227767 2021-07-07 13:22:58 -0700 fitcored crashes at JavaScriptCore: JSC::Heap::releaseAccessSlow 2022-02-27 23:25:07 -0800 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff webkit-unassigned ews-watchlist ggaren keith_miller mark.lam saam tzagallo webkit-bug-importer oldest_to_newest 1775417 0 msaboff 2021-07-07 13:22:58 -0700 We are getting crash reports from fitcored like: JavaScriptCore: WTFCrashWithInfo(int, char const*, char const*, int) JavaScriptCore: JSC::Heap::releaseAccessSlow() <== JavaScriptCore: JSC::JITWorklist::waitUntilAllPlansForVMAreReady(JSC::VM&) JavaScriptCore: JSC::JITWorklist::cancelAllPlansForVM(JSC::VM&) JavaScriptCore: JSC::VM::~VM() JavaScriptCore: JSC::JSLock::willReleaseLock() JavaScriptCore: JSC::JSLock::unlock() JavaScriptCore: JSC::JSRunLoopTimer::timerDidFire() JavaScriptCore: JSC::JSRunLoopTimer::Manager::timerDidFire() JavaScriptCore: WTF::RunLoop::TimerBase::start(WTF::Seconds, bool)::$_1::__invoke(__CFRunLoopTimer*, void*) CoreFoundation: __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ CoreFoundation: __CFRunLoopDoTimer CoreFoundation: __CFRunLoopDoTimers CoreFoundation: __CFRunLoopRun CoreFoundation: CFRunLoopRunSpecific Foundation: -[NSRunLoop(NSRunLoop) runMode:beforeDate:] Foundation: -[NSRunLoop(NSRunLoop) run] SeymourServices: static DaemonProtocol.main() fitcored: main dyld: Although I am unable to reproduce the crash, the theory is that the heap access lock is being dropped in JSLock::willReleaseLock() so when we try unlocking it again in JITWorklist::waitUntilAllPlansForVMAreReady() via ReleaseHeapAccessScope, we fault. This path can happen when the main thread becomes the sole reference to the VM during processing a request like the timer in this stack trace. I suspect it is a race with other threads that are done using the VM. 1775418 1 msaboff 2021-07-07 13:23:04 -0700 <rdar://78758218> 1775419 2 webkit-bug-importer 2021-07-07 13:23:22 -0700 <rdar://problem/80286291> 1775425 3 433066 msaboff 2021-07-07 13:34:32 -0700 Created attachment 433066 Patch 1775429 4 433066 ggaren 2021-07-07 13:41:05 -0700 Comment on attachment 433066 Patch r=me Is it ever correct to have heap access when we run the VM destructor? I think it is not. So, I think the VM destructor should RELEASE_ASSERT !hasAccess(). (I'm asking because that RELEASE_ASSERT would remove all the speculation in your reasoning.) 