Chrome的挥发性变量误差JS引擎?
根据我的理解,在JS中,没有同步代码的种族条件。也就是说,在执行函数变量期间,只能通过1个执行线程访问。
在此图像中,您可以观察第186行中的IF语句的谓词如何评估为true。 if语句中的代码仅包含返回语句。因此,线程无法逃脱IF语句。
一些函数正在调用的某些上下文:
这是服务工作者MV3扩展。
许多功能堆栈正在等待ClosePromise。一旦封闭的承诺解决,我的前提是要调用__innitialize的第一个“线程”将将if语句传递到执行线程中。当下一个“线程”调用__ Initialize时,第一个将将状态更改为初始化,因此他将输入第一个if语句,并等待Initpromise。
由于公司政策,我可能不再提供该片段。
According to my understanding, in JS there are not race conditions for synchronous code. That is, during the execution of a function variables should only be accessed by 1 executing thread.
However, I have run across this:
In this image you can observe how the predicate of the if statement in line 186 evaluates to true. The code inside the if statement contains only a return statement. Hence, there is no way the thread could have escaped the if statement.
Some context into what sort of functions are calling into this:
This is a service worker MV3 extension.
A number of function stacks are awaiting for the closePromise. Once the close promise resolves, my premise is that the first "thread" to call __innitialize will pass the if statements into the executing thread. When the next "thread" calls __initialize, then the first one would have changed the state to INITIALIZING, thus he would enter the first if statement, and await for the initPromise.
I may not provide anymore than this snippet due to company policy.
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(1)
(V8开发人员在这里。)
我同意在JavaScript中不会发生并发修改。另一个明显的解释(JS引擎未正确检查了病情)将是一个严重的(而且很明显!)。
但是,没有更多信息或repro,很难肯定地说什么。例如,如果
此
是嵌入式提供的对象,而.__状态
是一个截距的属性,那么任何事情都可能发生,并且完全不在V8的控制之外。您还在评论中提到“睡觉”:睡觉(和等待
)是同步控制流的中断,因此,如果您的代码中有这样的东西,这也可以解释为什么事情似乎是“神奇地” “在这样的观点之后改变。(V8 developer here.)
I agree that concurrent modification can't happen in JavaScript. The other obvious explanation (that the JS engine incorrectly checked the condition) would be a severe (and pretty obvious!) bug.
But without further information or a repro, it's hard to say anything for sure. For instance, if
this
is an embedder-provided object and.__state
is an intercepted property, then anything could happen, and it's entirely outside of V8's control. You also mention "sleeping" in the comment: sleeping (andawait
ing) are interruptions of synchronous control flow, so if you have such things in your code, that could also explain why things appear to "magically" change after such a point.