Bug 16920 - Crash inside garbage collector with simple code
Summary: Crash inside garbage collector with simple code
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Windows Vista
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2008-01-17 22:36 PST by Cameron McCormack (:heycam)
Modified: 2012-03-11 14:55 PDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Cameron McCormack (:heycam) 2008-01-17 22:36:47 PST
With some simple use of the JSCore API, I get a crash when calling JSGarbageCollect().

Reduced test case by bdash:

// Put me in test.c
// gcc -o test test.c -framework JavaScriptCore
// Run me against a debug build of JavaScriptCore like so:
// DYLD_FRAMEWORK_PATH=WebKitBuild/Debug DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib ./test

#include <JavaScriptCore/JavaScriptCore.h>
#include <stdio.h>

void doIt()
{
  JSClassDefinition definition = kJSClassDefinitionEmpty;
  JSClassRef a, b;
  JSGlobalContextRef global;
  definition.className = "A";
  a = JSClassCreate(&definition);

  definition = kJSClassDefinitionEmpty;
  definition.className = "B";
  definition.parentClass = a;
  b = JSClassCreate(&definition);

  global = JSGlobalContextCreate(b);
  JSGlobalContextRelease(global);
  JSClassRelease(b);
  JSClassRelease(a);
  JSGarbageCollect(NULL);
  printf("Done\n");
}


int main(int argc, char **argv)
{
  int i;
  for (i = 0; i < 1000; i++)
    doIt();
  return 0;
}
Comment 1 Cameron McCormack (:heycam) 2008-01-17 22:38:03 PST
Backtrack from bdash:

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000b0812fd0
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.JavaScriptCore              0x002d7df3 KJS::JSCallbackObject<KJS::JSGlobalObject>::~JSCallbackObject() + 57 (JSCallbackObjectFunctions.h:86)
1   com.apple.JavaScriptCore              0x002d7e63 KJS::JSCallbackObject<KJS::JSGlobalObject>::~JSCallbackObject() + 17 (JSCallbackObjectFunctions.h:90)
2   com.apple.JavaScriptCore              0x002a6f70 unsigned long KJS::Collector::sweep<(KJS::Collector::HeapType)0>(bool) + 760 (collector.cpp:883)
3   com.apple.JavaScriptCore              0x00277dee KJS::Collector::collect() + 382 (collector.cpp:963)
4   com.apple.JavaScriptCore              0x002d17b8 JSGarbageCollect + 34 (JSBase.cpp:83)
5   test                                  0x00001fba doIt + 192
6   test                                  0x00001fe2 main + 20
7   test                                  0x00001ece start + 54

And one from me, on Windows:

>        myapp.exe!KJS::JSCallbackObject<KJS::JSGlobalObject>::~JSCallbackObject<KJS::JSGlobalObject>()  Line 105 + 0x7 bytes        C++
         myapp.exe!KJS::JSCallbackObject<KJS::JSGlobalObject>::`scalar deleting destructor'()  + 0xf bytes        C++
         myapp.exe!KJS::Collector::sweep<0>(bool currentThreadIsMainThread=false)  Line 883        C++
         myapp.exe!KJS::Collector::collect()  Line 963 + 0x9 bytes        C++
         myapp.exe!JSGarbageCollect(const OpaqueJSContext * __formal=0x00000000)  Line 87        C++
         myapp.exe!myfunction(void * pUserData=0x020d734c, void * pDocument=0x020cfdf8, void * * ppDocumentUserData=0x020d16e4)  Line 271 + 0x7 bytes        C
Comment 2 Mark Rowe (bdash) 2008-01-17 22:43:03 PST
<rdar://problem/5694270>
Comment 3 Cameron McCormack (:heycam) 2008-01-29 22:40:29 PST
A workaround is to do an additional JSGarbageCollect() just before the JSGlobalContextRelease() call.

I wonder whether making OpaqueJSClass retain its parentClass would solve the problem.
Comment 4 Gavin Barraclough 2012-03-11 14:55:31 PDT
Works for me in ToT, looks like this has been fixed.  Please reopen if you can still repro the problem.

cheers, G.