Summary: | Assertion failure in JSC::SlotVisitor::copyLater when marking JSDataView | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> | ||||
Component: | JavaScriptCore | Assignee: | Filip Pizlo <fpizlo> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | eflews.bot, fpizlo, ggaren, gyuyoung.kim, mhahnenberg, oliver, thorton, webkit-ews | ||||
Priority: | P1 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Attachments: |
|
Description
Ryosuke Niwa
2013-08-20 20:19:57 PDT
This ASSERT is meant to catch cases where we would have corrupted to the state of CopiedSpace which may or may not have caused a crash later. I'll see if I can track down the particular object that's causing this issue. It appears that this particular crash is happening on ML Debug WK2 test builder quite frequently: http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK2%20(Tests)/r154383%20(11831)/fast/canvas/webgl/array-message-passing-crash-log.txt http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK2%20(Tests)/r154383%20(11831)/fast/canvas/webgl/array-message-passing-crash-log.txt I haven't seen this particular crash on WK1 bots so maybe it's more or only reproducible on WK2. This one is crashing on the main thread: http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK2%20(Tests)/r154384%20(11832)/security/crypto-random-values-crash-log.txt I can repro very easily with WKTR by running fast/canvas/webgl/array-message-passing.html repeatedly. Looks like the offending object is a DataView. (In reply to comment #6) > Looks like the offending object is a DataView. A JSDataView, to be more precise. Temporarily marked as a debug crash in http://trac.webkit.org/changeset/154402 Created attachment 209295 [details]
the patch
Comment on attachment 209295 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=209295&action=review r=me > Source/JavaScriptCore/runtime/JSArrayBufferView.h:74 > + // A data view. B is unusewd, V points to a vector allocated using who- unused > Source/JavaScriptCore/runtime/JSArrayBufferView.h:75 > + // knows-what, and M = DataViewMode. The view does not own the vector vector. (In reply to comment #8) > Temporarily marked as a debug crash in http://trac.webkit.org/changeset/154402 Please revert this too, in your patch (or after it). Comment on attachment 209295 [details] the patch Attachment 209295 [details] did not pass qt-wk2-ews (qt-wk2): Output: http://webkit-queues.appspot.com/results/1529149 Comment on attachment 209295 [details] the patch Attachment 209295 [details] did not pass efl-wk2-ews (efl-wk2): Output: http://webkit-queues.appspot.com/results/1512963 Comment on attachment 209295 [details] the patch Attachment 209295 [details] did not pass efl-ews (efl): Output: http://webkit-queues.appspot.com/results/1516849 Landed in http://trac.webkit.org/changeset/154408 |