Bug 148312

Summary: REGRESSION (r188714): Crash in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net
Product: WebKit Reporter: Timothy Hatcher <timothy>
Component: JavaScriptCoreAssignee: Geoffrey Garen <ggaren>
Status: RESOLVED FIXED    
Severity: Normal CC: bburg, fpizlo, ggaren, joepeck, mark.lam, msaboff, saam, timothy, ysuzuki
Priority: P2    
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch mark.lam: review+

Timothy Hatcher
Reported 2015-08-21 10:35:15 PDT
Thread 1 Queue : com.apple.main-thread (serial) #0 0x000000010284b9cd in JSC::Heap::incrementDeferralDepth() [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/HeapInlines.h:302 #1 0x000000010284b9cd in JSC::DeferGC::DeferGC(JSC::Heap&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/DeferGC.h:41 #2 0x000000010284b9cd in JSC::DeferGC::DeferGC(JSC::Heap&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/DeferGC.h:40 #3 0x000000010284b9cd in JSC::DFG::Worklist::completeAllPlansForVM(JSC::VM&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/dfg/DFGWorklist.cpp:205 #4 0x000000010284cdd8 in JSC::DFG::completeAllPlansForVM(JSC::VM&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/dfg/DFGWorklist.cpp:455 #5 0x0000000102689c6c in JSC::Debugger::recompileAllJSFunctions(JSC::VM*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/debugger/Debugger.cpp:353 #6 0x0000000103b713d2 in WebCore::PageScriptDebugServer::recompileAllJSFunctions() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/PageScriptDebugServer.cpp:91 #7 0x00000001036c4e50 in WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend(Inspector::FrontendChannel*, Inspector::BackendDispatcher*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/InspectorTimelineAgent.cpp:100 #8 0x00000001028fb2e4 in Inspector::AgentRegistry::didCreateFrontendAndBackend(Inspector::FrontendChannel*, Inspector::BackendDispatcher*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/inspector/InspectorAgentRegistry.cpp:55 #9 0x000000010365e623 in WebCore::InspectorController::connectFrontend(Inspector::FrontendChannel*, bool) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/InspectorController.cpp:247 #10 0x0000000101865ae1 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::MessageDecoder&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/MessageReceiverMap.cpp:102 #11 0x0000000101a208b8 in WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::MessageDecoder&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/WebProcess/WebProcess.cpp:618 #12 0x000000010181f8ec in IPC::Connection::dispatchMessage(IPC::MessageDecoder&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:878 #13 0x000000010181f8df in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:901 #14 0x0000000101821fd5 in IPC::Connection::dispatchOneMessage() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:929 #15 0x0000000102c5ff15 in std::__1::function<void ()>::operator()() const [inlined] at /Applications/Xcode.app/Contents/Developer/Toolchains/OSX10.11.xctoolchain/usr/bin/../include/c++/v1/functional:1793 #16 0x0000000102c5ff0b in WTF::RunLoop::performWork() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WTF/wtf/RunLoop.cpp:104 #17 0x0000000102c605f2 in WTF::RunLoop::performWork(void*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WTF/wtf/cf/RunLoopCF.cpp:38
Attachments
Patch (1.38 KB, patch)
2015-08-21 11:32 PDT, Geoffrey Garen 		mark.lam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Timothy Hatcher
Comment 1 2015-08-21 10:36:50 PDT
Pretty much any site now crashes when opening the Web Inspector. Only about:blank seems to work.
Timothy Hatcher
Comment 2 2015-08-21 11:24:31 PDT
Looks like r188714 broke this.
Geoffrey Garen
Comment 3 2015-08-21 11:32:08 PDT
Created attachment 259635 [details] Patch
Mark Lam
Comment 4 2015-08-21 11:32:57 PDT
Comment on attachment 259635 [details] Patch r=me
Geoffrey Garen
Comment 5 2015-08-21 11:39:34 PDT
Committed r188762: <http://trac.webkit.org/changeset/188762>
Joseph Pecoraro
Comment 6 2015-08-21 11:47:26 PDT
Comment on attachment 259635 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=259635&action=review > Source/JavaScriptCore/ChangeLog:3 > + REGRESSION (r188714): RELEASE_ASSERT in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net So this wasn't a RELEASE_ASSERT? Maybe we should retitle before landing.
Note You need to log in before you can comment on or make changes to this bug.