Patch from Igor:
Patch from Igor:

I must admit this is very subtitle, but still...

Here are the lines from
    public void defineProperty(String propertyName, Object delegateTo,
                               Method getter, Method setter, int attributes)


        GetterSlot slot = (GetterSlot)getSlotToSet(propertyName,
                                                   propertyName.hashCode(),
                                                   true);
        slot.delegateTo = delegateTo;
        slot.getter = getter;
        slot.setter = setter;
        slot.setterReturnsValue = setter != null && setter.getReturnType() != Void.TYPE;
        slot.value = null;
        slot.attributes = (short) attributes;
        slot.flags = (byte)flags;

Now suppose that after the new slot is added, another thread is accessing it. Then it would see not yet ready slot with all nasty consequences! For example,  SMP computer can re-arrange writes so the new value of slot.flags would be visible before slot.getter then another thread would generate null pointer exception.

race2_fix.diff fixes that by using the explicit Slot argument to addSlot instead of boolean flag so the new slot can be fully initialized and then inserted under synchronization to the table. I also call addSlot directly because it is supposed to be used with not-yet existed properties and split addSlot to addSlot and addSlotImpl so in case of table growth there is no need to re-enter already synchronized monitor.

This changes also allows to explicitly throw RuntimeException if defineProperty is called for the property that is already exists instead of either throwing cast exception in "GetterSlot slot = (GetterSlot)getSlotToSet(propertyName," or worth yet re-initializing already existed slot.

Regards, Igor

lv7777/egit_test,Angelfirenze/rhino,tejassaoji/RhinoCoarseTainting,AlexTrotsenko/rhino,qhanam/rhino,Angelfirenze/rhino,swannodette/rhino,Pilarbrist/rhino,Angelfirenze/rhino,jsdoc3/rhino,tejassaoji/RhinoCoarseTainting,ashwinrayaprolu1984/rhino,sam/htmlunit-rhino-fork,sam/htmlunit-rhino-fork,lv7777/egit_test,ashwinrayaprolu1984/rhino,tejassaoji/RhinoCoarseTainting,Pilarbrist/rhino,tuchida/rhino,Pilarbrist/rhino,sainaen/rhino,tntim96/rhino-jscover-repackaged,AlexTrotsenko/rhino,tntim96/htmlunit-rhino-fork,InstantWebP2P/rhino-android,ashwinrayaprolu1984/rhino,sainaen/rhino,tntim96/rhino-jscover,swannodette/rhino,Pilarbrist/rhino,AlexTrotsenko/rhino,tntim96/rhino-apigee,sam/htmlunit-rhino-fork,AlexTrotsenko/rhino,swannodette/rhino,tntim96/rhino-apigee,qhanam/rhino,Distrotech/rhino,ashwinrayaprolu1984/rhino,lv7777/egit_test,lv7777/egit_test,tejassaoji/RhinoCoarseTainting,AlexTrotsenko/rhino,sam/htmlunit-rhino-fork,lv7777/egit_test,Pilarbrist/rhino,Distrotech/rhino,jsdoc3/rhino,tejassaoji/RhinoCoarseTainting,ashwinrayaprolu1984/rhino,Angelfirenze/rhino,Pilarbrist/rhino,swannodette/rhino,Pilarbrist/rhino,sam/htmlunit-rhino-fork,swannodette/rhino,swannodette/rhino,tuchida/rhino,tuchida/rhino,rasmuserik/rhino,ashwinrayaprolu1984/rhino,tejassaoji/RhinoCoarseTainting,tntim96/htmlunit-rhino-fork,sainaen/rhino,qhanam/rhino,sainaen/rhino,tuchida/rhino,sainaen/rhino,sam/htmlunit-rhino-fork,tntim96/rhino-apigee,jsdoc3/rhino,InstantWebP2P/rhino-android,swannodette/rhino,tntim96/rhino-jscover-repackaged,AlexTrotsenko/rhino,rasmuserik/rhino,sainaen/rhino,tejassaoji/RhinoCoarseTainting,sam/htmlunit-rhino-fork,sainaen/rhino,AlexTrotsenko/rhino,tuchida/rhino,Angelfirenze/rhino,lv7777/egit_test,Angelfirenze/rhino,ashwinrayaprolu1984/rhino,Angelfirenze/rhino,tntim96/rhino-jscover,tuchida/rhino,lv7777/egit_test,qhanam/rhino,tuchida/rhino