150351 2015-10-19 18:33:02 -0700 GCAwareJITStubRoutineWithExceptionHandler has a stale CodeBlock pointer in its destructor 2015-10-20 11:39:09 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 saam saam benjamin fpizlo ggaren gskachkov keith_miller mark.lam msaboff oliver sukolsak ysuzuki oldest_to_newest 1134777 0 saam 2015-10-19 18:33:02 -0700 The problem is that we may regenerate many GCAwareJITStubRoutineWithExceptionHandler stubs per one PolymorphicAccess. Only the last GCAwareJITStubRoutineWithExceptionHandler stub that was generated will get the CodeBlock's aboutToDie() notification. All other GCAwareJITStubRoutineWithExceptionHandler stubs will still be holding a stale CodeBlock pointer that they will use in their destructor. The solution is to have GCAwareJITStubRoutineWithExceptionHandler remove its exception handler in observeZeroRefCount() instead of its destructor. observeZeroRefCount() will run when a PolymorphicAccess replaces its m_stubRoutine. 1134778 1 263539 saam 2015-10-19 18:38:35 -0700 Created attachment 263539 patch 1134782 2 263539 mark.lam 2015-10-19 19:05:06 -0700 Comment on attachment 263539 patch View in context: https://bugs.webkit.org/attachment.cgi?id=263539&action=review r=me > Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp:129 > +GCAwareJITStubRoutineWithExceptionHandler::~GCAwareJITStubRoutineWithExceptionHandler() > +{ > } maybe get rid of the destructor now since you don't need it anymore. > Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h:101 > ~GCAwareJITStubRoutineWithExceptionHandler() override; No need to override if we don't need it. 1134950 3 saam 2015-10-20 11:39:09 -0700 Thanks for the review. I've included your suggestions in the landed patch. landed in: http://trac.webkit.org/changeset/191350 263539 2015-10-19 18:38:35 -0700 2015-10-19 19:05:06 -0700 patch c-backup.diff text/plain 3445 saam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTkxMzI0KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIzIEBA CisyMDE1LTEwLTE5ICBTYWFtIGJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg IEdDQXdhcmVKSVRTdHViUm91dGluZVdpdGhFeGNlcHRpb25IYW5kbGVyIGhhcyBhIHN0YWxlIENv ZGVCbG9jayBwb2ludGVyIGluIGl0cyBkZXN0cnVjdG9yCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTAzNTEKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXZSBtYXkgcmVnZW5lcmF0ZSBtYW55IEdDQXdhcmVK SVRTdHViUm91dGluZVdpdGhFeGNlcHRpb25IYW5kbGVyIHN0dWJzIHBlciBvbmUgUG9seW1vcnBo aWNBY2Nlc3MuCisgICAgICAgIE9ubHkgdGhlIGxhc3QgR0NBd2FyZUpJVFN0dWJSb3V0aW5lV2l0 aEV4Y2VwdGlvbkhhbmRsZXIgc3R1YiB0aGF0IHdhcyBnZW5lcmF0ZWQgd2lsbCBnZXQgdGhlIENv ZGVCbG9jaydzIGFib3V0VG9EaWUoKQorICAgICAgICBub3RpZmljYXRpb24uIEFsbCBvdGhlciBH Q0F3YXJlSklUU3R1YlJvdXRpbmVXaXRoRXhjZXB0aW9uSGFuZGxlciBzdHVicyB3aWxsIHN0aWxs IGJlIGhvbGRpbmcgYSBzdGFsZSBDb2RlQmxvY2sgcG9pbnRlcgorICAgICAgICB0aGF0IHRoZXkg d2lsbCB1c2UgaW4gdGhlaXIgZGVzdHJ1Y3Rvci4gVGhlIHNvbHV0aW9uIGlzIHRvIGhhdmUgR0NB d2FyZUpJVFN0dWJSb3V0aW5lV2l0aEV4Y2VwdGlvbkhhbmRsZXIgcmVtb3ZlIGl0cworICAgICAg ICBleGNlcHRpb24gaGFuZGxlciBpbiBvYnNlcnZlWmVyb1JlZkNvdW50KCkgaW5zdGVhZCBvZiBp dHMgZGVzdHJ1Y3Rvci4gb2JzZXJ2ZVplcm9SZWZDb3VudCgpIHdpbGwgcnVuIHdoZW4gYSBQb2x5 