Bug 116633 - fourthTier: Race between LLInt->Baseline tier-up and DFG reading Baseline profiling data
Summary: fourthTier: Race between LLInt->Baseline tier-up and DFG reading Baseline pro...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on:
Blocks: 112836
  Show dependency tree / graph
 
Reported: 2013-05-22 13:22 PDT by Filip Pizlo
Modified: 2013-05-22 21:18 PDT (History)
8 users (show)

See Also:

Attachments
the patch (9.50 KB, patch)
2013-05-22 14:20 PDT, Filip Pizlo 		mhahnenberg: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-05-22 13:22:25 PDT 
If a code block has baseline profiling data because it was tiered up from LLInt to Baseline, then the DFG will try to read that additional data.  The updates to that data (like incrementing slow-path counters) are racy and that's fine.  But the bug is that the *creation* of those data structures that the Baseline JIT uses and the DFG reads is also racy and this is leading to hilarious crashes.
Comment 1 Filip Pizlo 2013-05-22 14:20:34 PDT 
Created attachment 202623 [details]
the patch
Comment 2 Mark Hahnenberg 2013-05-22 14:25:18 PDT 
Comment on attachment 202623 [details]
the patch

r=me
Comment 3 Filip Pizlo 2013-05-22 21:18:53 PDT 
Landed in http://trac.webkit.org/changeset/150563