Bug 85473 – IconDatabase thread causes assertion failure: m_verifier.isSafeToUse()

• Component: WebCore Misc.
• Status: RESOLVED DUPLICATE

[Dongseong Hwang]

adopted(RefCountedBase*) means new start of ia refCounted instance.
RefPtr::release calls WTF::adopted to reset, so RefCounted thread verification
code should reset.

SharedBuffer used by IconDatabase causes the assertion failure because
IconDatabase passes SharedBuffer to main thread.

[Dongseong Hwang]

Created attachment 139981 [details]
patch v.1

[Dongseong Hwang]

Following code causes assertion failure.
In IconDatabase.cpp

    RefPtr<SharedBuffer> data = dataOriginal ? dataOriginal->copy() : PassRefPtr<SharedBuffer>(0);
    ....
    {
        MutexLocker locker(m_urlAndIconLock);
        ....
        // Update the data and set the time stamp
        icon->setImageData(data.release());
        ....
    }

[David Levin]

Comment on attachment 139981 [details]
patch v.1

adopted just means that a refcount that wasn't accounted for now is. This is no reason to reset the verifier.


Something is wrong in this code and this change just attempts to hide the problem.

[David Levin]

If you want to understand the assert, figure out what invariant is being violated when the assert goes off and either why that invariant is incorrect or how to fix the code.

Note here is a similar bug: https://bugs.webkit.org/show_bug.cgi?id=67582

(Perhaps it is the same issue. It is hard to tell from what is in this bug.)

[Dongseong Hwang]

Ok, I made mistake that I thought RefPtr::release means passing ownership.

I need to study more about this bug, and if it is duplicated with Bug 67582, I will close this bug.

[David Levin]

(In reply to comment #5)
> Ok, I made mistake that I thought RefPtr::release means passing ownership.

It means passing ownership of that one ref count but other places may have a ref on the object (and they do in this case).

> I need to study more about this bug, and if it is duplicated with Bug 67582, I will close this bug.

I think the only thing stopping bug 67582 is some wierd windows compile error. I wish we could land it.

[Yong Li]

*** This bug has been marked as a duplicate of bug 67582 ***