187157 2018-06-28 14:33:06 -0700 IsoCellSet::sweepToFreeList() not safe when Full GC in process 2018-06-28 20:27:30 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff ews-watchlist fpizlo keith_miller mark.lam saam webkit-bug-importer oldest_to_newest 1437552 0 msaboff 2018-06-28 14:33:06 -0700 If we are in the process of a full GC and we call into IsoCellSet::sweepToFreeList(), the IsoCellSet's bits may be improperly cleared due to incomplete stale marks logic. The stale marks logic needs to match what is in MarkedBlock::Handle::specializedSweep where it takes into account whether or not we are in the process of marking during a full GC. 1437553 1 msaboff 2018-06-28 14:33:27 -0700 <rdar://problem/41400293> 1437606 2 343866 msaboff 2018-06-28 15:52:45 -0700 Created attachment 343866 Patch 1437610 3 343866 mark.lam 2018-06-28 16:00:14 -0700 Comment on attachment 343866 Patch r=me 1437687 4 msaboff 2018-06-28 20:27:30 -0700 Committed r233346: <https://trac.webkit.org/changeset/233346> 343866 2018-06-28 15:52:45 -0700 2018-06-28 16:00:14 -0700 Patch 187157.patch text/plain 3017 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjMzMzI4KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE4LTA2LTI4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorICAKKyAg ICAgICAgSXNvQ2VsbFNldDo6c3dlZXBUb0ZyZWVMaXN0KCkgbm90IHNhZmUgd2hlbiBGdWxsIEdD IGluIHByb2Nlc3MKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTE4NzE1NworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgICogaGVhcC9Jc29DZWxsU2V0LmNwcDoKKyAgICAgICAgKEpTQzo6SXNvQ2VsbFNldDo6c3dl ZXBUb0ZyZWVMaXN0KTogQ2hhbmdlZCB0aGUgInN0YWxlIG1hcmtzIGxvZ2ljIiB0byBtYXRjaCB3 aGF0CisgICAgICAgIGlzIGluIE1hcmtlZEJsb2NrOjpIYW5kbGU6OnNwZWNpYWxpemVkU3dlZXAg d2hlcmUgaXQgdGFrZXMgaW50byBhY2NvdW50IHdoZXRoZXIKKyAgICAgICAgb3Igbm90IHdlIGFy ZSBpbiB0aGUgcHJvY2VzcyBvZiBtYXJraW5nIGR1cmluZyBhIGZ1bGwgR0MuCisgICAgICAgICog aGVhcC9NYXJrZWRCbG9jay5oOgorICAgICAgICAqIGhlYXAvTWFya2VkQmxvY2tJbmxpbmVzLmg6 CisgICAgICAgIChKU0M6Ok1hcmtlZEJsb2NrOjpIYW5kbGU6OmFyZU1hcmtzU3RhbGVGb3JTd2Vl cCk6IE5ldyBoZWxwZXIuCisKIDIwMTgtMDYtMjcgIFNhYW0gQmFyYXRpICA8c2JhcmF0aUBhcHBs ZS5jb20+CiAKICAgICAgICAgQWRkIHNvbWUgbW9yZSByZWdpc3RlciBzdGF0ZSBpbmZvcm1hdGlv biB3aGVuIHdlIGNyYXNoIGluIHJlcGF0Y2hQdXRCeUlkCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlw dENvcmUvaGVhcC9Jc29DZWxsU2V0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlw dENvcmUvaGVhcC9Jc29DZWxsU2V0LmNwcAkocmV2aXNpb24gMjMzMzI4KQorKysgU291cmNlL0ph