66845 2011-08-24 02:20:09 -0700 ErrorInstance::create sometimes has two heap object constructions in flight at once 2011-08-24 10:44:53 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 fpizlo webkit-unassigned darin fpizlo ggaren oliver webkit.review.bot oldest_to_newest 456028 0 fpizlo 2011-08-24 02:20:09 -0700 Under the newly refactored heap object creation scheme, only one heap object can have its C++ constructor in flight at a time. This ensures that a GC cannot be fired while some object has yet to have its initial state (i.e. vtable) set. However, the ErrorInstance::create(ExecState*, Structure*, JSValue) constructor violates this constraint by calling toString() in the argument list to a placement new call. 456029 1 104974 fpizlo 2011-08-24 02:24:47 -0700 Created attachment 104974 the patch 456042 2 104974 fpizlo 2011-08-24 03:37:08 -0700 Comment on attachment 104974 the patch Tests pass, ready to commit if others concur. Interestingly, this failure is already covered by our run-javascriptcore-tests, but not in LayoutTests. Should we port the relevant test into LayoutTests, or maybe we should have run-webkit-tests trigger run-javascriptcore-tests automatically? 456144 3 darin 2011-08-24 09:43:43 -0700 (In reply to comment #2) > maybe we should have run-webkit-tests trigger run-javascriptcore-tests automatically? This is the right long term direction. But ideally we want this to run tests and show failures the same way run-webkit-tests does, not an entirely different way. The internal machinery doesn’t have to be identical, but the format of results should be. 456191 4 104974 webkit.review.bot 2011-08-24 10:44:49 -0700 Comment on attachment 104974 the patch Clearing flags on attachment: 104974 Committed r93710: <http://trac.webkit.org/changeset/93710> 456192 5 webkit.review.bot 2011-08-24 10:44:53 -0700 All reviewed patches have been landed. Closing bug. 104974 2011-08-24 02:24:47 -0700 2011-08-24 10:44:49 -0700 the patch errorinstance_patch_1.diff text/plain 1524 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gOTM2OTYpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAK KzIwMTEtMDgtMjQgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAgICBF cnJvckluc3RhbmNlOjpjcmVhdGUgc29tZXRpbWVzIGhhcyB0d28gaGVhcCBvYmplY3QgY29uc3Ry dWN0aW9ucworICAgICAgICBpbiBmbGlnaHQgYXQgb25jZQorICAgICAgICBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NjY4NDUKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKyAgICAgICAgCisgICAgICAgIFRoZSBmaXggaXMgc2ltcGxlIHNpbmNl IHRoZXJlIGlzIGFscmVhZHkgYSBzZWNvbmQgY3JlYXRlKCkgbWV0aG9kCisgICAgICAgIHRoYXQg dGFrZXMgYSBVU3RyaW5nLgorCisgICAgICAgICogcnVudGltZS9FcnJvckluc3RhbmNlLmNwcDoK KyAgICAgICAgKEpTQzo6RXJyb3JJbnN0YW5jZTo6Y3JlYXRlKToKKwogMjAxMS0wOC0yMyAgTWFy ayBIYWhuZW5iZXJnICA8bWhhaG5lbmJlcmdAYXBwbGUuY29tPgogCiAgICAgICAgIEFkZCBjaGVj a3MgdG8gZW5zdXJlIGFsbG9jYXRpb24gZG9lcyBub3QgdGFrZSBwbGFjZSBkdXJpbmcgaW5pdGlh bGl6YXRpb24gb2YgR0MtbWFuYWdlZCBvYmplY3RzCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENv cmUvcnVudGltZS9FcnJvckluc3RhbmNlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNj cmlwdENvcmUvcnVudGltZS9FcnJvckluc3RhbmNlLmNwcAkocmV2aXNpb24gOTM2OTUpCisrKyBT b3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9FcnJvckluc3RhbmNlLmNwcAkod29ya2luZyBj b3B5KQpAQCAtNDksNyArNDksNyBAQCBFcnJvckluc3RhbmNlKiBFcnJvckluc3RhbmNlOjpjcmVh dGUoRXhlCiB7CiAgICAgaWYgKG1lc3NhZ2UuaXNVbmRlZmluZWQoKSkKICAgICAgICAgcmV0dXJu IG5ldyAoYWxsb2NhdGVDZWxsPEVycm9ySW5zdGFuY2U+KCpleGVjLT5oZWFwKCkpKSBFcnJvcklu c3RhbmNlKGV4ZWMtPmdsb2JhbERhdGEoKSwgc3RydWN0dXJlKTsKLSAgICByZXR1cm4gbmV3IChh bGxvY2F0ZUNlbGw8RXJyb3JJbnN0YW5jZT4oKmV4ZWMtPmhlYXAoKSkpIEVycm9ySW5zdGFuY2Uo ZXhlYy0+Z2xvYmFsRGF0YSgpLCBzdHJ1Y3R1cmUsIG1lc3NhZ2UudG9TdHJpbmcoZXhlYykpOwor ICAgIHJldHVybiBjcmVhdGUoZXhlYy0+Z2xvYmFsRGF0YSgpLCBzdHJ1Y3R1cmUsIG1lc3NhZ2Uu dG9TdHJpbmcoZXhlYykpOwogfQogCiB9IC8vIG5hbWVzcGFjZSBKU0MK