Bug 102411 - Windows Fibers can corrupt the cached StackBounds
Summary: Windows Fibers can corrupt the cached StackBounds
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Hahnenberg
Depends on:
Reported: 2012-11-15 10:17 PST by Mark Hahnenberg
Modified: 2012-11-15 10:53 PST (History)
4 users (show)

See Also:

Patch (2.70 KB, patch)
2012-11-15 10:42 PST, Mark Hahnenberg
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Hahnenberg 2012-11-15 10:17:43 PST
Windows has support for something called fibers, which are like lightweight versions of threads. Multiple fibers can run within the context of a single thread and they have access to the same thread local storage but have different stacks. If we create a new JSGlobalContext on one fiber, then switch to another fiber and create a JSGlobalContext there, we will call initializeThreading() once for each new JSGlobalContext created. However, since these fibers are technically running inside the same thread, they will clobber each other's wtfThreadData(), which is stored using thread local storage. This can lead to corruption of the WTFThreadData structure for the fibers other than the last one to create a new JSGlobalContext, including the StackBounds data structure which is used during conservative scanning, among other things. This can lead to crashes during garbage collection on Windows if fibers are used.

A quick fix would be to always get a fresh StackBounds data structure when asking for it instead of using the cached version from the thread local storage. There is a larger problem in that these fibers can corrupt other WebKit data that uses thread local storage. We'll leave those theoretical fixes for future theoretical bugs.
Comment 1 Mark Hahnenberg 2012-11-15 10:42:31 PST
Created attachment 174485 [details]
Comment 2 Geoffrey Garen 2012-11-15 10:46:58 PST
Comment on attachment 174485 [details]


This will fix cases that schedule one fiber at a time; we still don't support fiber A switching to fiber B recursively, since the stack will be discontiguous in that case.
Comment 3 Oliver Hunt 2012-11-15 10:49:48 PST
Where are we using fibers???
Comment 4 Mark Hahnenberg 2012-11-15 10:50:59 PST
(In reply to comment #3)
> Where are we using fibers???

Clients of JSC on Windows could use fibers.
Comment 5 Mark Hahnenberg 2012-11-15 10:52:42 PST
Comment 6 Mark Hahnenberg 2012-11-15 10:53:51 PST
Committed r134797: <http://trac.webkit.org/changeset/134797>