Bug 115130 – [Windows, WinCairo] Fix Crash in fast/js/create-lots-of-workers.html

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Brent Fulgham]

The Windows test bots crash when running the Worker tests.

Here is a stack trace of the crash:

Opened log file 'E:\Projects\WebKit\tmp\layout-test-results\CrashLog_09d4_2013-04-18_10-39-29-773.txt'
0:011:x86> .srcpath "E:\Projects\WebKit"
Source search path is: E:\Projects\WebKit
0:011:x86> !analyze -vv
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for CFNetwork.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for libdispatch.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for CoreFoundation.dll - 

FAULTING_IP: 
JavaScriptCore!WTF::PageHeapAllocator<WTF::TCMalloc_ThreadCache>::New+a [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 1090]
707289ba 8b08            mov     ecx,dword ptr [eax]

EXCEPTION_RECORD:  00000000707289ba -- (.exr 0x707289ba)
.exr 0x707289ba
ExceptionAddress: 000000000350047e
   ExceptionCode: 4683088b
  ExceptionFlags: 4e890110
NumberParameters: 1534263296
   Parameter[0]: 000000006a006a57
   Parameter[1]: 0000000080006800
   Parameter[2]: 0000000073e80000
   Parameter[3]: 000000008b000167
   Parameter[4]: 000000000cc483f8
   Parameter[5]: 000000001374ff85
   Parameter[6]: 000000005cb00581
   Parameter[7]: 0000000080007079
   Parameter[8]: 0000000015830000
   Parameter[9]: 0000000070795cb4
   Parameter[10]: 00000000e818eb00
   Parameter[11]: 0000000000002d62
   Parameter[12]: 00000000002d4de8
   Parameter[13]: 00000000c7d23300
   Parameter[14]: 00000000adbeef05

FAULTING_THREAD:  000000000000009c

PROCESS_NAME:  DumpRenderTree.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000010

READ_ADDRESS:  0000000000000010 

FOLLOWUP_IP: 
JavaScriptCore!WTF::PageHeapAllocator<WTF::TCMalloc_ThreadCache>::New+a [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 1090]
707289ba 8b08            mov     ecx,dword ptr [eax]

WATSON_BKT_PROCSTAMP:  516ed430

WATSON_BKT_MODULE:  JavaScriptCore.dll

WATSON_BKT_MODSTAMP:  516f06a5

WATSON_BKT_MODOFFSET:  1489ba

BUILD_VERSION_STRING:  6.1.7601.18015 (win7sp1_gdr.121129-1432)

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

ANALYSIS_SESSION_HOST:  BFULGHAM-WIN7VM

ANALYSIS_SESSION_TIME:  04-18-2013 10:39:29.0857

THREAD_ATTRIBUTES: 

[ GLOBAL ]

    Global     PID: [2080]
    Global     Thread_Count: [19]
    Global     LoadedModule_Count: [95]
    Global     PageSize: [4096]
    Global     ModList_SHA1_Hash: [7d106974b0b1d7f0976c04f2d2df5cecb27a5dd2]
    Global     ProcessName: [dumprendertree.exe]
    Global     CommandLine: [e:\projects\webkit\webkitbuild\release\bin\dumprendertree.exe -]
    Global     Desktop_Name: [Winsta0\Default]
    Global     Debugger_CPU_Architecture: [X64]
    Global     CPU_ProcessorCount: [2]
    Global     CPU_MHZ: [3398]
    Global     CPU_Architecture: [X64]
    Global     CPU_Family: [6]
    Global     CPU_Model: [10]
    Global     CPU_Stepping: [7]
    Global     CPU_VendorString: []
    Global     ProcessBeingDebugged
    Global     GFlags: [0]
    Global     Application_Verifer_Flags: [0]
    Global     SystemUpTime: [0 days 0:02:49.000]
    Global     SystemUpTime: [169]
    Global     ProcessUpTime: [0 days 0:00:29.000]
    Global     ProcessUpTime: [29]
    Global     CurrentTimeDate: [Thu Apr 18 10:39:50.000 2013 (UTC - 7:00)]
    Global     CurrentTimeDate: [1366306790]
    Global     ProductType: [1]
    Global     SuiteMask: [272]

[ THREAD ]

  11 Id: 820.9c

    Frame[00]  Is_OriginalExceptionThread
    Frame[00]  Stack_Frames_Extraction_Time_(ms): [0x0]
    Frame[00]  ThreadStartAddress: [MSVCR80!_threadstartex]
    Frame[00]  ThreadStartAddress: [0x00000000754829e1]
    Frame[0c]  CompleteStackWalk
    Frame[0d]  CompleteStackWalk
    Frame[0e]  CompleteStackWalk
    Frame[00]  ThreadLocale: [0x409]
    Frame[00]  BadReadAddress: [0x10]
    Frame[00]  OneBit_READ
    Frame[00]  Number_of_Stack_Frames: [0xf]
    Frame[00]  Bad_Frame_Count: [0x1]
    Frame[00]  Ignored_Frame_Count: [0x4]
    Frame[00]  Frames_not_in_stack_range: [0x1]
    Frame[00]  Is_ManagedThread
    Frame[00]  MissingCriticalSymbol
    Frame[00]  Exception_Handler_Count: [0x1]
    Frame[00]  null_Arch_AX
    Frame[00]  null_Arch_BX
    Frame[00]  null_Arch_CX
    Frame[00]  null_Arch_DX
    Frame[00]  null_Arch_SI
    Frame[00]  null_Arch_DI
    Frame[00]  null_Arch_SP
    Frame[00]  null_Arch_BP
    Frame[00]  null_Arch_IP
    Frame[00]  null_msr_r8
    Frame[00]  null_msr_r9
    Frame[00]  null_msr_r10
    Frame[00]  null_msr_r11
    Frame[00]  null_msr_r12
    Frame[00]  null_msr_r13
    Frame[00]  null_msr_r14
    Frame[00]  null_msr_r15
    Frame[00]  Instruction_Pointer: [0x0000000000000000]
    Frame[00]  NULL_Context_Record
    Frame[00]  Stack_Attribute_Extraction_Time_(ms): [0x1f]


