156532 2016-04-13 00:00:44 -0700 ShadowChicken::visitChildren() should not visit tailMarkers and throwMarkers. 2016-04-14 11:04:56 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam ap benjamin fpizlo ggaren keith_miller msaboff saam oldest_to_newest 1183348 0 mark.lam 2016-04-13 00:00:44 -0700 ShadowChicken can store tailMarkers and throwMarkers in its log, specifically in the callee field of a log packet. However, ShadowChicken::visitChildren() unconditionally visits the callee field of each packet as if they are real objects. If visitChildren() encounters one of these markers in the log, we get a crash. This crash was observed in the v8-v6/v8-regexp.js stress test running with shadow chicken when r199393 landed. r199393 introduced tail calls to a RegExp split fast path, and the v8-regexp.js test exercised this fast path a lot. Throw in some timely GCs, and we get a crash party. The fix is to have ShadowChicken::visitChildren() filter out the tailMarker and throwMarker. Alternatively, if perf is an issue, we can allocate 2 dedicated objects for these markers so that ShadowChicken can continue to visit them. For now, I'm going with the filter. 1183351 1 276308 mark.lam 2016-04-13 00:06:09 -0700 Created attachment 276308 proposed patch. 1183390 2 fpizlo 2016-04-13 07:22:02 -0700 R=me too 1183415 3 mark.lam 2016-04-13 09:10:48 -0700 Thanks for the review. Landed in r199496: <http://trac.webkit.org/r199496>. 1183761 4 mark.lam 2016-04-14 11:04:56 -0700 <rdar://problem/25630551> 276308 2016-04-13 00:06:09 -0700 2016-04-13 05:58:35 -0700 proposed patch. bug-156532.patch text/plain 2552 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTk5NDE2KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDMxIEBA CisyMDE2LTA0LTEzICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBT aGFkb3dDaGlja2VuOjp2aXNpdENoaWxkcmVuKCkgc2hvdWxkIG5vdCB2aXNpdCB0YWlsTWFya2Vy cyBhbmQgdGhyb3dNYXJrZXJzLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTU2NTMyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgU2hhZG93Q2hpY2tlbiBjYW4gc3RvcmUgdGFpbE1hcmtlcnMgYW5kIHRocm93 TWFya2VycyBpbiBpdHMgbG9nLCBzcGVjaWZpY2FsbHkgaW4KKyAgICAgICAgdGhlIGNhbGxlZSBm aWVsZCBvZiBhIGxvZyBwYWNrZXQuICBIb3dldmVyLCBTaGFkb3dDaGlja2VuOjp2aXNpdENoaWxk cmVuKCkKKyAgICAgICAgdW5jb25kaXRpb25hbGx5IHZpc2l0cyB0aGUgY2FsbGVlIGZpZWxkIG9m IGVhY2ggcGFja2V0IGFzIGlmIHRoZXkgYXJlIHJlYWwKKyAgICAgICAgb2JqZWN0cy4gIElmIHZp