Bug 121661 – Frequent RELEASE_ASSERT crashes in Structure::checkOffsetConsistency on WebGL swizzler tests

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Alexey Proskuryakov]

All these tests are quite crashy, particularly on leaks tester for whatever reason: <http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=swizzlers>

    RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == propertyTable->propertyStorageSize());

Thread 12 Crashed:: JSC Compilation Thread
0   com.apple.JavaScriptCore      	0x000000010d91280a WTFCrash + 42 (Assertions.cpp:342)
1   com.apple.JavaScriptCore      	0x000000010d395a9f JSC::Structure::checkOffsetConsistency() const + 207 (StructureInlines.h:233)
2   com.apple.JavaScriptCore      	0x000000010d394c89 JSC::Structure::outOfLineCapacity() const + 25 (Structure.h:182)
3   com.apple.JavaScriptCore      	0x000000010d49ee2f JSC::DFG::ByteCodeParser::parseBlock(unsigned int) + 16639 (DFGByteCodeParser.cpp:2518)
4   com.apple.JavaScriptCore      	0x000000010d499ab2 JSC::DFG::ByteCodeParser::parseCodeBlock() + 2002 (DFGByteCodeParser.cpp:3589)
5   com.apple.JavaScriptCore      	0x000000010d4a50fa JSC::DFG::ByteCodeParser::parse() + 250 (DFGByteCodeParser.cpp:3626)
6   com.apple.JavaScriptCore      	0x000000010d4a53de JSC::DFG::parse(JSC::DFG::Graph&) + 62 (DFGByteCodeParser.cpp:3666)
7   com.apple.JavaScriptCore      	0x000000010d59446e JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) + 190 (DFGPlan.cpp:155)
8   com.apple.JavaScriptCore      	0x000000010d5941a2 JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&) + 242 (DFGPlan.cpp:116)
9   com.apple.JavaScriptCore      	0x000000010d634cc4 JSC::DFG::Worklist::runThread() + 468 (DFGWorklist.cpp:239)
10  com.apple.JavaScriptCore      	0x000000010d633d95 JSC::DFG::Worklist::threadFunction(void*) + 21 (DFGWorklist.cpp:261)
11  com.apple.JavaScriptCore      	0x000000010d959400 WTF::threadEntryPoint(void*) + 144 (Threading.cpp:70)
12  com.apple.JavaScriptCore      	0x000000010d959dd8 WTF::wtfThreadEntryPoint(void*) + 104 (ThreadingPthreads.cpp:195)
13  libsystem_c.dylib             	0x00007fff96e23772 _pthread_start + 327
14  libsystem_c.dylib             	0x00007fff96e101a1 thread_start + 13

[Radar WebKit Bug Importer]

<rdar://problem/15038349>

[Filip Pizlo]

Created attachment 214586 [details]
the patch

[Filip Pizlo]

Created attachment 214587 [details]
the patch

[Mark Hahnenberg]

Comment on attachment 214587 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214587&action=review

r=me

> Source/JavaScriptCore/ChangeLog:21
> +        keeping in sync with m_offset, we have the checkOffsetConsistency method. It's meant to be

it in sync

> Source/JavaScriptCore/ChangeLog:39
> +        outOfLineCapacity(), and is right to do wo without holding any locks (since in all cases where

do so

> Source/JavaScriptCore/ChangeLog:44
> +        property table modified - instead what happens is that so downstream structure steals the

some downstream

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/157645