PROBLEM_CLASSES: 

NULL_CLASS_PTR_DEREFERENCE
    Tid    [0xb]
    Frame  [0x00]

INVALID_POINTER_READ
    Tid    [0x9c]
    Frame  [0x00]: ntdll!ZwRaiseException

WRONG_SYMBOLS
    Tid    [0x9c]
    Frame  [0x00]: ntdll!ZwRaiseException

ZEROED_STACK
    Tid    [0x9c]
    Frame  [0x00]: ntdll!ZwRaiseException


BUGCHECK_STR:  APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_ZEROED_STACK

PRIMARY_PROBLEM_CLASS:  NULL_CLASS_PTR_DEREFERENCE

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 0000000077c7014d to 0000000077c815de

STACK_TEXT:  
08eaf4e0 77c7014d 08eaf4f4 08eaf544 00000000 ntdll_77c60000!ZwRaiseException+0x12
08eaf4f0 c0000005 00000000 00000000 707289ba ntdll_77c60000!KiUserExceptionDispatcher+0x29
WARNING: Frame IP not in any known module. Following frames may be wrong.
08eaf9b4 7072945f 0000009c 00000000 7be68360 0xc0000005
08eaf9c4 7072a572 7be683cc 00000000 00000003 JavaScriptCore!WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary+0x3f [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3506]
08eaf9dc 6ed1f9e0 0000012c 7be683cc 7be68360 JavaScriptCore!WTF::fastMalloc+0x32 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
08eaf9f4 6edd90be 08eafa40 7b65af50 7b65af80 WebKit!WebCore::DedicatedWorkerContext::create+0x10 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
08eafa20 6eaf0589 08eafa9c 7b65af50 7b65af80 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
08eafaa4 7073ea01 7be68360 7b012f80 00000000 WebKit!WebCore::WorkerThread::workerThread+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
08eafac0 707394d6 7be68360 00000000 00000000 JavaScriptCore!WTF::threadEntryPoint+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
08eafad4 754829bb 7be33768 d60afe1e 00000000 JavaScriptCore!WTF::wtfThreadEntryPoint+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
08eafb0c 75482a47 00000000 76ac33aa 051ea4e0 MSVCR80!_callthreadstartex+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
08eafb14 76ac33aa 051ea4e0 08eafb60 77c99ef2 MSVCR80!_threadstartex+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
08eafb20 77c99ef2 051ea4e0 7f3ef986 00000000 KERNEL32!BaseThreadInitThunk+0xe
08eafb60 77c99ec5 754829e1 051ea4e0 00000000 ntdll_77c60000!__RtlUserThreadStart+0x70
08eafb78 00000000 754829e1 051ea4e0 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b


FAULT_INSTR_CODE:  4683088b

FAULTING_SOURCE_CODE:  
  1086:     // Consult free list
  1087:     void* result;
  1088:     if (free_list_) {
  1089:       result = free_list_.value();
> 1090:       free_list_ = SLL_Next(free_list_, entropy_);
  1091:     } else {
  1092:       if (free_avail_ < kAlignedSize) {
  1093:         // Need more room
  1094:         char* new_allocation = reinterpret_cast<char*>(MetaDataAlloc(kAllocIncrement));
  1095:         if (!new_allocation)


SYMBOL_NAME:  javascriptcore!WTF::PageHeapAllocator<WTF::TCMalloc_ThreadCache>::New+a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: JavaScriptCore

IMAGE_NAME:  JavaScriptCore.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  516f06a5

STACK_COMMAND:  ~11s ; kb

FAILURE_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE_c0000005_JavaScriptCore.dll!WTF::PageHeapAllocator_WTF::TCMalloc_ThreadCache_::New

BUCKET_ID:  X64_APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_ZEROED_STACK_javascriptcore!WTF::PageHeapAllocator_WTF::TCMalloc_ThreadCache_::New+a

