Chrome的挥发性变量误差JS引擎?

发布于 2025-01-30 10:36:09 字数 531 浏览 2 评论 0原文

根据我的理解,在JS中,没有同步代码的种族条件。也就是说,在执行函数变量期间,只能通过1个执行线程访问。

但是,我已经遇到了这一点:

在此图像中,您可以观察第186行中的IF语句的谓词如何评估为true。 if语句中的代码仅包含返回语句。因此,线程无法逃脱IF语句。

一些函数正在调用的某些上下文:

这是服务工作者MV3扩展。

许多功能堆栈正在等待ClosePromise。一旦封闭的承诺解决,我的前提是要调用__innitialize的第一个“线程”将将if语句传递到执行线程中。当下一个“线程”调用__ Initialize时,第一个将将状态更改为初始化,因此他将输入第一个if语句,并等待Initpromise。

由于公司政策,我可能不再提供该片段。

According to my understanding, in JS there are not race conditions for synchronous code. That is, during the execution of a function variables should only be accessed by 1 executing thread.

However, I have run across this:
enter image description here

In this image you can observe how the predicate of the if statement in line 186 evaluates to true. The code inside the if statement contains only a return statement. Hence, there is no way the thread could have escaped the if statement.

Some context into what sort of functions are calling into this:

This is a service worker MV3 extension.

A number of function stacks are awaiting for the closePromise. Once the close promise resolves, my premise is that the first "thread" to call __innitialize will pass the if statements into the executing thread. When the next "thread" calls __initialize, then the first one would have changed the state to INITIALIZING, thus he would enter the first if statement, and await for the initPromise.

I may not provide anymore than this snippet due to company policy.

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

三生一梦 2025-02-06 10:36:09

(V8开发人员在这里。)
我同意在JavaScript中不会发生并发修改。另一个明显的解释(JS引擎未正确检查了病情)将是一个严重的(而且很明显!)。

但是,没有更多信息或repro,很难肯定地说什么。例如,如果是嵌入式提供的对象,而.__状态是一个截距的属性,那么任何事情都可能发生,并且完全不在V8的控制之外。您还在评论中提到“睡觉”:睡觉(和等待)是同步控制流的中断,因此,如果您的代码中有这样的东西,这也可以解释为什么事情似乎是“神奇地” “在这样的观点之后改变。

(V8 developer here.)
I agree that concurrent modification can't happen in JavaScript. The other obvious explanation (that the JS engine incorrectly checked the condition) would be a severe (and pretty obvious!) bug.

But without further information or a repro, it's hard to say anything for sure. For instance, if this is an embedder-provided object and .__state is an intercepted property, then anything could happen, and it's entirely outside of V8's control. You also mention "sleeping" in the comment: sleeping (and awaiting) are interruptions of synchronous control flow, so if you have such things in your code, that could also explain why things appear to "magically" change after such a point.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文