Bug 194767

Summary: Deadlock when adding a Structure property transition and then doing incremental marking
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, commit-queue, fpizlo, ggaren, gskachkov, guijemont, keith_miller, mark.lam, msaboff, rmorisset, ticaiolima, tzagallo, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch none

Saam Barati
Reported 2019-02-17 14:47:14 PST
So you have a Structure S. S is on the mark stack. Then: 1. S grabs its lock 2. S adds a new property transition 3. We find out we need to do some incremental marking 4. We mark S 5. visitChildren on S will try to grab its lock 6. We are now in a deadlock
Attachments
patch (3.53 KB, patch)
2019-02-17 15:08 PST, Saam Barati 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2019-02-17 15:08:47 PST
Created attachment 362257 [details] patch
Mark Lam
Comment 2 2019-02-17 15:11:34 PST
Comment on attachment 362257 [details] patch r=me
WebKit Commit Bot
Comment 3 2019-02-17 17:27:28 PST
Comment on attachment 362257 [details] patch Clearing flags on attachment: 362257 Committed r241655: <https://trac.webkit.org/changeset/241655>
WebKit Commit Bot
Comment 4 2019-02-17 17:27:29 PST
All reviewed patches have been landed. Closing bug.
Radar WebKit Bug Importer
Comment 5 2019-02-17 17:28:33 PST
<rdar://problem/48150864>
Note You need to log in before you can comment on or make changes to this bug.