ANALYSIS_SESSION_ELAPSED_TIME: 15fd5

Followup: MachineOwner
---------

0:011:x86> ~*kpn

   0  Id: 820.3f8 Suspend: 1 Teb: 7efdb000 Unfrozen
 # ChildEBP RetAddr  
00 0044ebb0 77823bc8 ntdll_77c60000!ZwDelayExecution+0x15
01 0044ec18 77824498 KERNELBASE!SleepEx+0x65
02 0044ec28 70617664 KERNELBASE!Sleep+0xf
03 0044ec3c 70729cc7 JavaScriptCore!TCMalloc_SpinLock::Lock(void)+0x24 [e:\projects\webkit\webkitbuild\release\include\private\wtf\tcspinlock.h @ 50]
04 0044ec5c 7072a003 JavaScriptCore!WTF::TCMalloc_Central_FreeList::FetchFromSpansSafe(void)+0x37 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3083]
05 0044ec80 7072a63c JavaScriptCore!WTF::TCMalloc_Central_FreeList::RemoveRange(class WTF::HardenedSLL * start = 0x0044eca4, class WTF::HardenedSLL * end = 0x0044eca0, int * N = 0x0044ecb0)+0x63 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3058]
06 0044eca8 6edd902e JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x20)+0xfc [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
07 0044ecb8 6edbbe04 WebKit!WebCore::DedicatedWorkerThread::create(class WebCore::KURL * scriptURL = 0x7be89d50, class WTF::String * userAgent = 0x0044ed28, class WebCore::GroupSettings * settings = 0x7ee94340, class WTF::String * sourceCode = 0x0044ed24, class WebCore::WorkerLoaderProxy * workerLoaderProxy = 0x7be70e08, class WebCore::WorkerObjectProxy * workerObjectProxy = 0x7be70e04, WebCore::WorkerThreadStartMode startMode = DontPauseWorkerContextOnStart (0n0), class WTF::String * contentSecurityPolicy = 0x7ee93040, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WebCore::SecurityOrigin * topOrigin = 0x7be63500)+0xe [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 44]
08 0044ed00 6ed183b2 WebKit!WebCore::WorkerMessagingProxy::startWorkerContext(class WebCore::KURL * scriptURL = 0x7be89d50, class WTF::String * userAgent = 0x0044ed28, class WTF::String * sourceCode = 0x0044ed24, WebCore::WorkerThreadStartMode startMode = DontPauseWorkerContextOnStart (0n0))+0x94 [e:\projects\webkit\source\webcore\workers\workermessagingproxy.cpp @ 280]
09 0044ed38 6edba9c7 WebKit!WebCore::Worker::notifyFinished(void)+0x102 [e:\projects\webkit\source\webcore\workers\worker.cpp @ 148]
0a 0044ed48 6edd34b8 WebKit!WebCore::WorkerScriptLoader::didFinishLoading(unsigned long identifier = 0x15e, double __formal = 0)+0xa7 [e:\projects\webkit\source\webcore\workers\workerscriptloader.cpp @ 159]
0b 0044ed60 6edd3913 WebKit!WebCore::DocumentThreadableLoader::didFinishLoading(unsigned long identifier = 0x15e, double finishTime = 0)+0x68 [e:\projects\webkit\source\webcore\loader\documentthreadableloader.cpp @ 324]
0c 0044ed70 6eb1c9ca WebKit!WebCore::DocumentThreadableLoader::notifyFinished(class WebCore::CachedResource * resource = 0x0044edd4)+0x53 [e:\projects\webkit\source\webcore\loader\documentthreadableloader.cpp @ 312]
0d 0044ed94 6eb1b987 WebKit!WebCore::CachedResource::checkNotify(void)+0x3a [e:\projects\webkit\source\webcore\loader\cache\cachedresource.cpp @ 378]
0e 0044ed9c 6ed25f21 WebKit!WebCore::CachedResource::data(class WTF::PassRefPtr<WebCore::ResourceBuffer> __formal = class WTF::PassRefPtr<WebCore::ResourceBuffer>, bool allDataReceived = true)+0x17 [e:\projects\webkit\source\webcore\loader\cache\cachedresource.cpp @ 388]
0f 0044edd4 6ecbb11f WebKit!WebCore::CachedRawResource::data(class WTF::PassRefPtr<WebCore::ResourceBuffer> data = class WTF::PassRefPtr<WebCore::ResourceBuffer>, bool allDataReceived = true)+0x111 [e:\projects\webkit\source\webcore\loader\cache\cachedrawresource.cpp @ 74]
10 0044edf0 6ed28213 WebKit!WebCore::SubresourceLoader::didFinishLoading(double finishTime = 0)+0x5f [e:\projects\webkit\source\webcore\loader\subresourceloader.cpp @ 284]
11 0044ee00 6e8ba67b WebKit!WebCore::ResourceLoader::didFinishLoading(class WebCore::ResourceHandle * __formal = 0x7be36d10, double finishTime = 0)+0x13 [e:\projects\webkit\source\webcore\loader\resourceloader.cpp @ 501]
12 0044ee18 74c375bf WebKit!WebCore::didFinishLoading(struct _CFURLConnection * conn = 0x0073fb70, void * clientInfo = 0x7be36d10)+0x2b [e:\projects\webkit\source\webcore\platform\network\cf\resourcehandlecfnet.cpp @ 262]
WARNING: Stack unwind information not available. Following frames may be wrong.
13 0044eeb4 74c38f96 CFNetwork!CFReadStreamCreateWithFormArray+0x769f
14 0044f03c 74c32702 CFNetwork!CFReadStreamCreateWithFormArray+0x9076
15 0044f0ac 74c33904 CFNetwork!CFReadStreamCreateWithFormArray+0x27e2
16 0044f0d0 758462fa CFNetwork!CFReadStreamCreateWithFormArray+0x39e4
17 0044f0fc 75846d3a USER32!InternalCallWinProc+0x23
18 0044f174 758477c4 USER32!UserCallWinProcCheckWow+0x109
19 0044f1d4 7584788a USER32!DispatchMessageWorker+0x3bc
1a 0044f1e4 70b8854e USER32!DispatchMessageW+0xf
1b 0044f288 70b8a43f DumpRenderTree_70b70000!runTest(class std::basic_string<char,std::char_traits<char>,std::allocator<char> > * inputLine = 0x0044f2a0)+0x43e [e:\projects\webkit\tools\dumprendertree\win\dumprendertree.cpp @ 1041]
1c 0044faec 00e91aab DumpRenderTree_70b70000!dllLauncherEntryPoint(int argc = 0n2, char ** argv = 0x00766f18)+0x75f [e:\projects\webkit\tools\dumprendertree\win\dumprendertree.cpp @ 1423]
1d 0044fd80 00e91c47 DumpRenderTree!main(int argc = 0n2, char ** argv = 0x00766f18)+0x20b [e:\projects\webkit\tools\win\dlllauncher\dlllaunchermain.cpp @ 206]
1e 0044fdc4 76ac33aa DumpRenderTree!__tmainCRTStartup(void)+0x10f [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 597]
1f 0044fdd0 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
20 0044fe10 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
21 0044fe28 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

   1  Id: 820.87c Suspend: 1 Teb: 7efd8000 Unfrozen
 # ChildEBP RetAddr  
00 00dafb88 7782149d ntdll_77c60000!NtWaitForSingleObject+0x15
01 00dafbf4 76ac1194 KERNELBASE!WaitForSingleObjectEx+0x98
02 00dafc0c 76ac1148 KERNEL32!WaitForSingleObjectExImplementation+0x75
03 00dafc20 752f3f12 KERNEL32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be wrong.
04 00000000 00000000 libdispatch!dispatch_semaphore_create+0x1d2

   2  Id: 820.954 Suspend: 1 Teb: 7efd5000 Unfrozen
 # ChildEBP RetAddr  
00 02d9f99c 77cb2f51 ntdll_77c60000!ZwWaitForMultipleObjects+0x15
01 02d9fb30 76ac33aa ntdll_77c60000!TppWaiterpThread+0x33d
02 02d9fb3c 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
03 02d9fb7c 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
04 02d9fb94 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