c2l0Q2hpbGRyZW4oKSBlbmNvdW50ZXJzIG9uZSBvZiB0aGVzZSBtYXJrZXJzIGluIHRoZSBsb2cs IHdlIGdldCBhCisgICAgICAgIGNyYXNoLgorCisgICAgICAgIFRoaXMgY3Jhc2ggd2FzIG9ic2Vy dmVkIGluIHRoZSB2OC12Ni92OC1yZWdleHAuanMgc3RyZXNzIHRlc3QgcnVubmluZyB3aXRoIHNo YWRvdworICAgICAgICBjaGlja2VuIHdoZW4gcjE5OTM5MyBsYW5kZWQuICByMTk5MzkzIGludHJv ZHVjZWQgdGFpbCBjYWxscyB0byBhIFJlZ0V4cCBzcGxpdAorICAgICAgICBmYXN0IHBhdGgsIGFu ZCB0aGUgdjgtcmVnZXhwLmpzIHRlc3QgZXhlcmNpc2VkIHRoaXMgZmFzdCBwYXRoIGEgbG90LiAg VGhyb3cgaW4KKyAgICAgICAgc29tZSB0aW1lbHkgR0NzLCBhbmQgd2UgZ2V0IGEgY3Jhc2ggcGFy dHkuCisKKyAgICAgICAgVGhlIGZpeCBpcyB0byBoYXZlIFNoYWRvd0NoaWNrZW46OnZpc2l0Q2hp bGRyZW4oKSBmaWx0ZXIgb3V0IHRoZSB0YWlsTWFya2VyIGFuZAorICAgICAgICB0aHJvd01hcmtl ci4KKworICAgICAgICBBbHRlcm5hdGl2ZWx5LCBpZiBwZXJmIGlzIGFuIGlzc3VlLCB3ZSBjYW4g YWxsb2NhdGUgMiBkZWRpY2F0ZWQgb2JqZWN0cyBmb3IKKyAgICAgICAgdGhlc2UgbWFya2VycyBz byB0aGF0IFNoYWRvd0NoaWNrZW4gY2FuIGNvbnRpbnVlIHRvIHZpc2l0IHRoZW0uICBGb3Igbm93 LCBJJ20KKyAgICAgICAgZ29pbmcgd2l0aCB0aGUgZmlsdGVyLgorCisgICAgICAgICogaW50ZXJw cmV0ZXIvU2hhZG93Q2hpY2tlbi5jcHA6CisgICAgICAgIChKU0M6OlNoYWRvd0NoaWNrZW46OnZp c2l0Q2hpbGRyZW4pOgorCiAyMDE2LTA0LTEyICBLZWl0aCBNaWxsZXIgIDxrZWl0aF9taWxsZXJA YXBwbGUuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQgdW5kbyBjaGFuZ2UgZnJvbSBBcnJheUNs YXNzIHRvIEFycmF5V2l0aFVuZGVjaWRlZCwgd2hpY2gKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9pbnRlcnByZXRlci9TaGFkb3dDaGlja2VuLmNwcAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvU2hhZG93Q2hpY2tlbi5jcHAJKHJldmlzaW9uIDE5 OTQwOCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnByZXRlci9TaGFkb3dDaGlja2Vu LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMzU0LDggKzM1NCwxMSBAQCB2b2lkIFNoYWRvd0NoaWNr ZW46OnVwZGF0ZShWTSYsIEV4ZWNTdGF0CiAKIHZvaWQgU2hhZG93Q2hpY2tlbjo6dmlzaXRDaGls ZHJlbihTbG90VmlzaXRvciYgdmlzaXRvcikKIHsKLSAgICBmb3IgKHVuc2lnbmVkIGkgPSBtX2xv Z0N1cnNvciAtIG1fbG9nOyBpLS07KQotICAgICAgICB2aXNpdG9yLmFwcGVuZFVuYmFycmllcmVk UmVhZE9ubHlQb2ludGVyKG1fbG9nW2ldLmNhbGxlZSk7CisgICAgZm9yICh1bnNpZ25lZCBpID0g bV9sb2dDdXJzb3IgLSBtX2xvZzsgaS0tOykgeworICAgICAgICBKU09iamVjdCogY2FsbGVlID0g bV9sb2dbaV0uY2FsbGVlOworICAgICAgICBpZiAoY2FsbGVlICE9IFBhY2tldDo6dGFpbE1hcmtl cigpICYmIGNhbGxlZSAhPSBQYWNrZXQ6OnRocm93TWFya2VyKCkpCisgICAgICAgICAgICB2aXNp dG9yLmFwcGVuZFVuYmFycmllcmVkUmVhZE9ubHlQb2ludGVyKGNhbGxlZSk7CisgICAgfQogICAg IAogICAgIGZvciAoRnJhbWUmIGZyYW1lIDogbV9zdGFjaykKICAgICAgICAgdmlzaXRvci5hcHBl bmRVbmJhcnJpZXJlZFJlYWRPbmx5UG9pbnRlcihmcmFtZS5jYWxsZWUpOwo=