<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>159537</bug_id>
          
          <creation_ts>2016-07-07 16:49:31 -0700</creation_ts>
          <short_desc>REGRESSION(184445): Need to insert a StoreBarrier when we don&apos;t know child&apos;s epoch</short_desc>
          <delta_ts>2016-07-07 20:48:36 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Major</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Michael Saboff">msaboff</reporter>
          <assigned_to name="Michael Saboff">msaboff</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>saam</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1208898</commentid>
    <comment_count>0</comment_count>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2016-07-07 16:49:31 -0700</bug_when>
    <thetext>In StoreBarrierInsertionPhase::considerBarrier(Edge base, Edge child), there is the following comment and code:

        // Something we watch out for here is that the null epoch is a catch-all for objects
        // allocated before we did any epoch tracking. Two objects being in the null epoch
        // means that we don&apos;t know their epoch relationship.
        if (!!base-&gt;epoch() &amp;&amp; base-&gt;epoch() &gt;= child-&gt;epoch()) {
            if (verbose)
                dataLog(&quot;            Rejecting because of epoch ordering.\n&quot;);
            return;
        }
The test doesn&apos;t check that the child&apos;s epoch is null and therefore we won&apos;t insert a barrier for the case where we allocate the base object, but don&apos;t know when the child object was allocated.