   3  Id: 820.8bc Suspend: 1 Teb: 7efad000 Unfrozen
 # ChildEBP RetAddr  
00 02f6f800 77cb3352 ntdll_77c60000!NtWaitForWorkViaWorkerFactory+0x12
01 02f6f960 76ac33aa ntdll_77c60000!TppWorkerThread+0x216
02 02f6f96c 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
03 02f6f9ac 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
04 02f6f9c4 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

   4  Id: 820.6b8 Suspend: 1 Teb: 7efaa000 Unfrozen
 # ChildEBP RetAddr  
00 0319f3a0 778215e9 ntdll_77c60000!ZwWaitForMultipleObjects+0x15
01 0319f43c 76ac1a2c KERNELBASE!WaitForMultipleObjectsEx+0x100
02 0319f484 7585086a KERNEL32!WaitForMultipleObjectsExImplementation+0xe0
03 0319f4d8 7537dcbe USER32!RealMsgWaitForMultipleObjectsEx+0x14d
WARNING: Stack unwind information not available. Following frames may be wrong.
04 0319f608 75380562 CoreFoundation!CFRunLoop01+0x628
05 0319f66c 7538088b CoreFoundation!CFRunLoopGetCurrent+0x7e6
06 0319f6fc 75380979 CoreFoundation!CFRunLoopGetCurrent+0xb0f
07 0319f76c 75334212 CoreFoundation!CFRunLoopRunInMode+0x1c
08 0319f798 754829bb pthreadVC2!ptw32_threadStart(void * vthreadParms = 0x006709a8)+0x62 [c:\bwa\pthreadswin32-12\srcroot\pthreads-w32-2-7-0-release\ptw32_threadstart.c @ 219]
09 0319f7d0 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0a 0319f7d8 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0b 0319f7e4 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0c 0319f824 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0d 0319f83c 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

   5  Id: 820.898 Suspend: 1 Teb: 7ef9d000 Unfrozen
 # ChildEBP RetAddr  
00 036efc40 7782149d ntdll_77c60000!NtWaitForSingleObject+0x15
01 036efcac 76ac1194 KERNELBASE!WaitForSingleObjectEx+0x98
02 036efcc4 76ac1148 KERNEL32!WaitForSingleObjectExImplementation+0x75
03 036efcd8 752f3f12 KERNEL32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be wrong.
04 00000000 00000000 libdispatch!dispatch_semaphore_create+0x1d2

   6  Id: 820.814 Suspend: 1 Teb: 7ef9a000 Unfrozen
 # ChildEBP RetAddr  
00 03fef6a0 77cb3352 ntdll_77c60000!NtWaitForWorkViaWorkerFactory+0x12
01 03fef800 76ac33aa ntdll_77c60000!TppWorkerThread+0x216
02 03fef80c 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
03 03fef84c 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
04 03fef864 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

   7  Id: 820.9b4 Suspend: 1 Teb: 7ee6d000 Unfrozen
 # ChildEBP RetAddr  
00 0435f7c0 7782149d ntdll_77c60000!NtWaitForSingleObject+0x15
01 0435f82c 76ac1194 KERNELBASE!WaitForSingleObjectEx+0x98
02 0435f844 76ac1148 KERNEL32!WaitForSingleObjectExImplementation+0x75
03 0435f858 70739190 KERNEL32!WaitForSingleObject+0x12
04 0435f874 707394ae JavaScriptCore!WTF::PlatformCondition::timedWait(struct WTF::PlatformMutex * mutex = 0x7eee8124, unsigned long durationMilliseconds = 0x3e7)+0x40 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 362]
05 0435f888 7071f313 JavaScriptCore!WTF::ThreadCondition::timedWait(class WTF::Mutex * mutex = 0x7eee8124, double absoluteTime = 1366306769.3670795)+0x2e [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 492]
06 0435f8b0 7073ea01 JavaScriptCore!JSC::BlockAllocator::blockFreeingThreadMain(void)+0x53 [e:\projects\webkit\source\javascriptcore\heap\blockallocator.cpp @ 114]
07 0435f8cc 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7eee8030)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
08 0435f8e0 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7ee93590)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
09 0435f918 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0a 0435f920 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0b 0435f92c 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0c 0435f96c 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0d 0435f984 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

   8  Id: 820.8e8 Suspend: 1 Teb: 7ee6a000 Unfrozen
 # ChildEBP RetAddr  
00 0489f478 778215e9 ntdll_77c60000!ZwWaitForMultipleObjects+0x15
01 0489f514 76ac1a2c KERNELBASE!WaitForMultipleObjectsEx+0x100
02 0489f55c 7585086a KERNEL32!WaitForMultipleObjectsExImplementation+0xe0
03 0489f5b0 7537dcbe USER32!RealMsgWaitForMultipleObjectsEx+0x14d
WARNING: Stack unwind information not available. Following frames may be wrong.
04 0489f6e0 75380562 CoreFoundation!CFRunLoop01+0x628
05 0489f744 7538088b CoreFoundation!CFRunLoopGetCurrent+0x7e6
06 0489f7d4 75380979 CoreFoundation!CFRunLoopGetCurrent+0xb0f
07 0489f834 7073ea01 CoreFoundation!CFRunLoopRunInMode+0x1c
08 0489f850 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x00000000)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
09 0489f864 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7ee93ba8)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
0a 0489f89c 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0b 0489f8a4 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0c 0489f8b0 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0d 0489f8f0 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0e 0489f908 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

   9  Id: 820.23c Suspend: 1 Teb: 7e35d000 Unfrozen
 # ChildEBP RetAddr  
00 083ffc8c 77cb3352 ntdll_77c60000!NtWaitForWorkViaWorkerFactory+0x12
01 083ffdec 76ac33aa ntdll_77c60000!TppWorkerThread+0x216
02 083ffdf8 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
03 083ffe38 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
04 083ffe50 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

