We crash with the following traceback: 0 JavaScriptCore 0x00000001005e1ac8 WTFCrash + 72 1 JavaScriptCore 0x0000000100297a88 JSC::CodeBlock::baselineVersion() + 148 2 JavaScriptCore 0x000000010031d684 JSC::DFG::JITFinalizer::finalizeCommon() + 124 3 JavaScriptCore 0x000000010031d784 JSC::DFG::JITFinalizer::finalizeFunction() + 224 4 JavaScriptCore 0x000000010033fe44 JSC::DFG::Plan::finalizeWithoutNotifyingCallback() + 188 5 JavaScriptCore 0x000000010033ff50 JSC::DFG::Plan::finalizeAndNotifyCallback() + 36 6 JavaScriptCore 0x00000001003ac9e8 JSC::DFG::Worklist::completeAllReadyPlansForVM(JSC::VM&, JSC::DFG::CompilationKey) + 340 7 JavaScriptCore 0x0000000100403358 operationOptimize + 552 8 ??? 0x00000001061c40c4 0 + 4397482180 9 JavaScriptCore 0x00000001004c03dc llint_op_call + 180 10 JavaScriptCore 0x00000001004c0440 llint_op_call + 280 11 JavaScriptCore 0x00000001004c0570 llint_op_construct + 236 12 ??? 0x0000000106144c3c 0 + 4396960828 13 JavaScriptCore 0x00000001004bb238 callToJavaScript + 304 14 JavaScriptCore 0x00000001003ee37c JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 44 15 JavaScriptCore 0x00000001003db6f4 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 2940 16 JavaScriptCore 0x00000001002abd48 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 452 17 WebCore 0x000000010145c224 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 280 18 WebCore 0x000000010145c42c WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 48 19 WebCore 0x00000001014618f4 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 592 20 WebCore 0x00000001014604d0 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 1064 21 WebCore 0x0000000100d74428 WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) + 264 22 WebCore 0x0000000100d742c0 WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) + 60 23 WebCore 0x0000000100d1b164 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 76 24 WebCore 0x0000000100d1b208 WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&) + 104 25 WebCore 0x0000000100d1aef8 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 360 26 WebCore 0x0000000100d1baa0 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() + 104 27 WebCore 0x0000000100d1bcdc non-virtual thunk to WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 96 28 WebCore 0x00000001009becd8 WebCore::CachedResource::checkNotify() + 268 29 WebCore 0x00000001015066b8 WebCore::SubresourceLoader::didFinishLoading(double) + 108 30 CFNetwork 0x00000001866ae168 ___ZN27URLConnectionClient_Classic26_delegate_didFinishLoadingEU13block_pointerFvvE_block_invoke + 100 31 CFNetwork 0x0000000186767298 ___ZN27URLConnectionClient_Classic18_withDelegateAsyncEPKcU13block_pointerFvP16_CFURLConnectionPK33CFURLConnectionClientCurrent_VMaxE_block_invoke_2 + 92 32 CoreFoundation 0x0000000186bac000 CFArrayApplyFunction + 64 33 CFNetwork 0x000000018669be0c RunloopBlockContext::perform() + 132 34 CFNetwork 0x000000018669bcc0 MultiplexerSource::perform() + 308 35 CFNetwork 0x000000018669bae4 MultiplexerSource::_perform(void*) + 56 36 CoreFoundation 0x0000000186c80d34 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 20 37 CoreFoundation 0x0000000186c80050 __CFRunLoopDoSources0 + 240 38 CoreFoundation 0x0000000186c7e2c4 __CFRunLoopRun + 696 39 CoreFoundation 0x0000000186bac61c CFRunLoopRunSpecific + 384 40 WebCore 0x00000001015c38c8 RunWebThread(void*) + 468 41 libsystem_pthread.dylib 0x0000000195ea4000 _pthread_body + 160 42 libsystem_pthread.dylib 0x0000000195ea3f5c _pthread_start + 136 43 libsystem_pthread.dylib 0x0000000195ea1430 thread_start + 0
Created attachment 230856 [details] Patch
Committed r168319: <http://trac.webkit.org/changeset/168319>
Comment on attachment 230856 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review > Source/JavaScriptCore/ChangeLog:11 > + (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we > + started compiling for is still the same at the end of compilation. > + Also did some minor restructuring. Why might they be different? Please explain. Please add a regression test.
(In reply to comment #3) > (From update of attachment 230856 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review > > > Source/JavaScriptCore/ChangeLog:11 > > + (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we > > + started compiling for is still the same at the end of compilation. > > + Also did some minor restructuring. > > Why might they be different? Please explain. Because we cleared the code blocks of the executable during GC. > Please add a regression test. Given that the issue is the result of a GC while we have compilation(s) queued up or needing finalization, I think it would difficult to write a deterministic test.
(In reply to comment #3) > (From update of attachment 230856 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=230856&action=review > > > Source/JavaScriptCore/ChangeLog:11 > > + (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we > > + started compiling for is still the same at the end of compilation. > > + Also did some minor restructuring. > > Why might they be different? Please explain. > > Please add a regression test. New test tracked in https://bugs.webkit.org/show_bug.cgi?id=132632 and landed in change set r168396: <http://trac.webkit.org/changeset/168396>.
<rdar://problem/15961859>