<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>88449</bug_id>
          
          <creation_ts>2012-06-06 13:23:52 -0700</creation_ts>
          <short_desc>Worker tear-down can re-enter JSC during GC finalization</short_desc>
          <delta_ts>2012-06-07 11:32:13 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebCore JavaScript</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          <dependson>88472</dependson>
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Mark Hahnenberg">mhahnenberg</reporter>
          <assigned_to name="Mark Hahnenberg">mhahnenberg</assigned_to>
          <cc>ap</cc>
    
    <cc>ggaren</cc>
    
    <cc>levin</cc>
    
    <cc>rniwa</cc>
    
    <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>642744</commentid>
    <comment_count>0</comment_count>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2012-06-06 13:23:52 -0700</bug_when>
    <thetext>~AbstractWorker can enter JS during GC finalization due to attempting to update the Web Inspector when the worker is being torn down, which is not allowed by JSC.

~Worker has a similar story. Both of these should be fixed to prevent this.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>642844</commentid>
    <comment_count>1</comment_count>
      <attachid>146116</attachid>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2012-06-06 14:53:30 -0700</bug_when>
    <thetext>Created attachment 146116
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>642856</commentid>
    <comment_count>2</comment_count>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2012-06-06 15:06:32 -0700</bug_when>
    <thetext>&gt; ~AbstractWorker can enter JS during GC finalization due to attempting to update the Web Inspector when the worker is being torn down, which is not allowed by JSC.

To make this more clear:

~AbstractWorker can re-enter JS during GC finalization, which is not allowed by JSC, due to attempting to update the Web Inspector when the worker is being torn down.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>642876</commentid>
    <comment_count>3</comment_count>
      <attachid>146116</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2012-06-06 15:21:17 -0700</bug_when>
    <thetext>Comment on attachment 146116
Patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>642884</commentid>
    <comment_count>4</comment_count>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2012-06-06 15:29:07 -0700</bug_when>
    <thetext>Committed r119624: &lt;http://trac.webkit.org/changeset/119624&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>642963</commentid>
    <comment_count>5</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2012-06-06 16:59:40 -0700</bug_when>
    <thetext>A bunch of worker tests started crashing after this patch:
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=fast%2Fworkers%2Fworker-event-listener.html%2Cfast%2Fworkers%2Fstorage%2Fchange-version-handle-reuse-worker.html%2Chttp%2Ftests%2Fhistory%2Fback-during-onload-triggered-by-back.html%2Cfast%2Fworkers%2Fstorage%2Fread-and-write-transactions-dont-run-together.html</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>642970</commentid>
    <comment_count>6</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-06-06 17:04:40 -0700</bug_when>
    <thetext>Re-opened since this is blocked by 88472</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>643028</commentid>
    <comment_count>7</comment_count>
      <attachid>146165</attachid>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2012-06-06 18:01:39 -0700</bug_when>
    <thetext>Created attachment 146165
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>643029</commentid>
    <comment_count>8</comment_count>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2012-06-06 18:02:11 -0700</bug_when>
    <thetext>Let&apos;s try landing each piece of the patch separately to determine which half caused the regression. I think this first patch is the safer of the two.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>643706</commentid>
    <comment_count>9</comment_count>
      <attachid>146165</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2012-06-07 11:11:18 -0700</bug_when>
    <thetext>Comment on attachment 146165
Patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>643727</commentid>
    <comment_count>10</comment_count>
      <attachid>146165</attachid>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-06-07 11:32:08 -0700</bug_when>
    <thetext>Comment on attachment 146165
Patch