  10  Id: 820.b90 Suspend: 1 Teb: 7e35a000 Unfrozen
 # ChildEBP RetAddr  
00 08cafb8c 77823bc8 ntdll_77c60000!ZwDelayExecution+0x15
01 08cafbf4 77824498 KERNELBASE!SleepEx+0x65
02 08cafc04 70617664 KERNELBASE!Sleep+0xf
03 08cafc18 70729cc7 JavaScriptCore!TCMalloc_SpinLock::Lock(void)+0x24 [e:\projects\webkit\webkitbuild\release\include\private\wtf\tcspinlock.h @ 50]
04 08cafc38 7072a003 JavaScriptCore!WTF::TCMalloc_Central_FreeList::FetchFromSpansSafe(void)+0x37 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3083]
05 08cafc5c 7072a63c JavaScriptCore!WTF::TCMalloc_Central_FreeList::RemoveRange(class WTF::HardenedSLL * start = 0x08cafc80, class WTF::HardenedSLL * end = 0x08cafc7c, int * N = 0x08cafc8c)+0x63 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3058]
06 08cafc84 707216c8 JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x10)+0xfc [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
07 08cafc98 70721765 JavaScriptCore!WTF::BlockStack<JSC::JSValue>::grow(void)+0x18 [e:\projects\webkit\webkitbuild\release\include\private\wtf\blockstack.h @ 73]
08 08cafca0 70722881 JavaScriptCore!JSC::HandleStack::HandleStack(void)+0x15 [e:\projects\webkit\source\javascriptcore\heap\handlestack.cpp @ 40]
09 08cafcb4 7060bbc3 JavaScriptCore!JSC::Heap::Heap(class JSC::JSGlobalData * globalData = 0x7be90000, JSC::HeapType heapType = SmallHeap (0n0))+0xf1 [e:\projects\webkit\source\javascriptcore\heap\heap.cpp @ 267]
0a 08cafd7c 7060dd41 JavaScriptCore!JSC::JSGlobalData::JSGlobalData(JSC::JSGlobalData::GlobalDataType globalDataType = Default (0n0), JSC::HeapType heapType = SmallHeap (0n0))+0x53 [e:\projects\webkit\source\javascriptcore\runtime\jsglobaldata.cpp @ 198]
0b 08cafd8c 6e895f65 JavaScriptCore!JSC::JSGlobalData::createLeaked(JSC::HeapType heapType = SmallHeap (0n0))+0x21 [e:\projects\webkit\source\javascriptcore\runtime\jsglobaldata.cpp @ 343]
0c 08cafdac 6ed2019f WebKit!WebCore::WorkerScriptController::WorkerScriptController(class WebCore::WorkerContext * workerContext = 0x7c194b40)+0x15 [e:\projects\webkit\source\webcore\bindings\js\workerscriptcontroller.cpp @ 63]
0d 08cafdc4 6ed1fa10 WebKit!WebCore::WorkerContext::WorkerContext(class WebCore::KURL * url = 0x7b65af00, class WTF::String * userAgent = 0x7b65af30, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::WorkerThread * thread = 0x7be683f0, class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x7f [e:\projects\webkit\source\webcore\workers\workercontext.cpp @ 100]
0e 08cafdec 6edd90be WebKit!WebCore::DedicatedWorkerContext::create(class WebCore::KURL * url = 0x7b65af00, class WTF::String * userAgent = 0x7b65af30, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::DedicatedWorkerThread * thread = 0x7be683f0, class WTF::String * contentSecurityPolicy = 0x7b65af40, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x40 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
0f 08cafe18 6eaf0589 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext(class WebCore::KURL * url = 0x7b65af00, class WTF::String * userAgent = 0x7b65af30, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WTF::String * contentSecurityPolicy = 0x7b65af40, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
10 08cafe9c 7073ea01 WebKit!WebCore::WorkerThread::workerThread(void)+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
11 08cafeb8 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be683f0)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
12 08cafecc 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be33770)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
13 08caff04 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
14 08caff0c 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
15 08caff18 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
16 08caff58 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
17 08caff70 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

# 11  Id: 820.9c Suspend: 1 Teb: 7d44d000 Unfrozen
 # ChildEBP RetAddr  
00 08eaf4e0 77c7014d ntdll_77c60000!ZwRaiseException+0x12
01 08eaf4f0 c0000005 ntdll_77c60000!KiUserExceptionDispatcher+0x29
WARNING: Frame IP not in any known module. Following frames may be wrong.
02 08eaf9b4 7072945f 0xc0000005
03 08eaf9c4 7072a572 JavaScriptCore!WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary(void)+0x3f [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3506]
04 08eaf9dc 6ed1f9e0 JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x12c)+0x32 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
05 08eaf9f4 6edd90be WebKit!WebCore::DedicatedWorkerContext::create(class WebCore::KURL * url = 0x7b65af50, class WTF::String * userAgent = 0x7b65af80, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::DedicatedWorkerThread * thread = 0x7be68360, class WTF::String * contentSecurityPolicy = 0x7b65af90, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x10 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
06 08eafa20 6eaf0589 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext(class WebCore::KURL * url = 0x7b65af50, class WTF::String * userAgent = 0x7b65af80, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WTF::String * contentSecurityPolicy = 0x7b65af90, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
07 08eafaa4 7073ea01 WebKit!WebCore::WorkerThread::workerThread(void)+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
08 08eafac0 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be68360)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
09 08eafad4 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be33768)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
0a 08eafb0c 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0b 08eafb14 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0c 08eafb20 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0d 08eafb60 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0e 08eafb78 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

