180634 2017-12-10 09:19:58 -0800 Harden a few assertions in GC sweep 2017-12-10 17:11:24 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 fpizlo fpizlo ews-watchlist keith_miller mark.lam msaboff saam webkit-bug-importer oldest_to_newest 1380072 0 fpizlo 2017-12-10 09:19:58 -0800 Patch forthcoming. 1380073 1 328937 fpizlo 2017-12-10 09:21:27 -0800 Created attachment 328937 the patch 1380092 2 328937 saam 2017-12-10 16:33:50 -0800 Comment on attachment 328937 the patch View in context: https://bugs.webkit.org/attachment.cgi?id=328937&action=review > Source/JavaScriptCore/heap/MarkedBlock.cpp:405 > + RELEASE_ASSERT(!m_isFreeListed); The old branch was never taken? 1380093 3 fpizlo 2017-12-10 17:09:43 -0800 (In reply to Saam Barati from comment #2) > Comment on attachment 328937 [details] > the patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=328937&action=review > > > Source/JavaScriptCore/heap/MarkedBlock.cpp:405 > > + RELEASE_ASSERT(!m_isFreeListed); > > The old branch was never taken? Nope. It doesn't make sense that m_isFreeListed would be true, and if it was, simply returning couldn't possibly be the right thing to do. My best theory is this: this was landed originally in a patch where I had added that logic to support something else, and then removed that something else, but didn't remove the check. 1380094 4 fpizlo 2017-12-10 17:10:51 -0800 Landed in https://trac.webkit.org/changeset/225734/webkit 1380095 5 webkit-bug-importer 2017-12-10 17:11:24 -0800 <rdar://problem/35958652> 328937 2017-12-10 09:21:27 -0800 2017-12-10 16:33:50 -0800 the patch blah.patch text/plain 1490 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjI1NzMyKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDE3LTEyLTEwICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg SGFyZGVuIGEgZmV3IGFzc2VydGlvbnMgaW4gR0Mgc3dlZXAKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE4MDYzNAorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAgVGhpcyB0dXJucyBvbmUgZHluYW1p YyBjaGVjayBpbnRvIGEgcmVsZWFzZSBhc3NlcnRpb24gYW5kIHVwZ3JhZGVzIGFub3RoZXIgYXNz ZXJ0aW9uIHRvIGEgcmVsZWFzZQorICAgICAgICBhc3NlcnRpb24uCisKKyAgICAgICAgKiBoZWFw L01hcmtlZEJsb2NrLmNwcDoKKyAgICAgICAgKEpTQzo6TWFya2VkQmxvY2s6OkhhbmRsZTo6c3dl ZXApOgorCiAyMDE3LTEyLTA1ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CiAKICAg ICAgICAgSW5mZXJyZWRUeXBlIHNob3VsZCBub3QgdXNlIFVuY29uZGl0aW9uYWxGaW5hbGl6ZXIK SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9oZWFwL01hcmtlZEJsb2NrLmNwcAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaGVhcC9NYXJrZWRCbG9jay5jcHAJKHJldmlz aW9uIDIyNTcyOCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9oZWFwL01hcmtlZEJsb2NrLmNw cAkod29ya2luZyBjb3B5KQpAQCAtNDAyLDEyICs0MDIsOCBAQCB2b2lkIE1hcmtlZEJsb2NrOjpI YW5kbGU6OnN3ZWVwKEZyZWVMaXN0CiAgICAgaWYgKHN3ZWVwTW9kZSA9PSBTd2VlcE9ubHkgJiYg IW5lZWRzRGVzdHJ1Y3Rpb24pCiAgICAgICAgIHJldHVybjsKIAotICAgIGlmIChVTkxJS0VMWSht X2lzRnJlZUxpc3RlZCkpIHsKLSAgICAgICAgUkVMRUFTRV9BU1NFUlQoc3dlZXBNb2RlID09IFN3 ZWVwVG9GcmVlTGlzdCk7Ci0gICAgICAgIHJldHVybjsKLSAgICB9Ci0gICAgCi0gICAgQVNTRVJU KCFtX2FsbG9jYXRvci0+aXNBbGxvY2F0ZWQoTm9Mb2NraW5nTmVjZXNzYXJ5LCB0aGlzKSk7Cisg ICAgUkVMRUFTRV9BU1NFUlQoIW1faXNGcmVlTGlzdGVkKTsKKyAgICBSRUxFQVNFX0FTU0VSVCgh bV9hbGxvY2F0b3ItPmlzQWxsb2NhdGVkKE5vTG9ja2luZ05lY2Vzc2FyeSwgdGhpcykpOwogICAg IAogICAgIGlmIChzcGFjZSgpLT5pc01hcmtpbmcoKSkKICAgICAgICAgYmxvY2soKS5tX2xvY2su bG9jaygpOwo=