Bug 128641 – DelayedReleaseScope in MarkedAllocator::tryAllocateHelper is racy

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Hahnenberg]

It causes the VM to drop the lock in the middle of adding a new block to the allocator, so another thread could come in and add a block before we're done.

[Mark Hahnenberg]

(In reply to comment #0)
> It causes the VM to drop the lock in the middle of adding a new block to the allocator, so another thread could come in and add a block before we're done.

Actually, it was the DelayedReleaseScope in tryAllocateHelper that was wrong.

[Mark Hahnenberg]

Created attachment 223936 [details]
Patch

[Mark Hahnenberg]

Comment on attachment 223936 [details]
Patch

This still has issues.

[Mark Hahnenberg]

Created attachment 223941 [details]
Patch

[Mark Hahnenberg]

Created attachment 223942 [details]
Patch

[Mark Hahnenberg]

Created attachment 223969 [details]
Patch

[Mark Lam]

Comment on attachment 223969 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=223969&action=review

> Source/JavaScriptCore/heap/MarkedAllocator.cpp:109
> +    void* head = tryPopFreeList(bytes);
>      ASSERT(head);

According to tryPopFreeList() below, it can return a 0.  So, is this assertion still valid?

[Mark Hahnenberg]

(In reply to comment #7)
> (From update of attachment 223969 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=223969&action=review
> 
> > Source/JavaScriptCore/heap/MarkedAllocator.cpp:109
> > +    void* head = tryPopFreeList(bytes);
> >      ASSERT(head);
> 
> According to tryPopFreeList() below, it can return a 0.  So, is this assertion still valid?

Yes. We will loop around the while loop until m_freeList.head is not null. If m_freeList.head is not null then tryPopFreeList *must* succeed.

[Oliver Hunt]

Comment on attachment 223969 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=223969&action=review

> Source/JavaScriptCore/heap/MarkedAllocator.cpp:116
> +    ASSERT(m_currentBlock);

RELEASE_ASSERT?

> Source/JavaScriptCore/heap/MarkedAllocator.cpp:127
>      ASSERT(!m_heap->isBusy());

Can we RELEASE_ASSERT here without hurting perf?

[Mark Hahnenberg]

Created attachment 223996 [details]
Patch

[Michael Saboff]

Comment on attachment 223996 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 223996 [details]
Patch

Clearing flags on attachment: 223996

Committed r164009: <http://trac.webkit.org/changeset/164009>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.