  12  Id: 820.ccc Suspend: 1 Teb: 7d44a000 Unfrozen
 # ChildEBP RetAddr  
00 0920fd6c 77823bc8 ntdll_77c60000!ZwDelayExecution+0x15
01 0920fdd4 77824498 KERNELBASE!SleepEx+0x65
02 0920fde4 70617664 KERNELBASE!Sleep+0xf
03 0920fdf8 7072942a JavaScriptCore!TCMalloc_SpinLock::Lock(void)+0x24 [e:\projects\webkit\webkitbuild\release\include\private\wtf\tcspinlock.h @ 50]
04 0920fdfc 7072a572 JavaScriptCore!WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary(void)+0xa [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3477]
05 0920fe14 6ed1f9e0 JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x12c)+0x32 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
06 0920fe2c 6edd90be WebKit!WebCore::DedicatedWorkerContext::create(class WebCore::KURL * url = 0x7b65afa0, class WTF::String * userAgent = 0x7b65afd0, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::DedicatedWorkerThread * thread = 0x7be682d0, class WTF::String * contentSecurityPolicy = 0x7b65afe0, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x10 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
07 0920fe58 6eaf0589 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext(class WebCore::KURL * url = 0x7b65afa0, class WTF::String * userAgent = 0x7b65afd0, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WTF::String * contentSecurityPolicy = 0x7b65afe0, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
08 0920fedc 7073ea01 WebKit!WebCore::WorkerThread::workerThread(void)+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
09 0920fef8 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be682d0)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
0a 0920ff0c 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be33758)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
0b 0920ff44 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0c 0920ff4c 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0d 0920ff58 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0e 0920ff98 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0f 0920ffb0 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

  13  Id: 820.b98 Suspend: 1 Teb: 7bf3d000 Unfrozen
 # ChildEBP RetAddr  
00 0947f9f8 7782149d ntdll_77c60000!NtWaitForSingleObject+0x15
01 0947fa64 76ac1194 KERNELBASE!WaitForSingleObjectEx+0x98
02 0947fa7c 76ac1148 KERNEL32!WaitForSingleObjectExImplementation+0x75
03 0947fa90 70739190 KERNEL32!WaitForSingleObject+0x12
04 0947faac 707394ae JavaScriptCore!WTF::PlatformCondition::timedWait(struct WTF::PlatformMutex * mutex = 0x7be90124, unsigned long durationMilliseconds = 0x3e7)+0x40 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 362]
05 0947fac0 7071f313 JavaScriptCore!WTF::ThreadCondition::timedWait(class WTF::Mutex * mutex = 0x7be90124, double absoluteTime = 1366306768.9799612)+0x2e [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 492]
06 0947fae8 7073ea01 JavaScriptCore!JSC::BlockAllocator::blockFreeingThreadMain(void)+0x53 [e:\projects\webkit\source\javascriptcore\heap\blockallocator.cpp @ 114]
07 0947fb04 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be90030)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
08 0947fb18 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be7d4f8)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
09 0947fb50 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0a 0947fb58 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0b 0947fb64 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0c 0947fba4 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0d 0947fbbc 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

  14  Id: 820.9c4 Suspend: 1 Teb: 7bf3a000 Unfrozen
 # ChildEBP RetAddr  
00 0932fd7c 77823bc8 ntdll_77c60000!ZwDelayExecution+0x15
01 0932fde4 77824498 KERNELBASE!SleepEx+0x65
02 0932fdf4 70617664 KERNELBASE!Sleep+0xf
03 0932fe08 7072942a JavaScriptCore!TCMalloc_SpinLock::Lock(void)+0x24 [e:\projects\webkit\webkitbuild\release\include\private\wtf\tcspinlock.h @ 50]
04 0932fe0c 7072a572 JavaScriptCore!WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary(void)+0xa [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3477]
05 0932fe24 6ed1f9e0 JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x12c)+0x32 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
06 0932fe3c 6edd90be WebKit!WebCore::DedicatedWorkerContext::create(class WebCore::KURL * url = 0x7b65a000, class WTF::String * userAgent = 0x7b65a030, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::DedicatedWorkerThread * thread = 0x7be68240, class WTF::String * contentSecurityPolicy = 0x7b65a040, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x10 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
07 0932fe68 6eaf0589 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext(class WebCore::KURL * url = 0x7b65a000, class WTF::String * userAgent = 0x7b65a030, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WTF::String * contentSecurityPolicy = 0x7b65a040, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
08 0932feec 7073ea01 WebKit!WebCore::WorkerThread::workerThread(void)+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
09 0932ff08 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be68240)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
0a 0932ff1c 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be33750)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
0b 0932ff54 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0c 0932ff5c 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0d 0932ff68 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0e 0932ffa8 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0f 0932ffc0 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

  15  Id: 820.c40 Suspend: 1 Teb: 7b92d000 Unfrozen
 # ChildEBP RetAddr  
00 0975fd28 77823bc8 ntdll_77c60000!ZwDelayExecution+0x15
01 0975fd90 77824498 KERNELBASE!SleepEx+0x65
02 0975fda0 70617664 KERNELBASE!Sleep+0xf
03 0975fdb4 7072942a JavaScriptCore!TCMalloc_SpinLock::Lock(void)+0x24 [e:\projects\webkit\webkitbuild\release\include\private\wtf\tcspinlock.h @ 50]
04 0975fdb8 7072a572 JavaScriptCore!WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary(void)+0xa [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3477]
05 0975fdd0 6ed1f9e0 JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x12c)+0x32 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
06 0975fde8 6edd90be WebKit!WebCore::DedicatedWorkerContext::create(class WebCore::KURL * url = 0x7b65a050, class WTF::String * userAgent = 0x7b65a080, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::DedicatedWorkerThread * thread = 0x7be681b0, class WTF::String * contentSecurityPolicy = 0x7b65a090, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x10 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
07 0975fe14 6eaf0589 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext(class WebCore::KURL * url = 0x7b65a050, class WTF::String * userAgent = 0x7b65a080, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WTF::String * contentSecurityPolicy = 0x7b65a090, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
08 0975fe98 7073ea01 WebKit!WebCore::WorkerThread::workerThread(void)+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
09 0975feb4 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be681b0)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
0a 0975fec8 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be124a8)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
0b 0975ff00 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0c 0975ff08 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0d 0975ff14 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0e 0975ff54 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0f 0975ff6c 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

