REGRESSION: RELEASE_ASSERT in CodeBlock::baselineVersion @ cnn.com

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

We crash with the following traceback:
0   JavaScriptCore                      0x00000001005e1ac8 WTFCrash + 72
1   JavaScriptCore                      0x0000000100297a88 JSC::CodeBlock::baselineVersion() + 148
2   JavaScriptCore                      0x000000010031d684 JSC::DFG::JITFinalizer::finalizeCommon() + 124
3   JavaScriptCore                      0x000000010031d784 JSC::DFG::JITFinalizer::finalizeFunction() + 224
4   JavaScriptCore                      0x000000010033fe44 JSC::DFG::Plan::finalizeWithoutNotifyingCallback() + 188
5   JavaScriptCore                      0x000000010033ff50 JSC::DFG::Plan::finalizeAndNotifyCallback() + 36
6   JavaScriptCore                      0x00000001003ac9e8 JSC::DFG::Worklist::completeAllReadyPlansForVM(JSC::VM&, JSC::DFG::CompilationKey) + 340
7   JavaScriptCore                      0x0000000100403358 operationOptimize + 552
8   ???                                 0x00000001061c40c4 0 + 4397482180
9   JavaScriptCore                      0x00000001004c03dc llint_op_call + 180
10  JavaScriptCore                      0x00000001004c0440 llint_op_call + 280
11  JavaScriptCore                      0x00000001004c0570 llint_op_construct + 236
12  ???                                 0x0000000106144c3c 0 + 4396960828
13  JavaScriptCore                      0x00000001004bb238 callToJavaScript + 304
14  JavaScriptCore                      0x00000001003ee37c JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 44
15  JavaScriptCore                      0x00000001003db6f4 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 2940
16  JavaScriptCore                      0x00000001002abd48 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 452
17  WebCore                             0x000000010145c224 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 280
18  WebCore                             0x000000010145c42c WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 48
19  WebCore                             0x00000001014618f4 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 592
20  WebCore                             0x00000001014604d0 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 1064
21  WebCore                             0x0000000100d74428 WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) + 264
22  WebCore                             0x0000000100d742c0 WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) + 60
23  WebCore                             0x0000000100d1b164 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 76
24  WebCore                             0x0000000100d1b208 WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&) + 104
25  WebCore                             0x0000000100d1aef8 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 360
26  WebCore                             0x0000000100d1baa0 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() + 104
27  WebCore                             0x0000000100d1bcdc non-virtual thunk to WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 96
28  WebCore                             0x00000001009becd8 WebCore::CachedResource::checkNotify() + 268
29  WebCore                             0x00000001015066b8 WebCore::SubresourceLoader::didFinishLoading(double) + 108
30  CFNetwork                           0x00000001866ae168 ___ZN27URLConnectionClient_Classic26_delegate_didFinishLoadingEU13block_pointerFvvE_block_invoke + 100
31  CFNetwork                           0x0000000186767298 ___ZN27URLConnectionClient_Classic18_withDelegateAsyncEPKcU13block_pointerFvP16_CFURLConnectionPK33CFURLConnectionClientCurrent_VMaxE_block_invoke_2 + 92
32  CoreFoundation                      0x0000000186bac000 CFArrayApplyFunction + 64
33  CFNetwork                           0x000000018669be0c RunloopBlockContext::perform() + 132
34  CFNetwork                           0x000000018669bcc0 MultiplexerSource::perform() + 308
35  CFNetwork                           0x000000018669bae4 MultiplexerSource::_perform(void*) + 56
36  CoreFoundation                      0x0000000186c80d34 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 20
37  CoreFoundation                      0x0000000186c80050 __CFRunLoopDoSources0 + 240
38  CoreFoundation                      0x0000000186c7e2c4 __CFRunLoopRun + 696
39  CoreFoundation                      0x0000000186bac61c CFRunLoopRunSpecific + 384
40  WebCore                             0x00000001015c38c8 RunWebThread(void*) + 468
41  libsystem_pthread.dylib             0x0000000195ea4000 _pthread_body + 160
42  libsystem_pthread.dylib             0x0000000195ea3f5c _pthread_start + 136
43  libsystem_pthread.dylib             0x0000000195ea1430 thread_start + 0

[Michael Saboff]

Created attachment 230856 [details]
Patch

[Michael Saboff]

Committed r168319: <http://trac.webkit.org/changeset/168319>

[Geoffrey Garen]

Comment on attachment 230856 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review

> Source/JavaScriptCore/ChangeLog:11
> +        (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we
> +        started compiling for is still the same at the end of compilation.
> +        Also did some minor restructuring.

Why might they be different? Please explain.

Please add a regression test.

[Michael Saboff]

(In reply to comment #3)
> (From update of attachment 230856 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review
> 
> > Source/JavaScriptCore/ChangeLog:11
> > +        (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we
> > +        started compiling for is still the same at the end of compilation.
> > +        Also did some minor restructuring.
> 
> Why might they be different? Please explain.

Because we cleared the code blocks of the executable during GC.

> Please add a regression test.

Given that the issue is the result of a GC while we have compilation(s) queued up or needing finalization, I think it would difficult to write a deterministic test.

[Michael Saboff]

(In reply to comment #3)
> (From update of attachment 230856 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review
> 
> > Source/JavaScriptCore/ChangeLog:11
> > +        (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we
> > +        started compiling for is still the same at the end of compilation.
> > +        Also did some minor restructuring.
> 
> Why might they be different? Please explain.
> 
> Please add a regression test.

New test tracked in https://bugs.webkit.org/show_bug.cgi?id=132632 and landed in change set r168396: <http://trac.webkit.org/changeset/168396>.

[Geoffrey Garen]

<rdar://problem/15961859>