Clearing flags on attachment: 146165

Committed r119740: &lt;http://trac.webkit.org/changeset/119740&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>643728</commentid>
    <comment_count>11</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-06-07 11:32:13 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>146116</attachid>
            <date>2012-06-06 14:53:30 -0700</date>
            <delta_ts>2012-06-06 18:01:35 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-88449-20120606145330.patch</filename>
            <type>text/plain</type>
            <size>2303</size>
            <attacher name="Mark Hahnenberg">mhahnenberg</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExOTYyMikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDEyLTA2LTA2ICBNYXJrIEhh
aG5lbmJlcmcgIDxtaGFobmVuYmVyZ0BhcHBsZS5jb20+CisKKyAgICAgICAgV29ya2VyIHRlYXIt
ZG93biBjYW4gcmUtZW50ZXIgSlNDIGR1cmluZyBHQyBmaW5hbGl6YXRpb24KKyAgICAgICAgaHR0
cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTg4NDQ5CisKKyAgICAgICAgUmV2
aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgTm8gbmV3IHRlc3RzLiBDdXJyZW50
IHJlZ3Jlc3Npb24gdGVzdHMgY292ZXIgdGhlc2UgY2hhbmdlcy4KKworICAgICAgICAqIHdvcmtl
cnMvQWJzdHJhY3RXb3JrZXIuY3BwOiAKKyAgICAgICAgKFdlYkNvcmU6OkFic3RyYWN0V29ya2Vy
Ojp+QWJzdHJhY3RXb3JrZXIpOiBXZSBkb24ndCBuZWVkIHRvIGNhbGwgb25Xb3JrZXJEZXN0cm95
KCkgaGVyZSwgaXQgCisgICAgICAgIHdpbGwgYmUgY2FsbGVkIGVsc2V3aGVyZSBpbiBjb250ZXh0
RGVzdHJveWVkKCkuCisgICAgICAgICogd29ya2Vycy9Xb3JrZXJNZXNzYWdpbmdQcm94eS5jcHA6
CisgICAgICAgIChXZWJDb3JlOjpXb3JrZXJNZXNzYWdpbmdQcm94eTo6d29ya2VyT2JqZWN0RGVz
dHJveWVkKTogV2UgbWFrZSB0aGUgY2FsbCB0byB0ZXJtaW5hdGVXb3JrZXJDb250ZXh0KCkKKyAg
ICAgICAgYW5kIHdvcmtlckNvbnRleHREZXN0cm95ZWQoKSBhc3luY2hyb25vdXMgdG8gYXZvaWQg
ZW50ZXJpbmcgSlNDIGR1cmluZyBHQyBmaW5hbGl6YXRpb24uCisKIDIwMTItMDYtMDYgIFRvbnkg
Q2hhbmcgIDx0b255QGNocm9taXVtLm9yZz4KIAogICAgICAgICB3ZWJraXQgY3Jhc2hlcyBvbiBk
ZWJ1ZyBidWlsZHMgd2hlbiBydW5uaW5nIElFVEMgZmxleGJveC1vcmRpbmFsLWdyb3VwLTAwMS5o
dG0KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3dvcmtlcnMvQWJzdHJhY3RXb3JrZXIuY3BwCj09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3dvcmtlcnMvQWJzdHJhY3RXb3JrZXIuY3BwCShyZXZp
c2lvbiAxMTk1OTUpCisrKyBTb3VyY2UvV2ViQ29yZS93b3JrZXJzL0Fic3RyYWN0V29ya2VyLmNw
cAkod29ya2luZyBjb3B5KQpAQCAtNTMsNyArNTMsNiBAQCBBYnN0cmFjdFdvcmtlcjo6QWJzdHJh
Y3RXb3JrZXIoU2NyaXB0RXhlCiAKIEFic3RyYWN0V29ya2VyOjp+QWJzdHJhY3RXb3JrZXIoKQog
ewotICAgIG9uRGVzdHJveVdvcmtlcigpOwogfQogCiB2b2lkIEFic3RyYWN0V29ya2VyOjpvbkRl
c3Ryb3lXb3JrZXIoKQpJbmRleDogU291cmNlL1dlYkNvcmUvd29ya2Vycy9Xb3JrZXJNZXNzYWdp
bmdQcm94eS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvd29ya2Vycy9Xb3JrZXJN
ZXNzYWdpbmdQcm94eS5jcHAJKHJldmlzaW9uIDExOTU5NSkKKysrIFNvdXJjZS9XZWJDb3JlL3dv
cmtlcnMvV29ya2VyTWVzc2FnaW5nUHJveHkuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zNTQsMTAg