&lt;rdar://problem/23438751&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1208943</commentid>
    <comment_count>1</comment_count>
      <attachid>283101</attachid>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2016-07-07 19:58:54 -0700</bug_when>
    <thetext>Created attachment 283101
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1208956</commentid>
    <comment_count>2</comment_count>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2016-07-07 20:48:36 -0700</bug_when>
    <thetext>Committed r202955: &lt;http://trac.webkit.org/changeset/202955&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>283101</attachid>
            <date>2016-07-07 19:58:54 -0700</date>
            <delta_ts>2016-07-07 20:00:35 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>159537.patch</filename>
            <type>text/plain</type>
            <size>3867</size>
            <attacher name="Michael Saboff">msaboff</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjAyOTUzKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI5IEBA
CisyMDE2LTA3LTA3ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg
ICAgIFJFR1JFU1NJT04oMTg0NDQ1KTogTmVlZCB0byBpbnNlcnQgYSBTdG9yZUJhcnJpZXIgd2hl
biB3ZSBkb24ndCBrbm93IGNoaWxkJ3MgZXBvY2gKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp
dC5vcmcvc2hvd19idWcuY2dpP2lkPTE1OTUzNworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E
WSAoT09QUyEpLgorCisgICAgICAgIFdlIHdlcmVuJ3QgY2hlY2tpbmcgdGhlIGNhc2Ugb2YgYSBj
aGlsZCBub2RlIHdpdGggYSBudWxsIGVwb2NoLiAgVGhlIHByb2JsZW0gc3VyZmFjZXMKKyAgICAg
ICAgd2hlbiB0aGUgYmFzZSBub2RlIG9mIGEgUHV0QnlWYWwgdmFyaWFudCBoYXMgYSBub24tbnVs
bCBlcG9jaCwgYmVjYXVzZSBpdCByZXByZXNlbnRzIGFuCisgICAgICAgIGFsbG9jYXRpb24gaW4g
dGhlIGN1cnJlbnQgZnVuY3Rpb24sIHdoaWxlIHRoZSBjaGlsZCBvZiB0aGUgc2FtZSBub2RlIGhh
cyBhbiB1bmtub3duIGVwb2NoLgorICAgICAgICBBZGRlZCBhIGNoZWNrIHRoYXQgdGhlIGNoaWxk
IG5vZGUgaXMgbm90IG51bGwgYmVmb3JlIGNvbXBhcmluZyB0aGUgZXBvY2hzIG9mIHRoZSBiYXNl
IGFuZAorICAgICAgICBjaGlsZCBub2Rlcy4KKworICAgICAgICBUaGUgYWRkZWQgdGVzdCBjcmVh
dGVzIHRoZSBwcm9ibGVtIGNpcmN1bXN0YW5jZSBieSBkb2luZyBhIGZ1bGwgR0MgdG8gcGxhY2Ug
YW4gYXJyYXkgaW4KKyAgICAgICAgcmVtZW1iZXJlZCBzcGFjZSwgYWxsb2NhdGluZyBhIG5ldyBv
YmplY3QgZm9sbG93ZWQgYnkgYW4gZWRlbiBHQy4gIFRoZSBuZXcgb2JqZWN0IGlzCisgICAgICAg
IG9ubHkgcmVmZXJlbmNlZCBieSB0aGUgYXJyYXkgYW5kIHRoZXJlZm9yZSB3b24ndCBiZSB2aXNp
dGVkIFdpdGhvdXQgdGhlIHN0b3JlIGJhcnJpZXIuCisgICAgICAgIFRoZSB0ZXN0IG1heSBjcmFz
aCBvciBtb3JlIGxpa2VseSBnZXQgdGhlIHdyb25nIGFuc3dlciB3aXRoIHRoZSBidWcuCisKKyAg
ICAgICAgKiBkZmcvREZHU3RvcmVCYXJyaWVySW5zZXJ0aW9uUGhhc2UuY3BwOgorICAgICAgICAq
IHRlc3RzL3N0cmVzcy9yZWdyZXNzLTE1OTUzNy5qczogQWRkZWQgdGVzdC4KKyAgICAgICAgKE15
TnVtYmVyKToKKyAgICAgICAgKE15TnVtYmVyLnByb3RvdHlwZS5wbHVzT25lKToKKyAgICAgICAg
KGJhcik6CisgICAgICAgIChmb28pOgorICAgICAgICAodGVzdCk6CisKIDIwMTYtMDctMDcgIEJl
bmphbWluIFBvdWxhaW4gIDxiZW5qYW1pbkB3ZWJraXQub3JnPgogCiAgICAgICAgIFtKU0NdIEFy
cmF5LnByb3RvdHlwZVtTeW1ib2wudW5zY29wYWJsZXNdIHNob3VsZCBoYXZlIHRoZSAiaW5jbHVk
ZXMiIHByb3BlcnR5CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1N0b3JlQmFy