bW9ycGhpY0FjY2VzcworICAgICAgICByZXBsYWNlcyBpdHMgbV9zdHViUm91dGluZS4KKworICAg ICAgICAqIGppdC9HQ0F3YXJlSklUU3R1YlJvdXRpbmUuY3BwOgorICAgICAgICAoSlNDOjpHQ0F3 YXJlSklUU3R1YlJvdXRpbmVXaXRoRXhjZXB0aW9uSGFuZGxlcjo6YWJvdXRUb0RpZSk6CisgICAg ICAgIChKU0M6OkdDQXdhcmVKSVRTdHViUm91dGluZVdpdGhFeGNlcHRpb25IYW5kbGVyOjpvYnNl cnZlWmVyb1JlZkNvdW50KToKKyAgICAgICAgKEpTQzo6R0NBd2FyZUpJVFN0dWJSb3V0aW5lV2l0 aEV4Y2VwdGlvbkhhbmRsZXI6On5HQ0F3YXJlSklUU3R1YlJvdXRpbmVXaXRoRXhjZXB0aW9uSGFu ZGxlcik6CisgICAgICAgICogaml0L0dDQXdhcmVKSVRTdHViUm91dGluZS5oOgorCiAyMDE1LTEw LTE5ICBTYWFtIGJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgogCiAgICAgICAgIEZUTCBzaG91 bGQgZ2VuZXJhdGUgYSB1bmlxdWUgT1NSIGV4aXQgZm9yIGVhY2ggZHVwbGljYXRlZCBPU1IgZXhp dCBzdGFja21hcCBpbnRyaW5zaWMuCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0dD QXdhcmVKSVRTdHViUm91dGluZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRD b3JlL2ppdC9HQ0F3YXJlSklUU3R1YlJvdXRpbmUuY3BwCShyZXZpc2lvbiAxOTEzMDcpCisrKyBT b3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0dDQXdhcmVKSVRTdHViUm91dGluZS5jcHAJKHdvcmtp bmcgY29weSkKQEAgLTExMywxMiArMTEzLDE5IEBAIHZvaWQgR0NBd2FyZUpJVFN0dWJSb3V0aW5l V2l0aEV4Y2VwdGlvbkgKICAgICBtX2NvZGVCbG9ja1dpdGhFeGNlcHRpb25IYW5kbGVyID0gbnVs bHB0cjsKIH0KIAotR0NBd2FyZUpJVFN0dWJSb3V0aW5lV2l0aEV4Y2VwdGlvbkhhbmRsZXI6On5H Q0F3YXJlSklUU3R1YlJvdXRpbmVXaXRoRXhjZXB0aW9uSGFuZGxlcigpCit2b2lkIEdDQXdhcmVK SVRTdHViUm91dGluZVdpdGhFeGNlcHRpb25IYW5kbGVyOjpvYnNlcnZlWmVyb1JlZkNvdW50KCkK IHsKICAgICBpZiAobV9jb2RlQmxvY2tXaXRoRXhjZXB0aW9uSGFuZGxlcikgewogICAgICAgICBt X2NvZGVCbG9ja1dpdGhFeGNlcHRpb25IYW5kbGVyLT5qaXRDb2RlKCktPmRmZ0NvbW1vbigpLT5y ZW1vdmVDYWxsU2l0ZUluZGV4KG1fZXhjZXB0aW9uSGFuZGxlckNhbGxTaXRlSW5kZXgpOwogICAg ICAgICBtX2NvZGVCbG9ja1dpdGhFeGNlcHRpb25IYW5kbGVyLT5yZW1vdmVFeGNlcHRpb25IYW5k bGVyRm9yQ2FsbFNpdGUobV9leGNlcHRpb25IYW5kbGVyQ2FsbFNpdGVJbmRleCk7CisgICAgICAg IG1fY29kZUJsb2NrV2l0aEV4Y2VwdGlvbkhhbmRsZXIgPSBudWxscHRyOwogICAgIH0KKworICAg IEJhc2U6Om9ic2VydmVaZXJvUmVmQ291bnQoKTsKK30KKworR0NBd2FyZUpJVFN0dWJSb3V0aW5l V2l0aEV4Y2VwdGlvbkhhbmRsZXI6On5HQ0F3YXJlSklUU3R1YlJvdXRpbmVXaXRoRXhjZXB0aW9u SGFuZGxlcigpCit7CiB9CiAgICAgCiAKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQv R0NBd2FyZUpJVFN0dWJSb3V0aW5lLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRD b3JlL2ppdC9HQ0F3YXJlSklUU3R1YlJvdXRpbmUuaAkocmV2aXNpb24gMTkxMzA3KQorKysgU291 cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9HQ0F3YXJlSklUU3R1YlJvdXRpbmUuaAkod29ya2luZyBj b3B5KQpAQCAtOTUsMTAgKzk1LDEzIEBAIHByaXZhdGU6CiAvLyBmb3IgbmV3IGV4Y2VwdGlvbiBo YW5kbGVycyB0byB1c2UgdGhlIHNhbWUgQ2FsbFNpdGVJbmRleC4KIGNsYXNzIEdDQXdhcmVKSVRT dHViUm91dGluZVdpdGhFeGNlcHRpb25IYW5kbGVyIDogcHVibGljIEdDQXdhcmVKSVRTdHViUm91 dGluZSB7CiBwdWJsaWM6CisgICAgdHlwZWRlZiBHQ0F3YXJlSklUU3R1YlJvdXRpbmUgQmFzZTsK KwogICAgIEdDQXdhcmVKSVRTdHViUm91dGluZVdpdGhFeGNlcHRpb25IYW5kbGVyKGNvbnN0IE1h Y3JvQXNzZW1ibGVyQ29kZVJlZiYsIFZNJiwgQ29kZUJsb2NrKiwgQ2FsbFNpdGVJbmRleCk7CiAg ICAgfkdDQXdhcmVKSVRTdHViUm91dGluZVdpdGhFeGNlcHRpb25IYW5kbGVyKCkgb3ZlcnJpZGU7 CiAKICAgICB2b2lkIGFib3V0VG9EaWUoKSBvdmVycmlkZTsKKyAgICB2b2lkIG9ic2VydmVaZXJv UmVmQ291bnQoKSBvdmVycmlkZTsKIAogcHJpdmF0ZToKICAgICBDb2RlQmxvY2sqIG1fY29kZUJs b2NrV2l0aEV4Y2VwdGlvbkhhbmRsZXI7Cg==