Bug 144378 – LazyNeverDestroyed is not thread safe in debug builds, causing assertions

• Status: RESOLVED
• Resolution: FIXED
• Component: Web Template Framework

[Alexey Proskuryakov]

Thread 28 Crashed:: WebCore: Worker
0   com.apple.JavaScriptCore      	0x00000001128509da WTFCrash + 42 (Assertions.cpp:321)

ASSERT(m_isConstructed);

1   com.apple.JavaScriptCore      	0x0000000112862ed2 WTF::LazyNeverDestroyed<std::__1::mutex>::asPtr() + 66 (NeverDestroyed.h:102)
2   com.apple.JavaScriptCore      	0x0000000112862e85 WTF::LazyNeverDestroyed<std::__1::mutex>::operator std::__1::mutex&() + 21 (NeverDestroyed.h:94)
3   com.apple.JavaScriptCore      	0x0000000112862161 WTF::cachedCollatorMutex() + 577 (CollatorICU.cpp:62)
4   com.apple.JavaScriptCore      	0x0000000112861c8b WTF::Collator::Collator(char const*, bool) + 43 (CollatorICU.cpp:120)
5   com.apple.JavaScriptCore      	0x0000000112861c4c WTF::Collator::Collator(char const*, bool) + 44 (CollatorICU.cpp:146)
6   com.apple.JavaScriptCore      	0x0000000112788a4b JSC::stringProtoFuncLocaleCompare(JSC::ExecState*) + 155 (StringPrototype.cpp:1429)

LazyNeverDestroyed has a non-trivial constructor in debug builds, which is obviously wrong to have for the pattern we normally use it with.

static std::mutex& cachedCollatorMutex()
{
    static std::once_flag onceFlag;

    static LazyNeverDestroyed<std::mutex> mutex;
    std::call_once(onceFlag, []{
        mutex.construct();
    });

    return mutex;
}

[Zan Dobersek]

Removing the brace initializer for the m_isConstructed member will make it trivial again.

[Alexey Proskuryakov]

Yes, this class is only used for static variables. I don't know of a way to assert that though.

[Alexey Proskuryakov]

Created attachment 251979 [details]
proposed fix

[WebKit Commit Bot]

Comment on attachment 251979 [details]
proposed fix

Clearing flags on attachment: 251979

Committed r183608: <http://trac.webkit.org/changeset/183608>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.