Bug 36514

Summary: [v8] Failed assertion in V8Proxy::setDOMException() if worker is shutting down
Product: WebKit Reporter: Andrew Wilson <atwilson>
Component: WebCore JavaScriptAssignee: Andrew Wilson <atwilson>
Severity: Normal CC: commit-queue, dimich, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Description Flags
Patch none

Description Andrew Wilson 2010-03-23 18:43:00 PDT
The SharedWorkerHttpAuth test results in the worker being shutdown in the middle of an importScript() call, which results in an exception being generated and passed to V8Proxy::setDOMException().

There's a race condition that occurs - if WorkerScriptController::forbidExecution() is invoked before the importScript() call returns and calls setDOMException(), then a failed assertion happens.

It seems that this line in setDOMException() yields an empty exception object:

        exception = toV8(EventException::create(description));

Which causes this to fail further on in the function.


I suspect the issue is that toV8() can't create an object if the worker context is shutting down.

I think the right thing to do is to get rid of that assertion, and instead have a failed assertion in the default: case statement (failing if setDOMException() is passed an unknown exception type), and then quietly return without throwing the exception.
Comment 1 Andrew Wilson 2010-03-24 10:17:24 PDT
Created attachment 51516 [details]
Comment 2 WebKit Review Bot 2010-03-24 10:19:12 PDT
Attachment 51516 [details] did not pass style-queue:

Failed to run "WebKitTools/Scripts/check-webkit-style" exit_code: 1
WebCore/ChangeLog:8:  Line contains tab character.  [whitespace/tab] [5]
WebCore/ChangeLog:12:  Line contains tab character.  [whitespace/tab] [5]
Total errors found: 2 in 2 files

If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 3 Dmitry Titov 2010-03-24 10:57:01 PDT
Comment on attachment 51516 [details]


Please change tabs to spaces, per style bot note.

It is a good rule to have [v8] in front of title of the bug if the change only affects v8-specific files. Some people use it to immediately see if the change is relevant or not relevant for them (having filters etc). I've changed the bug title.
Comment 4 Andrew Wilson 2010-03-24 11:05:19 PDT
Created attachment 51527 [details]
Comment 5 Andrew Wilson 2010-03-24 11:07:10 PDT
Created attachment 51528 [details]
Comment 6 Dmitry Titov 2010-03-24 11:44:30 PDT
Comment on attachment 51528 [details]

Comment 7 WebKit Commit Bot 2010-03-24 15:05:09 PDT
Comment on attachment 51528 [details]

Clearing flags on attachment: 51528

Committed r56461: <http://trac.webkit.org/changeset/56461>
Comment 8 WebKit Commit Bot 2010-03-24 15:05:14 PDT
All reviewed patches have been landed.  Closing bug.