102411 2012-11-15 10:17:43 -0800 Windows Fibers can corrupt the cached StackBounds 2012-11-15 10:53:51 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mhahnenberg mhahnenberg benjamin ggaren oliver webkit.review.bot oldest_to_newest 768244 0 mhahnenberg 2012-11-15 10:17:43 -0800 Windows has support for something called fibers, which are like lightweight versions of threads. Multiple fibers can run within the context of a single thread and they have access to the same thread local storage but have different stacks. If we create a new JSGlobalContext on one fiber, then switch to another fiber and create a JSGlobalContext there, we will call initializeThreading() once for each new JSGlobalContext created. However, since these fibers are technically running inside the same thread, they will clobber each other's wtfThreadData(), which is stored using thread local storage. This can lead to corruption of the WTFThreadData structure for the fibers other than the last one to create a new JSGlobalContext, including the StackBounds data structure which is used during conservative scanning, among other things. This can lead to crashes during garbage collection on Windows if fibers are used. A quick fix would be to always get a fresh StackBounds data structure when asking for it instead of using the cached version from the thread local storage. There is a larger problem in that these fibers can corrupt other WebKit data that uses thread local storage. We'll leave those theoretical fixes for future theoretical bugs. 768284 1 174485 mhahnenberg 2012-11-15 10:42:31 -0800 Created attachment 174485 Patch 768291 2 174485 ggaren 2012-11-15 10:46:58 -0800 Comment on attachment 174485 Patch r=me This will fix cases that schedule one fiber at a time; we still don't support fiber A switching to fiber B recursively, since the stack will be discontiguous in that case. 768297 3 oliver 2012-11-15 10:49:48 -0800 Where are we using fibers??? 768300 4 mhahnenberg 2012-11-15 10:50:59 -0800 (In reply to comment #3) > Where are we using fibers??? Clients of JSC on Windows could use fibers. 768302 5 mhahnenberg 2012-11-15 10:52:42 -0800 <rdar://problem/12679639> 768304 6 mhahnenberg 2012-11-15 10:53:51 -0800 Committed r134797: <http://trac.webkit.org/changeset/134797> 174485 2012-11-15 10:42:31 -0800 2012-11-15 10:46:57 -0800 Patch bug-102411-20121115104028.patch text/plain 2762 mhahnenberg SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh bmdlTG9nCShyZXZpc2lvbiAxMzQ3OTQpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDMwIEBACisyMDEyLTExLTE1ICBNYXJrIEhhaG5lbmJlcmcgIDxt aGFobmVuYmVyZ0BhcHBsZS5jb20+CisKKyAgICAgICAgV2luZG93cyBGaWJlcnMgY2FuIGNvcnJ1 cHQgdGhlIGNhY2hlZCBTdGFja0JvdW5kcworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTAyNDExCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgV2luZG93cyBoYXMgc3VwcG9ydCBmb3Igc29tZXRoaW5nIGNhbGxl ZCBmaWJlcnMsIHdoaWNoIGFyZSBsaWtlIGxpZ2h0d2VpZ2h0IHZlcnNpb25zIG9mIAorICAgICAg