dmFTY3JpcHRDb3JlL2hlYXAvSXNvQ2VsbFNldC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTEyNywx MSArMTI3LDEyIEBAIHZvaWQgSXNvQ2VsbFNldDo6c3dlZXBUb0ZyZWVMaXN0KE1hcmtlZEIKICAg ICB9CiAgICAgCiAgICAgaWYgKGJsb2NrLT5ibG9jaygpLmhhc0FueU5ld2x5QWxsb2NhdGVkKCkp IHsKKyAgICAgICAgLy8gVGhlIG5ld2x5QWxsb2NhdGVkKCkgYml0cyBhcmUgYSBzdXBlcnNldCBv ZiB0aGUgbWFya3MoKSBiaXRzLgogICAgICAgICBtX2JpdHNbYmxvY2stPmluZGV4KCldLT5jb25j dXJyZW50RmlsdGVyKGJsb2NrLT5ibG9jaygpLm5ld2x5QWxsb2NhdGVkKCkpOwogICAgICAgICBy ZXR1cm47CiAgICAgfQogCi0gICAgaWYgKGJsb2NrLT5pc0VtcHR5KCkgfHwgYmxvY2stPmFyZU1h cmtzU3RhbGUoKSkgeworICAgIGlmIChibG9jay0+aXNFbXB0eSgpIHx8IGJsb2NrLT5hcmVNYXJr c1N0YWxlRm9yU3dlZXAoKSkgewogICAgICAgICB7CiAgICAgICAgICAgICAvLyBIb2xkaW5nIHRo ZSBiaXR2ZWN0b3IgbG9jayBoYXBwZW5zIHRvIGJlIGVub3VnaCBiZWNhdXNlIHRoYXQncyB3aGF0 IHdlIGFsc28gaG9sZCBpbgogICAgICAgICAgICAgLy8gb3RoZXIgcGxhY2VzIHdoZXJlIHdlIG1h bmlwdWxhdGUgdGhpcyBiaXR2ZWN0b3IuCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaGVh cC9NYXJrZWRCbG9jay5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9oZWFw L01hcmtlZEJsb2NrLmgJKHJldmlzaW9uIDIzMzMyOCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9oZWFwL01hcmtlZEJsb2NrLmgJKHdvcmtpbmcgY29weSkKQEAgLTE4Nyw2ICsxODcsNyBAQCBw dWJsaWM6CiAgICAgICAgIHRlbXBsYXRlIDx0eXBlbmFtZSBGdW5jdG9yPiBpbmxpbmUgSXRlcmF0 aW9uU3RhdHVzIGZvckVhY2hNYXJrZWRDZWxsKGNvbnN0IEZ1bmN0b3ImKTsKICAgICAgICAgICAg IAogICAgICAgICBKU19FWFBPUlRfUFJJVkFURSBib29sIGFyZU1hcmtzU3RhbGUoKTsKKyAgICAg ICAgYm9vbCBhcmVNYXJrc1N0YWxlRm9yU3dlZXAoKTsKICAgICAgICAgCiAgICAgICAgIHZvaWQg YXNzZXJ0TWFya3NOb3RTdGFsZSgpOwogICAgICAgICAgICAgCkluZGV4OiBTb3VyY2UvSmF2YVNj cmlwdENvcmUvaGVhcC9NYXJrZWRCbG9ja0lubGluZXMuaAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvaGVhcC9NYXJrZWRCbG9ja0lubGluZXMuaAkocmV2aXNpb24gMjMzMzI4 KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAvTWFya2VkQmxvY2tJbmxpbmVzLmgJKHdv cmtpbmcgY29weSkKQEAgLTIwMyw2ICsyMDMsMTEgQEAgaW5saW5lIGJvb2wgTWFya2VkQmxvY2s6 OkhhbmRsZTo6aXNMaXZlQwogICAgIHJldHVybiBpc0xpdmVDZWxsKHNwYWNlKCktPm1hcmtpbmdW ZXJzaW9uKCksIHNwYWNlKCktPm5ld2x5QWxsb2NhdGVkVmVyc2lvbigpLCBzcGFjZSgpLT5pc01h cmtpbmcoKSwgcCk7CiB9CiAKK2lubGluZSBib29sIE1hcmtlZEJsb2NrOjpIYW5kbGU6OmFyZU1h cmtzU3RhbGVGb3JTd2VlcCgpCit7CisgICAgcmV0dXJuIG1hcmtzTW9kZSgpID09IE1hcmtzU3Rh bGU7Cit9CisKIC8vIFRoZSBmb2xsb3dpbmcgaGFzIHRvIGJlIHRydWUgZm9yIHNwZWNpYWxpemF0 aW9uIHRvIGtpY2sgaW46CiAvLwogLy8gc3dlZXBNb2RlID09IFN3ZWVwVG9GcmVlTGlzdAo=