Bug 148312

Summary:

REGRESSION (r188714): Crash in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net

Product:

WebKit

Reporter:

Timothy Hatcher <timothy>

Component:

JavaScriptCore

Assignee:

Geoffrey Garen <ggaren>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bburg, fpizlo, ggaren, joepeck, mark.lam, msaboff, saam, timothy, ysuzuki

Priority:

Version:

WebKit Local Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	mark.lam: review+

Description Timothy Hatcher 2015-08-21 10:35:15 PDT

Thread 1 Queue : com.apple.main-thread (serial)
#0	0x000000010284b9cd in JSC::Heap::incrementDeferralDepth() [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/HeapInlines.h:302
#1	0x000000010284b9cd in JSC::DeferGC::DeferGC(JSC::Heap&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/DeferGC.h:41
#2	0x000000010284b9cd in JSC::DeferGC::DeferGC(JSC::Heap&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/DeferGC.h:40
#3	0x000000010284b9cd in JSC::DFG::Worklist::completeAllPlansForVM(JSC::VM&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/dfg/DFGWorklist.cpp:205
#4	0x000000010284cdd8 in JSC::DFG::completeAllPlansForVM(JSC::VM&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/dfg/DFGWorklist.cpp:455
#5	0x0000000102689c6c in JSC::Debugger::recompileAllJSFunctions(JSC::VM*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/debugger/Debugger.cpp:353
#6	0x0000000103b713d2 in WebCore::PageScriptDebugServer::recompileAllJSFunctions() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/PageScriptDebugServer.cpp:91
#7	0x00000001036c4e50 in WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend(Inspector::FrontendChannel*, Inspector::BackendDispatcher*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/InspectorTimelineAgent.cpp:100
#8	0x00000001028fb2e4 in Inspector::AgentRegistry::didCreateFrontendAndBackend(Inspector::FrontendChannel*, Inspector::BackendDispatcher*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/inspector/InspectorAgentRegistry.cpp:55
#9	0x000000010365e623 in WebCore::InspectorController::connectFrontend(Inspector::FrontendChannel*, bool) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/InspectorController.cpp:247
#10	0x0000000101865ae1 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::MessageDecoder&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/MessageReceiverMap.cpp:102
#11	0x0000000101a208b8 in WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::MessageDecoder&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/WebProcess/WebProcess.cpp:618
#12	0x000000010181f8ec in IPC::Connection::dispatchMessage(IPC::MessageDecoder&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:878
#13	0x000000010181f8df in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:901
#14	0x0000000101821fd5 in IPC::Connection::dispatchOneMessage() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:929
#15	0x0000000102c5ff15 in std::__1::function<void ()>::operator()() const [inlined] at /Applications/Xcode.app/Contents/Developer/Toolchains/OSX10.11.xctoolchain/usr/bin/../include/c++/v1/functional:1793
#16	0x0000000102c5ff0b in WTF::RunLoop::performWork() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WTF/wtf/RunLoop.cpp:104
#17	0x0000000102c605f2 in WTF::RunLoop::performWork(void*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WTF/wtf/cf/RunLoopCF.cpp:38

Comment 1 Timothy Hatcher 2015-08-21 10:36:50 PDT

Pretty much any site now crashes when opening the Web Inspector. Only about:blank seems to work.

Comment 2 Timothy Hatcher 2015-08-21 11:24:31 PDT

Looks like r188714 broke this.

Comment 3 Geoffrey Garen 2015-08-21 11:32:08 PDT

Created attachment 259635 [details]
Patch

Comment 4 Mark Lam 2015-08-21 11:32:57 PDT

Comment on attachment 259635 [details]
Patch

r=me

Comment 5 Geoffrey Garen 2015-08-21 11:39:34 PDT

Committed r188762: <http://trac.webkit.org/changeset/188762>

Comment 6 Joseph Pecoraro 2015-08-21 11:47:26 PDT

Comment on attachment 259635 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=259635&action=review

> Source/JavaScriptCore/ChangeLog:3
> +        REGRESSION (r188714): RELEASE_ASSERT in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net

So this wasn't a RELEASE_ASSERT? Maybe we should retitle before landing.