KzM1NCwxMiBAQCB2b2lkIFdvcmtlck1lc3NhZ2luZ1Byb3h5Ojp3b3JrZXJUaHJlYWRDCiB2b2lk
IFdvcmtlck1lc3NhZ2luZ1Byb3h5Ojp3b3JrZXJPYmplY3REZXN0cm95ZWQoKQogewogICAgIG1f
d29ya2VyT2JqZWN0ID0gMDsKKyAgICAvLyBUaGVzZSB0YXNrcyBtdXN0IGJlIGRvbmUgYXN5bmNo
cm9ub3VzbHkgYmVjYXVzZSB0aGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCBkdXJpbmcgZmluYWxpemF0
aW9uIAorICAgIC8vIG9mIEpTIHdyYXBwZXJzIGZvciBXb3JrZXJzIGFuZCBjYW4gY2F1c2UgcmUt
ZW50cnkgaW4gSlMgZHVlIHRvIHVwZGF0aW5nIHRoZSBJbnNwZWN0b3IuCiAgICAgaWYgKG1fd29y
a2VyVGhyZWFkKQotICAgICAgICB0ZXJtaW5hdGVXb3JrZXJDb250ZXh0KCk7CisgICAgICAgIHdv
cmtlckNvbnRleHRDbG9zZWQoKTsKICAgICBlbHNlCi0gICAgICAgIHdvcmtlckNvbnRleHREZXN0
cm95ZWRJbnRlcm5hbCgpOworICAgICAgICB3b3JrZXJDb250ZXh0RGVzdHJveWVkKCk7CiB9CiAK
ICNpZiBFTkFCTEUoSU5TUEVDVE9SKQo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>146165</attachid>
            <date>2012-06-06 18:01:39 -0700</date>
            <delta_ts>2012-06-07 11:32:08 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-88449-20120606180138.patch</filename>
            <type>text/plain</type>
            <size>1260</size>
            <attacher name="Mark Hahnenberg">mhahnenberg</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExOTY1NikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDEyLTA2LTA2ICBNYXJrIEhh
aG5lbmJlcmcgIDxtaGFobmVuYmVyZ0BhcHBsZS5jb20+CisKKyAgICAgICAgV29ya2VyIHRlYXIt
ZG93biBjYW4gcmUtZW50ZXIgSlNDIGR1cmluZyBHQyBmaW5hbGl6YXRpb24KKyAgICAgICAgaHR0
cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTg4NDQ5CisKKyAgICAgICAgUmV2
aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgTm8gbmV3IHRlc3RzLiAKKworICAg
ICAgICBUaGlzIGlzIHRoZSBmaXJzdCBvZiB0d28gcGF0Y2hlcyB0byBmaXggdGhpcyBpc3N1ZSB3
aXRoIFdvcmtlcnMuCisKKyAgICAgICAgKiB3b3JrZXJzL0Fic3RyYWN0V29ya2VyLmNwcDoKKyAg
ICAgICAgKFdlYkNvcmU6OkFic3RyYWN0V29ya2VyOjp+QWJzdHJhY3RXb3JrZXIpOiBXZSBkb24n
dCBuZWVkIHRvIGNhbGwgb25EZXN0cm95V29ya2VyKCkgaGVyZSwgaXQgCisgICAgICAgIHdpbGwg
YmUgY2FsbGVkIGVsc2V3aGVyZSBpbiBjb250ZXh0RGVzdHJveWVkKCkuCisKIDIwMTItMDYtMDYg
IEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KIAogICAgICAgICBHbG9iYWwgb2JqZWN0
IHZhcmlhYmxlIGFjY2Vzc2VzIHNob3VsZCBub3QgcmVxdWlyZSBhbiBleHRyYSBsb2FkCkluZGV4
OiBTb3VyY2UvV2ViQ29yZS93b3JrZXJzL0Fic3RyYWN0V29ya2VyLmNwcAo9PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t
LSBTb3VyY2UvV2ViQ29yZS93b3JrZXJzL0Fic3RyYWN0V29ya2VyLmNwcAkocmV2aXNpb24gMTE5
NjQ4KQorKysgU291cmNlL1dlYkNvcmUvd29ya2Vycy9BYnN0cmFjdFdvcmtlci5jcHAJKHdvcmtp
bmcgY29weSkKQEAgLTUzLDcgKzUzLDYgQEAgQWJzdHJhY3RXb3JrZXI6OkFic3RyYWN0V29ya2Vy
KFNjcmlwdEV4ZQogCiBBYnN0cmFjdFdvcmtlcjo6fkFic3RyYWN0V29ya2VyKCkKIHsKLSAgICBv
bkRlc3Ryb3lXb3JrZXIoKTsKIH0KIAogdm9pZCBBYnN0cmFjdFdvcmtlcjo6b25EZXN0cm95V29y
a2VyKCkK
</data>

          </attachment>
      

    </bug>

</bugzilla>