  16  Id: 820.7a0 Suspend: 1 Teb: 7b92a000 Unfrozen
 # ChildEBP RetAddr  
00 095efc60 77823bc8 ntdll_77c60000!ZwDelayExecution+0x15
01 095efcc8 77824498 KERNELBASE!SleepEx+0x65
02 095efcd8 70617664 KERNELBASE!Sleep+0xf
03 095efcec 7072942a JavaScriptCore!TCMalloc_SpinLock::Lock(void)+0x24 [e:\projects\webkit\webkitbuild\release\include\private\wtf\tcspinlock.h @ 50]
04 095efcf0 7072a572 JavaScriptCore!WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary(void)+0xa [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3477]
05 095efd08 6ed1f9e0 JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x12c)+0x32 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
06 095efd20 6edd90be WebKit!WebCore::DedicatedWorkerContext::create(class WebCore::KURL * url = 0x7b65a0a0, class WTF::String * userAgent = 0x7b65a0d0, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::DedicatedWorkerThread * thread = 0x7be68120, class WTF::String * contentSecurityPolicy = 0x7b65a0e0, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x10 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
07 095efd4c 6eaf0589 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext(class WebCore::KURL * url = 0x7b65a0a0, class WTF::String * userAgent = 0x7b65a0d0, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WTF::String * contentSecurityPolicy = 0x7b65a0e0, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
08 095efdd0 7073ea01 WebKit!WebCore::WorkerThread::workerThread(void)+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
09 095efdec 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be68120)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
0a 095efe00 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be33de8)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
0b 095efe38 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0c 095efe40 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0d 095efe4c 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0e 095efe8c 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0f 095efea4 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

  17  Id: 820.3a0 Suspend: 1 Teb: 7b01d000 Unfrozen
 # ChildEBP RetAddr  
00 0997fd64 77823bc8 ntdll_77c60000!ZwDelayExecution+0x15
01 0997fdcc 77824498 KERNELBASE!SleepEx+0x65
02 0997fddc 70617664 KERNELBASE!Sleep+0xf
03 0997fdf0 7072942a JavaScriptCore!TCMalloc_SpinLock::Lock(void)+0x24 [e:\projects\webkit\webkitbuild\release\include\private\wtf\tcspinlock.h @ 50]
04 0997fdf4 7072a572 JavaScriptCore!WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary(void)+0xa [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3477]
05 0997fe0c 6ed1f9e0 JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x12c)+0x32 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
06 0997fe24 6edd90be WebKit!WebCore::DedicatedWorkerContext::create(class WebCore::KURL * url = 0x7b65a0f0, class WTF::String * userAgent = 0x7b65a120, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::DedicatedWorkerThread * thread = 0x7be68090, class WTF::String * contentSecurityPolicy = 0x7b65a130, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x10 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
07 0997fe50 6eaf0589 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext(class WebCore::KURL * url = 0x7b65a0f0, class WTF::String * userAgent = 0x7b65a120, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WTF::String * contentSecurityPolicy = 0x7b65a130, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
08 0997fed4 7073ea01 WebKit!WebCore::WorkerThread::workerThread(void)+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
09 0997fef0 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be68090)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
0a 0997ff04 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be7d318)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
0b 0997ff3c 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0c 0997ff44 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0d 0997ff50 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0e 0997ff90 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0f 0997ffa8 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b

  18  Id: 820.e7c Suspend: 1 Teb: 7b01a000 Unfrozen
 # ChildEBP RetAddr  
00 09b4fa30 77823bc8 ntdll_77c60000!ZwDelayExecution+0x15
01 09b4fa98 77824498 KERNELBASE!SleepEx+0x65
02 09b4faa8 70617664 KERNELBASE!Sleep+0xf
03 09b4fabc 7072942a JavaScriptCore!TCMalloc_SpinLock::Lock(void)+0x24 [e:\projects\webkit\webkitbuild\release\include\private\wtf\tcspinlock.h @ 50]
04 09b4fac0 7072a572 JavaScriptCore!WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary(void)+0xa [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 3477]
05 09b4fad8 6ed1f9e0 JavaScriptCore!WTF::fastMalloc(unsigned int size = 0x12c)+0x32 [e:\projects\webkit\source\wtf\wtf\fastmalloc.cpp @ 4162]
06 09b4faf0 6edd90be WebKit!WebCore::DedicatedWorkerContext::create(class WebCore::KURL * url = 0x7b65a140, class WTF::String * userAgent = 0x7b65a170, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WebCore::DedicatedWorkerThread * thread = 0x7be68000, class WTF::String * contentSecurityPolicy = 0x7b65a180, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x10 [e:\projects\webkit\source\webcore\workers\dedicatedworkercontext.cpp @ 46]
07 09b4fb1c 6eaf0589 WebKit!WebCore::DedicatedWorkerThread::createWorkerContext(class WebCore::KURL * url = 0x7b65a140, class WTF::String * userAgent = 0x7b65a170, class WTF::PassOwnPtr<WebCore::GroupSettings> settings = class WTF::PassOwnPtr<WebCore::GroupSettings>, class WTF::String * contentSecurityPolicy = 0x7b65a180, WebCore::ContentSecurityPolicy::HeaderType contentSecurityPolicyType = Enforce (0n1), class WTF::PassRefPtr<WebCore::SecurityOrigin> topOrigin = class WTF::PassRefPtr<WebCore::SecurityOrigin>)+0x2e [e:\projects\webkit\source\webcore\workers\dedicatedworkerthread.cpp @ 59]
08 09b4fba0 7073ea01 WebKit!WebCore::WorkerThread::workerThread(void)+0x59 [e:\projects\webkit\source\webcore\workers\workerthread.cpp @ 149]
09 09b4fbbc 707394d6 JavaScriptCore!WTF::threadEntryPoint(void * contextData = 0x7be68000)+0x41 [e:\projects\webkit\source\wtf\wtf\threading.cpp @ 69]
0a 09b4fbd0 754829bb JavaScriptCore!WTF::wtfThreadEntryPoint(void * param = 0x7be7d320)+0x16 [e:\projects\webkit\source\wtf\wtf\threadingwin.cpp @ 220]
0b 09b4fc08 75482a47 MSVCR80!_callthreadstartex(void)+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
0c 09b4fc10 76ac33aa MSVCR80!_threadstartex(void * ptd = 0x77c99ef2)+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326]
0d 09b4fc1c 77c99ef2 KERNEL32!BaseThreadInitThunk+0xe
0e 09b4fc5c 77c99ec5 ntdll_77c60000!__RtlUserThreadStart+0x70
0f 09b4fc74 00000000 ntdll_77c60000!_RtlUserThreadStart+0x1b
0:011:x86> q
quit:

[Brent Fulgham]

Discussion with Zoltan on IRC revealed that the problem might be because WorkerContext is a RefCounted.  This could introduce the crash if WorkerContext is used by gc, or a tricky placement new, or there is a cast somewhere. He suggested I try a build where WorkerContext inherits from RefCountedCustomAllocated instead of RefCounted.

