Bug 65638

Summary: Interpreter can potentially GC in the middle of initializing a structure chain
Product: WebKit Reporter: Mark Hahnenberg <mhahnenberg>
Component: JavaScriptCoreAssignee: Mark Hahnenberg <mhahnenberg>
Status: RESOLVED FIXED    
Severity: Normal CC: oliver, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch none

Mark Hahnenberg
Reported 2011-08-03 13:31:44 PDT
Occasionally when running new-run-webkit-tests we can get a failure when the garbage collector decides to do a collection in the middle of initializing a structure chain in Interpreter.cpp around line 1396. It's difficult to reproduce on its own due to the fact that it depends on what the garbage collector is doing up to that point of the test. An easy fix would be to move the allocation of the prototypeChain before calling getOpcode.
Attachments
Patch (1.94 KB, patch)
2011-08-03 16:19 PDT, Mark Hahnenberg 		no flags
DetailsFormatted DiffDiff
Patch (2.14 KB, patch)
2011-08-03 16:42 PDT, Mark Hahnenberg 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Mark Hahnenberg
Comment 1 2011-08-03 16:19:36 PDT
Created attachment 102850 [details] Patch
Michael Saboff
Comment 2 2011-08-03 16:31:25 PDT
Comment on attachment 102850 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=102850&action=review > Source/JavaScriptCore/interpreter/Interpreter.cpp:1392 > + StructureChain* prototypeChain = structure->prototypeChain(callFrame); I think it make sense to document why you do the call here and use a local so that some future unsuspecting engineer doesn't reintroduce the bug by eliminating the local.
Mark Hahnenberg
Comment 3 2011-08-03 16:42:39 PDT
Created attachment 102859 [details] Patch
WebKit Review Bot
Comment 4 2011-08-04 11:26:42 PDT
Comment on attachment 102859 [details] Patch Clearing flags on attachment: 102859 Committed r92393: <http://trac.webkit.org/changeset/92393>
WebKit Review Bot
Comment 5 2011-08-04 11:26:46 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.