Summary: | We need to destroy worker threads in jsc.cpp | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | JF Bastien <jfbastien> | ||||||
Component: | JavaScriptCore | Assignee: | Saam Barati <saam> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | fpizlo, gskachkov, jfbastien, keith_miller, mark.lam, msaboff, saam, ticaiolima, webkit-bug-importer | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Bug Depends on: | 170628 | ||||||||
Bug Blocks: | |||||||||
Attachments: |
|
Description
JF Bastien
2017-04-11 15:00:50 PDT
Created attachment 306859 [details]
Test causing the failure
This looks like it could be a serious bug. The bug is as follows: - We're asserting that a string that we observed as being atomic is no longer atomic. - This happens because we create the $agent thread, start compiling code, then destroy the thread, all before the compilation finishes. This will lead to the thread's atomic string table being destroyed. We have two options: 1. Wait for compilations to finish for workers 2. Just destroy worker VMs I'm choosing 2 since this is what WebCore does and it's probably good testing. We're not going to destroy the VM when it's the main thread VM since the main thread is just going to exit. Created attachment 310574 [details]
patch
Comment on attachment 310574 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=310574&action=review > Source/JavaScriptCore/jsc.cpp:3855 > + oops, I'll undo I accidentally undid Pizlo's r+. r=pizlo |