Bug 119108 – ASSERT(m_vm->apiLock().currentThreadIsHoldingLock()); fails for Safari on current ToT

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

Here's the back trace:

(gdb) bt
#0  WTFCrash () at /Volumes/Data/ws6/OpenSource/Source/WTF/wtf/Assertions.cpp:339
#1  0x000000010732e094 in JSC::Heap::protect (this=0x7f827a04a418, k={u = {asInt64 = 4627690608, ptr = 0x113d4f470, asBits = {payload = 332723312, tag = 1}}}) at /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/heap/Heap.cpp:337
#2  0x00000001073bf333 in JSC::gcProtect (val=0x113d4f470) at Protect.h:32
#3  0x00000001073be9b9 in JSGlobalContextRetain (ctx=0x113d4f4e0) at /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/API/JSContextRef.cpp:158
#4  0x00000001109d8822 in WBSJSController::setContext (this=0x7f827b860690, context=0x113d4f4e0) at /Volumes/Data/ws6/Internal/SafariShared/WBSJSController.mm:107
#5  0x00000001109d8c50 in WBSJSController::scriptObjectReady (this=0x7f827b860690, ctx=0x113d4f4e0) at /Volumes/Data/ws6/Internal/SafariShared/WBSJSController.mm:64
…

The rest of the stack trace shows this initiated from Reader.  I saw this assertion failure crash by launching a debug build of ToT (r153339) with the Safari set to load "http://www.zazzle.com/vintage_zebra_blue_mojo_pillow-189636972500458458" on launch.

Per our conversation, it looks like the assertion is failing because of the recent added code to check for "vm.exclusiveThread".  gdb confirms that this code was active in this case.  Here are the gdb details:

(gdb) frame 3      
#3  0x00000001073be9b9 in JSGlobalContextRetain (ctx=0x113d4f4e0) at /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/API/JSContextRef.cpp:158
158	    gcProtect(exec->dynamicGlobalObject());
(gdb) list
153	{
154	    ExecState* exec = toJS(ctx);
155	    APIEntryShim entryShim(exec);
156	
157	    VM& vm = exec->vm();
158	    gcProtect(exec->dynamicGlobalObject());
159	    vm.ref();
160	    return ctx;
161	}
162	
(gdb) p vm.exclusiveThread
$1 = 1
 
Based on the APIEntryShim code, this means that it does not acquire the VM lock on allocation of the shim.

[Sergio Correia (qrwteyrutiyoup)]

Not sure it's related, but I get a similar ASSERT [vm()->apiLock().currentThreadIsHoldingLock()] on an EFL build, right after starting MiniBrowser - trying to load google.com. The assert it's hitting is in Heap::collect() [Source/JavaScriptCore/heap/Heap.cpp(714)].

[Mark Hahnenberg]

Change that triggered this: http://trac.webkit.org/changeset/153331

[Anders Carlsson]

Created attachment 207496 [details]
Patch

[Mark Hahnenberg]

Comment on attachment 207496 [details]
Patch

r=me

[Anders Carlsson]

Committed r153357: <http://trac.webkit.org/changeset/153357>