[Brent Fulgham]

Created attachment 199526 [details]
Patch

[Brent Fulgham]

Created attachment 199528 [details]
Patch

[Brent Fulgham]

Note that Bug 102895 discusses changes in link order to avoid a runtime crash in KURL tests under Linux. These were caused by an allocator mismatch (using libc's new and fastMalloc delete). This is very similar to MSVC's crashing due to msvcrt new and fastMalloc delete.

See also Bug 115335 for some link errors when trying to build the Apple Windows port with ENABLE_GLOBAL_FASTMALLOC_NEW defined as zero.

[Brent Fulgham]

Created attachment 200158 [details]
Patch

[Darin Adler]

I have an idea for the future of the global operator new: Use it just to catch, in debug builds, classes that are not using fastMalloc but should. And not use it at all in release builds. I wonder if that’s practical on platforms like Mac.

[Tim Horton]

Comment on attachment 200158 [details]
Patch

We'd really like to know what object is getting mismatched, and Oliver thinks we should maybe make this the default behaviour, and Brent is going to bring this up on webkit-dev so we can discuss.

[Zoltan Horvath]

(In reply to comment #6)
> I have an idea for the future of the global operator new: Use it just to catch, in debug builds, classes that are not using fastMalloc but should. And not use it at all in release builds. I wonder if that’s practical on platforms like Mac.

This was our earlier intention also. I'm going to run a static analysis on the system soon to check the the current coverage of the Custom Allocation Framework. It should be pretty good, but I think there are some classes which needs to be FAST_ALLOCATED, then we can experiment with catching the missing classes in debug build.

[Brent Fulgham]

Committed r149408: <http://trac.webkit.org/changeset/149408>

[Brent Fulgham]

Oliver Hunt suggested we might want to make this change the default.  More discussion to follow.

[Build Bot]

Comment on attachment 200158 [details]
Patch

Attachment 200158 [details] did not pass win-ews (win):
Output: http://webkit-queues.appspot.com/results/177179

[Brent Fulgham]

For the record:
[webkit-dev] Mismatched Allocators in Windows

Brent Fulgham bfulgham at webkit.org 
Wed May 1 10:21:40 PDT 2013
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
While investigating a crash in the 'create-lots-of-workers' test (see
https://bugs.webkit.org/show_bug.cgi?id=115130), I found that there were a
number of cases where objects were created using the system allocator, but
later freed using the 'fastFree' overload provided by fastMalloc.h.

I proposed having Windows build using the same settings as Gtk/EFL/QT,
which is to avoid overloading global operator new/delete with the
fastMalloc varients (which fixes the crash).  However, I was not sure if
this would create any kind of performance regression.

Oliver Hunt suggested I document which objects were falling into this
mismatched allocator/deallocator camp.

I used a tool called BoundsChecker (similar to Valgrind) to see if I could
identify which objects fell into this category:

Allocator mismatches (running DumpRenderTree on create-lots-of-workers):

1. DumpRenderTree.cpp, Line 245:

    [...]
    if (lastSlash != -1 && lastSlash + 1 < path.length())
        path = path.substr(0, lastSlash + 1);

    return path;

Here, path is set to the result of the substr method, which internally uses
the system 'new'.  When this temporary is destroyed on return, it is
passing through fastFree.

2. DumpRenderTree.cpp, Line 307 (addQTDirToPATH):

    // And add the QuickTime dll.
    wstring newPath;
    newPath.append(qtPath);
    newPath.append(L";");
    newPath.append(oldPath.data(), oldPath.size());
    SetEnvironmentVariableW(pathEnvironmentVariable, newPath.data());

The various calls to 'append' internally use the system 'new'.  When the
newPath temporary is destroyed on method exit, it is cleaned up by fastFree.

3. CSSParser.cpp, Line 421 (setupParser):

    if (!stringLength || string.is8Bit()) {
        m_dataStart8 = adoptArrayPtr(new LChar[length]);

The m_dataStart8 array is supposedly allocated using system new. In the
destructor, fastFree is getting called.

3. SelectorFilter.cpp, Line 89 (setupParentStack):

    m_parentStack.shrink(0);
    m_ancestorIdentifierFilter = adoptPtr(new
BloomFilter<bloomFilterKeyBits>);

The m_ancestorIdentifierFilter BloomFilter is allocated using system new,
but destroyed (later, in SelectorFilter::popParentStackFrame) by fastFree.

4. WebKitSystemInterface.cpp, Line 724 (wkCACFContextCreate):

Create of the context object is allocated with system new.  Later,
wkCACFContextDestroy calls fastFree to cleanup.

5. PluginPackageWin.cpp, Line 174 (fetchInfo):

    OwnArrayPtr<char> versionInfoData = adoptArrayPtr(new
char[versionInfoSize]);

A character array is allocated using system new, and is cleaned up at scope
exit by fastFree.

4. ThreadingWin.cpp, Line 230 (createThreadInternal):

    OwnPtr<ThreadFunctionInvocation> invocation = adoptPtr(new
ThreadFunctionInvocation(entryPoint, data));

ThreadFunctionInvocation is allocated with system new, but deleted by
fastFree.

Not all of these cases make sense to me, so BoundsChecker may be reporting
some false positives.  For example, I don't see how the 'ThreadingWin.cpp'
case would simultaneously see system 'new' for the adoptPtr call, but then
call 'fastFree' when cleaning up.  The entire object's life-cycle is in a
few lines of code.

[Brent Fulgham]

Committed r149509: <http://trac.webkit.org/changeset/149509>