1775469 5 msaboff 2021-07-07 14:44:05 -0700 (In reply to Geoffrey Garen from comment #4) > Comment on attachment 433066 [details] > Patch > > r=me > > Is it ever correct to have heap access when we run the VM destructor? I > think it is not. So, I think the VM destructor should RELEASE_ASSERT > !hasAccess(). You can have heap access when you destruct the VM, so such a RELEASE_ASSERT is not valid. > (I'm asking because that RELEASE_ASSERT would remove all the speculation in > your reasoning.) 1775475 6 msaboff 2021-07-07 14:55:30 -0700 Committed r279677 (239482@main): <https://commits.webkit.org/239482@main> 433066 2021-07-07 13:34:32 -0700 2022-02-27 23:25:07 -0800 Patch 227767.patch text/plain 3474 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjc5NjI5KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIzIEBA CisyMDIxLTA3LTA2ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIGZpdGNvcmVkIGNyYXNoZXMgYXQgSmF2YVNjcmlwdENvcmU6IEpTQzo6SGVhcDo6cmVsZWFz ZUFjY2Vzc1Nsb3cKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTIyNzc2NworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgIFNwZWN1bGF0aXZlIGZpeCBmb3IgdGhpcyBjcmFzaC4gIFdlIGFyZSBjcmFzaGluZyB3aGls ZSBkZXN0cm95aW5nIHRoZSBWTSBhcyB3ZSBhcmUgYWJvdXQgdG8KKyAgICAgICAgcmVsZWFzZSB0 aGUgSlNMb2NrLiAgSW4gSlNMb2NrOjp3aWxsUmVsZWFzZUxvY2soKSwgd2UgcmVsZWFzZSBoZWFw IGFjY2Vzcy4gIFRoZXJlZm9yZSB3ZSBkb24ndAorICAgICAgICBuZWVkIHRvIHJlbGVhc2UgaXQg aWFnYWluIHdoZW4gdW5kZXJ0YWtpbmcgdGhlIHZhcmlvdXMgc2h1dGRvd24gc3RlcHMgaW4gdGhl IFZNIGRlc3RydWN0b3IuCisKKyAgICAgICAgQWRkZWQgYSBuZXcgc2NvcGUgY2xhc3MgdGhhdCB3 aWxsIG9ubHkgcmVsZWFzZSBhbmQgdGhlbiBhY3F1aXJlIGhlYXAgYWNjZXNzIGlmIHRoZSBjYWxs ZXIKKyAgICAgICAgY3VycmVudGx5IGhhcyBoZWFwIGFjY2Vzcy4KKworICAgICAgICAqIGhlYXAv UmVsZWFzZUhlYXBBY2Nlc3NTY29wZS5oOgorICAgICAgICAoSlNDOjpSZWxlYXNlSGVhcEFjY2Vz c0lmTmVlZGVkU2NvcGU6OlJlbGVhc2VIZWFwQWNjZXNzSWZOZWVkZWRTY29wZSk6CisgICAgICAg IChKU0M6OlJlbGVhc2VIZWFwQWNjZXNzSWZOZWVkZWRTY29wZTo6flJlbGVhc2VIZWFwQWNjZXNz SWZOZWVkZWRTY29wZSk6CisgICAgICAgICogaml0L0pJVFdvcmtsaXN0LmNwcDoKKyAgICAgICAg KEpTQzo6SklUV29ya2xpc3Q6OndhaXRVbnRpbEFsbFBsYW5zRm9yVk1BcmVSZWFkeSk6CisKIDIw MjEtMDctMDYgIFlpamlhIEh1YW5nICA8eWlqaWFfaHVhbmdAYXBwbGUuY29tPgogCiAgICAgICAg IEZpeCB0eXBlIGVycm9yIGluIHRlc3RiMwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2hl YXAvUmVsZWFzZUhlYXBBY2Nlc3NTY29wZS5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS9oZWFwL1JlbGVhc2VIZWFwQWNjZXNzU2NvcGUuaAkocmV2aXNpb24gMjc5NjI3KQor KysgU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAvUmVsZWFzZUhlYXBBY2Nlc3NTY29wZS5oCSh3 b3JraW5nIGNvcHkpCkBAIC0xLDUgKzEsNSBAQAogLyoKLSAqIENvcHlyaWdodCAoQykgMjAxNiBB cHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCisgKiBDb3B5cmlnaHQgKEMpIDIwMTYtMjAy MSBBcHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCiAgKgogICogUmVkaXN0cmlidXRpb24g YW5kIHVzZSBpbiBzb3VyY2UgYW5kIGJpbmFyeSBmb3Jtcywgd2l0aCBvciB3aXRob3V0CiAgKiBt b2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJvdmlkZWQgdGhhdCB0aGUgZm9sbG93aW5nIGNv bmRpdGlvbnMKQEAgLTU0LDUgKzU0LDI2IEBAIHByaXZhdGU6CiAgICAgSGVhcCYgbV9oZWFwOwog fTsKIAorY2xhc3MgUmVsZWFzZUhlYXBBY2Nlc3NJZk5lZWRlZFNjb3BlIHsKK3B1YmxpYzoKKyAg ICBSZWxlYXNlSGVhcEFjY2Vzc0lmTmVlZGVkU2NvcGUoSGVhcCYgaGVhcCkKKyAgICAgICAgOiBt X2hlYXAoaGVhcCkKKyAgICB7CisgICAgICAgIGhhZEhlYXBBY2Nlc3MgPSBtX2hlYXAuaGFzQWNj ZXNzKCk7CisgICAgICAgIGlmIChoYWRIZWFwQWNjZXNzKQorICAgICAgICAgICAgbV9oZWFwLnJl bGVhc2VBY2Nlc3MoKTsKKyAgICB9CisKKyAgICB+UmVsZWFzZUhlYXBBY2Nlc3NJZk5lZWRlZFNj b3BlKCkKKyAgICB7CisgICAgICAgIGlmIChoYWRIZWFwQWNjZXNzKQorICAgICAgICAgICAgbV9o ZWFwLmFjcXVpcmVBY2Nlc3MoKTsKKyAgICB9CisKK3ByaXZhdGU6CisgICAgSGVhcCYgbV9oZWFw OworICAgIGJvb2wgaGFkSGVhcEFjY2VzcyB7IGZhbHNlIH07Cit9OworCiB9IC8vIG5hbWVzcGFj ZSBKU0MKIApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRXb3JrbGlzdC5jcHAK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRXb3JrbGlzdC5jcHAJ KHJldmlzaW9uIDI3OTYyNykKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUV29ya2xp c3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xNzMsNyArMTczLDEwIEBAIHZvaWQgSklUV29ya2xp c3Q6OndhaXRVbnRpbEFsbFBsYW5zRm9yVk0KICAgICAvLyB0aGUgY29tcGlsZXIgYW5kIHRoZW4g aXQgd2lsbCBiZSB3YWl0aW5nIGZvciB1cyB0byBzdG9wLiBUaGF0J3MgYSBkZWFkbG9jay4gV2Ug YXZvaWQgdGhhdAogICAgIC8vIGRlYWRsb2NrIGJ5IHJlbGlucXVpc2hpbmcgb3VyIGhlYXAgYWNj ZXNzLCBzbyB0aGF0IHRoZSBjb2xsZWN0b3IgcHJldGVuZHMgdGhhdCB3ZSBhcmUgc3RvcHBlZAog ICAgIC8vIGV2ZW4gaWYgd2UgYXJlbid0LgotICAgIFJlbGVhc2VIZWFwQWNjZXNzU2NvcGUgcmVs ZWFzZUhlYXBBY2Nlc3NTY29wZSh2bS5oZWFwKTsKKyAgICAvLyBUaGVyZSBjYW4gYmUgdGhlIGNh c2Ugd2hlcmUgd2UgYWxyZWFkeSByZWxlYXNlZCBoZWFwIGFjY2VzcywgZm9yIGV4YW1wbGUgd2hl biB0aGUgVk0gaXMgYmVpbmcKKyAgICAvLyBkZXN0cm95ZWQgYXMgYSByZXN1bHQgb2YgSlNMb2Nr Ojp1bmxvY2sgdW5sb2NraW5nIHRoZSBsYXN0IHJlZmVyZW5jZSB0byB0aGUgVk0uCisgICAgLy8g U28gd2UgdXNlIGEgUmVsZWFzZSBhY2Nlc3Mgc2NvcGUgdGhhdCBjaGVja3MgaWYgd2UgY3VycmVu dGx5IGhhdmUgYWNjZXNzIGJlZm9yZSByZWxlYXNpbmcgYW5kIGxhdGVyIHJlc3RvcmluZy4KKyAg ICBSZWxlYXNlSGVhcEFjY2Vzc0lmTmVlZGVkU2NvcGUgcmVsZWFzZUhlYXBBY2Nlc3NTY29wZSh2 bS5oZWFwKTsKIAogICAgIC8vIFdhaXQgZm9yIGFsbCBvZiB0aGUgcGxhbnMgZm9yIHRoZSBnaXZl biBWTSB0byBjb21wbGV0ZS4gVGhlIGlkZWEgaGVyZQogICAgIC8vIGlzIHRoYXQgd2Ugd2FudCBh bGwgb2YgdGhlIGNhbGxlciBWTSdzIHBsYW5zIHRvIGJlIGRvbmUuIFdlIGRvbid0IGNhcmUK