cmllckluc2VydGlvblBoYXNlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENv
cmUvZGZnL0RGR1N0b3JlQmFycmllckluc2VydGlvblBoYXNlLmNwcAkocmV2aXNpb24gMjAyOTQ0
KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTdG9yZUJhcnJpZXJJbnNlcnRpb25Q
aGFzZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTQ1OSwxMiArNDU5LDEyIEBAIHByaXZhdGU6CiAg
ICAgICAgIC8vIFNvbWV0aGluZyB3ZSB3YXRjaCBvdXQgZm9yIGhlcmUgaXMgdGhhdCB0aGUgbnVs
bCBlcG9jaCBpcyBhIGNhdGNoLWFsbCBmb3Igb2JqZWN0cwogICAgICAgICAvLyBhbGxvY2F0ZWQg
YmVmb3JlIHdlIGRpZCBhbnkgZXBvY2ggdHJhY2tpbmcuIFR3byBvYmplY3RzIGJlaW5nIGluIHRo
ZSBudWxsIGVwb2NoCiAgICAgICAgIC8vIG1lYW5zIHRoYXQgd2UgZG9uJ3Qga25vdyB0aGVpciBl
cG9jaCByZWxhdGlvbnNoaXAuCi0gICAgICAgIGlmICghIWJhc2UtPmVwb2NoKCkgJiYgYmFzZS0+
ZXBvY2goKSA+PSBjaGlsZC0+ZXBvY2goKSkgeworICAgICAgICBpZiAoISFiYXNlLT5lcG9jaCgp
ICYmICEhY2hpbGQtPmVwb2NoKCkgJiYgYmFzZS0+ZXBvY2goKSA+PSBjaGlsZC0+ZXBvY2goKSkg
ewogICAgICAgICAgICAgaWYgKHZlcmJvc2UpCiAgICAgICAgICAgICAgICAgZGF0YUxvZygiICAg
ICAgICAgICAgUmVqZWN0aW5nIGJlY2F1c2Ugb2YgZXBvY2ggb3JkZXJpbmcuXG4iKTsKICAgICAg
ICAgICAgIHJldHVybjsKICAgICAgICAgfQotICAgICAgICAKKwogICAgICAgICBjb25zaWRlckJh
cnJpZXIoYmFzZSk7CiAgICAgfQogICAgIApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3Rl
c3RzL3N0cmVzcy9yZWdyZXNzLTE1OTUzNy5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNj
cmlwdENvcmUvdGVzdHMvc3RyZXNzL3JlZ3Jlc3MtMTU5NTM3LmpzCShub25leGlzdGVudCkKKysr
IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvcmVncmVzcy0xNTk1MzcuanMJKHdv
cmtpbmcgY29weSkKQEAgLTAsMCArMSw2MiBAQAorLy8gVGhpcyB0ZXN0IHZlcmlmaWVzIHRoYXQg
d2UgZG9uJ3QgY3Jhc2ggaW4gRlRMIGdlbmVyYXRlZCBjb2RlIGR1ZSB0byBsYWNrIG9mIGEgc3Rv
cmUgYmFycmllcgorLy8gZm9yIGEgcHV0LWJ5LXZhbCB3aGVuIHdlIGRvbid0IGtub3cgd2hlbiB0
aGUgdmFsdWUgd2FzIGFsbG9jYXRlZC4KKworY2xhc3MgTXlOdW1iZXIKK3sKKyAgICBjb25zdHJ1
Y3Rvcih2KQorICAgIHsKKyAgICAgICAgdGhpcy5fdiA9IHY7CisgICAgfQorCisgICAgcGx1c09u
ZSgpCisgICAgeworICAgICAgICByZXR1cm4gdGhpcy5fdiArIDE7CisgICAgfQorfQorCitub0RG
RyhNeU51bWJlci5wbHVzT25lKTsKKworbGV0IGNvdW50ID0gMDsKK2xldCBib2d1cyA9IG51bGw7
CisKK2Z1bmN0aW9uIGJhcigpCit7CisgICAgY291bnQrKzsKKworICAgIGlmICghKGNvdW50ICUg
MTAwKSkKKyAgICAgICAgZnVsbEdDKCk7CisgICAgcmV0dXJuIG5ldyBNeU51bWJlcihjb3VudCk7
Cit9CisKK25vREZHKGJhcik7Citub0lubGluZShiYXIpOworCitmdW5jdGlvbiBmb28oaW5kZXgs
IGFyZykKK3sKKyAgICB2YXIgcmVzdWx0ID0gW2FyZ1swXV07CisgICAgaWYgKGFyZy5sZW5ndGgg
PiAxKQorICAgICAgICByZXN1bHRbMV0gPSBiYXIoKTsKKyAgICByZXR1cm4gcmVzdWx0OworfQor
Citub0lubGluZShmb28pOworCitmdW5jdGlvbiB0ZXN0KCkKK3sKKyAgICBmb3IgKGxldCBpID0g
MDsgaSA8IDUwMDAwOyBpKyspCisgICAgeworICAgICAgICBsZXQgYSA9IFsxLCBpXTsKKyAgICAg
ICAgbGV0IHggPSBmb28oaSwgYSk7CisKKyAgICAgICAgaWYgKCEoY291bnQgJSAxMDApKQorICAg
ICAgICAgICAgZWRlbkdDKCk7CisKKyAgICAgICAgZm9yIChsZXQgaiA9IDA7IGogPCAxMDA7IGor
KykKKyAgICAgICAgICAgIGJvZ3VzID0gbmV3IE15TnVtYmVyKC0xKTsKKyAgICAgICAgCisgICAg
ICAgIGlmICgoY291bnQgKyAxKSAhPSB4WzFdLnBsdXNPbmUoKSkKKyAgICAgICAgICAgIHRocm93
KCJXcm9uZyB2YWx1ZSBmb3IgY291bnQiKTsKKyAgICB9Cit9CisKK3Rlc3QoKTsK
</data>
<flag name="review"
          id="306822"
          type_id="1"
          status="+"
          setter="benjamin"
    />
          </attachment>
      

    </bug>

</bugzilla>