ICB0aHJlYWRzLiBNdWx0aXBsZSBmaWJlcnMgY2FuIHJ1biB3aXRoaW4gdGhlIGNvbnRleHQgb2Yg YSBzaW5nbGUgdGhyZWFkIGFuZCB0aGV5IGhhdmUgYWNjZXNzIAorICAgICAgICB0byB0aGUgc2Ft ZSB0aHJlYWQgbG9jYWwgc3RvcmFnZSBidXQgaGF2ZSBkaWZmZXJlbnQgc3RhY2tzLiBJZiB3ZSBj cmVhdGUgYSBuZXcgSlNHbG9iYWxDb250ZXh0IAorICAgICAgICBvbiBvbmUgZmliZXIsIHRoZW4g c3dpdGNoIHRvIGFub3RoZXIgZmliZXIgYW5kIGNyZWF0ZSBhIEpTR2xvYmFsQ29udGV4dCB0aGVy ZSwgd2Ugd2lsbCBjYWxsIAorICAgICAgICBpbml0aWFsaXplVGhyZWFkaW5nKCkgb25jZSBmb3Ig ZWFjaCBuZXcgSlNHbG9iYWxDb250ZXh0IGNyZWF0ZWQuIEhvd2V2ZXIsIHNpbmNlIHRoZXNlIGZp YmVycyAKKyAgICAgICAgYXJlIHRlY2huaWNhbGx5IHJ1bm5pbmcgaW5zaWRlIHRoZSBzYW1lIHRo cmVhZCwgdGhleSB3aWxsIGNsb2JiZXIgZWFjaCBvdGhlcidzIHd0ZlRocmVhZERhdGEoKSwgCisg ICAgICAgIHdoaWNoIGlzIHN0b3JlZCB1c2luZyB0aHJlYWQgbG9jYWwgc3RvcmFnZS4gVGhpcyBj YW4gbGVhZCB0byBjb3JydXB0aW9uIG9mIHRoZSBXVEZUaHJlYWREYXRhIAorICAgICAgICBzdHJ1 Y3R1cmUgZm9yIHRoZSBmaWJlcnMgb3RoZXIgdGhhbiB0aGUgbGFzdCBvbmUgdG8gY3JlYXRlIGEg bmV3IEpTR2xvYmFsQ29udGV4dCwgaW5jbHVkaW5nIAorICAgICAgICB0aGUgU3RhY2tCb3VuZHMg ZGF0YSBzdHJ1Y3R1cmUgd2hpY2ggaXMgdXNlZCBkdXJpbmcgY29uc2VydmF0aXZlIHNjYW5uaW5n LCBhbW9uZyBvdGhlciB0aGluZ3MuIAorICAgICAgICBUaGlzIGNhbiBsZWFkIHRvIGNyYXNoZXMg ZHVyaW5nIGdhcmJhZ2UgY29sbGVjdGlvbiBvbiBXaW5kb3dzIGlmIGZpYmVycyBhcmUgdXNlZC4K KworICAgICAgICBBIHF1aWNrIGZpeCB3b3VsZCBiZSB0byBhbHdheXMgZ2V0IGEgZnJlc2ggU3Rh Y2tCb3VuZHMgZGF0YSBzdHJ1Y3R1cmUgd2hlbiBhc2tpbmcgZm9yIGl0IAorICAgICAgICBpbnN0 ZWFkIG9mIHVzaW5nIHRoZSBjYWNoZWQgdmVyc2lvbiBmcm9tIHRoZSB0aHJlYWQgbG9jYWwgc3Rv cmFnZS4gVGhlcmUgaXMgYSBsYXJnZXIgcHJvYmxlbSAKKyAgICAgICAgaW4gdGhhdCB0aGVzZSBm aWJlcnMgY2FuIGNvcnJ1cHQgb3RoZXIgV2ViS2l0IGRhdGEgdGhhdCB1c2VzIHRocmVhZCBsb2Nh bCBzdG9yYWdlLiBXZSdsbCBsZWF2ZSAKKyAgICAgICAgdGhvc2UgdGhlb3JldGljYWwgZml4ZXMg Zm9yIGZ1dHVyZSB0aGVvcmV0aWNhbCBidWdzLgorCisgICAgICAgICogd3RmL1dURlRocmVhZERh dGEuaDoKKyAgICAgICAgKFdURjo6V1RGVGhyZWFkRGF0YTo6c3RhY2spOiBXZSBub3cgcmVmcmVz aCB0aGUgbV9zdGFja0JvdW5kcyBmaWVsZCB3aGVuZXZlciBzb21lYm9keSBhc2tzIGZvciAKKyAg ICAgICAgdGhlIFN0YWNrQm91bmRzLgorCiAyMDEyLTExLTE1ICBNYWNpZWogU3RhY2hvd2lhayAg PG1qc0BhcHBsZS5jb20+CiAKICAgICAgICAgRml4IGFuIGVycm9uZW91cyBjb21tZW50IGFib3V0 IHRoZSBvcGVyYXRvcnMgcmVxdWlyZWQgYnkgYmluYXJ5U2VhcmNoCkluZGV4OiBTb3VyY2UvV1RG L3d0Zi9XVEZUaHJlYWREYXRhLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dURi93dGYvV1RGVGhy ZWFkRGF0YS5oCShyZXZpc2lvbiAxMzQ3OTIpCisrKyBTb3VyY2UvV1RGL3d0Zi9XVEZUaHJlYWRE YXRhLmgJKHdvcmtpbmcgY29weSkKQEAgLTEwNSw4ICsxMDUsMTMgQEAgcHVibGljOgogICAgICAg ICBtX2N1cnJlbnRJZGVudGlmaWVyVGFibGUgPSBtX2RlZmF1bHRJZGVudGlmaWVyVGFibGU7CiAg ICAgfQogCi0gICAgY29uc3QgU3RhY2tCb3VuZHMmIHN0YWNrKCkgY29uc3QKKyAgICBjb25zdCBT dGFja0JvdW5kcyYgc3RhY2soKQogICAgIHsKKyAgICAgICAgLy8gV2UgbmVlZCB0byBhbHdheXMg Z2V0IGEgZnJlc2ggU3RhY2tCb3VuZHMgZnJvbSB0aGUgT1MgZHVlIHRvIGhvdyBmaWJlcnMgd29y ay4KKyAgICAgICAgLy8gU2VlIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD0xMDI0MTEKKyNpZiBPUyhXSU5ET1dTKQorICAgICAgICBtX3N0YWNrQm91bmRzID0gU3RhY2tC b3VuZHM6OmN1cnJlbnRUaHJlYWRTdGFja0JvdW5kcygpOworI2VuZGlmCiAgICAgICAgIHJldHVy biBtX3N0YWNrQm91bmRzOwogICAgIH0KIAo=