135352 2014-07-28 14:17:16 -0700 ASSERTION FAILED: m_heap->vm()->currentThreadIsHoldingAPILock() 2014-07-28 15:19:33 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mhahnenberg mhahnenberg commit-queue oldest_to_newest 1025229 0 mhahnenberg 2014-07-28 14:17:16 -0700 ASSERTION FAILED: m_heap->vm()->currentThreadIsHoldingAPILock() /Volumes/Data/Development/OSX/webkit/OpenSource/Source/JavaScriptCore/heap/MarkedAllocator.cpp(164) : void *JSC::MarkedAllocator::allocateSlowCase(size_t) 1 0x10fa6b5c0 WTFCrash 2 0x10f83cfe5 JSC::MarkedAllocator::allocateSlowCase(unsigned long) 3 0x10f2406a1 JSC::MarkedAllocator::allocate(unsigned long) 4 0x10f252c19 JSC::MarkedSpace::allocateWithImmortalStructureDestructor(unsigned long) 5 0x10f252be6 JSC::Heap::allocateWithImmortalStructureDestructor(unsigned long) 6 0x10f976a67 void* JSC::allocateCell<JSC::PropertyTable>(JSC::Heap&, unsigned long) 7 0x10f97623f void* JSC::allocateCell<JSC::PropertyTable>(JSC::Heap&) 8 0x10f975723 JSC::PropertyTable::clone(JSC::VM&, JSC::PropertyTable const&) 9 0x10f9e43c2 JSC::PropertyTable::copy(JSC::VM&, unsigned int) 10 0x10f9df720 JSC::Structure::materializePropertyMap(JSC::VM&) 11 0x10f2444c3 JSC::Structure::materializePropertyMapIfNecessary(JSC::VM&, JSC::PropertyTable*&) 12 0x10f241fc3 JSC::Structure::get(JSC::VM&, JSC::PropertyName, unsigned int&, JSC::JSCell*&) 13 0x10f245aee JSC::JSObject::inlineGetOwnPropertySlot(JSC::VM&, JSC::Structure&, JSC::PropertyName, JSC::PropertySlot&) 14 0x10f23e58a JSC::JSObject::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) 15 0x10f723749 bool JSC::getStaticFunctionSlot<JSC::JSSegmentedVariableObject>(JSC::ExecState*, JSC::HashTable const&, JSC::JSObject*, JSC::PropertyName, JSC::PropertySlot&) 16 0x10f70fbec JSC::JSGlobalObject::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) 17 0x112fcbc9c WebCore::JSDOMWindow::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) 18 0x1124c1de7 JSC::JSObject::fastGetOwnPropertySlot(JSC::ExecState*, JSC::VM&, JSC::Structure&, JSC::PropertyName, JSC::PropertySlot&) 19 0x1124c1bc6 JSC::JSObject::getPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) 20 0x1124c0e48 JSC::JSObject::get(JSC::ExecState*, JSC::PropertyName) const 21 0x113734350 WebCore::QuickTimePluginReplacement::ensureReplacementScriptInjected() ensureReplacementScriptInjected should be taking a JSLock like its sibling methods do (e.g. installReplacement). 1025230 1 mhahnenberg 2014-07-28 14:17:42 -0700 <rdar://problem/17833422> 1025234 2 235616 mhahnenberg 2014-07-28 14:20:23 -0700 Created attachment 235616 Patch 1025257 3 235616 commit-queue 2014-07-28 15:19:28 -0700 Comment on attachment 235616 Patch Clearing flags on attachment: 235616 Committed r171703: <http://trac.webkit.org/changeset/171703> 1025258 4 commit-queue 2014-07-28 15:19:33 -0700 All reviewed patches have been landed. Closing bug. 235616 2014-07-28 14:20:23 -0700 2014-07-28 15:19:28 -0700 Patch bug-135352-20140728142009.patch text/plain 1605 mhahnenberg SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3MTY5NCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDE0LTA3LTI4ICBNYXJrIEhh aG5lbmJlcmcgIDxtaGFobmVuYmVyZ0BhcHBsZS5jb20+CisKKyAgICAgICAgQVNTRVJUSU9OIEZB SUxFRDogbV9oZWFwLT52bSgpLT5jdXJyZW50VGhyZWFkSXNIb2xkaW5nQVBJTG9jaygpCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzUzNTIKKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIE1vZHVsZXMvcGx1 Z2lucy9RdWlja1RpbWVQbHVnaW5SZXBsYWNlbWVudC5tbToKKyAgICAgICAgKFdlYkNvcmU6OlF1 aWNrVGltZVBsdWdpblJlcGxhY2VtZW50OjplbnN1cmVSZXBsYWNlbWVudFNjcmlwdEluamVjdGVk KTogVGhpcyBzaG91bGQgYmUgdGFraW5nIGEgCisgICAgICAgIEpTTG9jayBsaWtlIGl0cyBzaWJs aW5nIG1ldGhvZHMgZG8gKGUuZy4gaW5zdGFsbFJlcGxhY2VtZW50KS4KKwogMjAxNC0wNy0yOCAg QW5kcmVhcyBLbGluZyAgPGFrbGluZ0BhcHBsZS5jb20+CiAKICAgICAgICAgUkVHUkVTU0lPTiAo cjE2MDgwNik6IENTUyB6b29tIHByb3BlcnR5IGRvZXNuJ3Qgd29yayBvbiBhbnl0aGluZyBpbnNp ZGUgYW5jaG9ycy4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL01vZHVsZXMvcGx1Z2lucy9RdWlja1Rp bWVQbHVnaW5SZXBsYWNlbWVudC5tbQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9Nb2R1 bGVzL3BsdWdpbnMvUXVpY2tUaW1lUGx1Z2luUmVwbGFjZW1lbnQubW0JKHJldmlzaW9uIDE3MTY5 MikKKysrIFNvdXJjZS9XZWJDb3JlL01vZHVsZXMvcGx1Z2lucy9RdWlja1RpbWVQbHVnaW5SZXBs YWNlbWVudC5tbQkod29ya2luZyBjb3B5KQpAQCAtMTU5LDYgKzE1OSw3IEBAIGJvb2wgUXVpY2tU aW1lUGx1Z2luUmVwbGFjZW1lbnQ6OmVuc3VyZVIKICAgICBTY3JpcHRDb250cm9sbGVyJiBzY3Jp cHRDb250cm9sbGVyID0gcGFnZS0+bWFpbkZyYW1lKCkuc2NyaXB0KCk7CiAgICAgSlNET01HbG9i YWxPYmplY3QqIGdsb2JhbE9iamVjdCA9IEpTQzo6anNDYXN0PEpTRE9NR2xvYmFsT2JqZWN0Kj4o c2NyaXB0Q29udHJvbGxlci5nbG9iYWxPYmplY3Qod29ybGQpKTsKICAgICBKU0M6OkV4ZWNTdGF0 ZSogZXhlYyA9IGdsb2JhbE9iamVjdC0+Z2xvYmFsRXhlYygpOworICAgIEpTQzo6SlNMb2NrSG9s ZGVyIGxvY2soZXhlYyk7CiAgICAgCiAgICAgSlNDOjpKU1ZhbHVlIHJlcGxhY2VtZW50RnVuY3Rp b24gPSBnbG9iYWxPYmplY3QtPmdldChleGVjLCBKU0M6OklkZW50aWZpZXIoZXhlYywgImNyZWF0 ZVBsdWdpblJlcGxhY2VtZW50IikpOwogICAgIGlmIChyZXBsYWNlbWVudEZ1bmN0aW9uLmlzRnVu Y3Rpb24oKSkK