Bug 148312 - REGRESSION (r188714): Crash in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net
Summary: REGRESSION (r188714): Crash in JSC::Heap::incrementDeferralDepth() opening We...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Geoffrey Garen
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-21 10:35 PDT by Timothy Hatcher
Modified: 2015-08-21 11:54 PDT (History)
9 users (show)

See Also:


Attachments
Patch (1.38 KB, patch)
2015-08-21 11:32 PDT, Geoffrey Garen
mark.lam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Timothy Hatcher 2015-08-21 10:35:15 PDT
Thread 1 Queue : com.apple.main-thread (serial)
#0	0x000000010284b9cd in JSC::Heap::incrementDeferralDepth() [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/HeapInlines.h:302
#1	0x000000010284b9cd in JSC::DeferGC::DeferGC(JSC::Heap&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/DeferGC.h:41
#2	0x000000010284b9cd in JSC::DeferGC::DeferGC(JSC::Heap&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/DeferGC.h:40
#3	0x000000010284b9cd in JSC::DFG::Worklist::completeAllPlansForVM(JSC::VM&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/dfg/DFGWorklist.cpp:205
#4	0x000000010284cdd8 in JSC::DFG::completeAllPlansForVM(JSC::VM&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/dfg/DFGWorklist.cpp:455
#5	0x0000000102689c6c in JSC::Debugger::recompileAllJSFunctions(JSC::VM*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/debugger/Debugger.cpp:353
#6	0x0000000103b713d2 in WebCore::PageScriptDebugServer::recompileAllJSFunctions() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/PageScriptDebugServer.cpp:91
#7	0x00000001036c4e50 in WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend(Inspector::FrontendChannel*, Inspector::BackendDispatcher*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/InspectorTimelineAgent.cpp:100
#8	0x00000001028fb2e4 in Inspector::AgentRegistry::didCreateFrontendAndBackend(Inspector::FrontendChannel*, Inspector::BackendDispatcher*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/inspector/InspectorAgentRegistry.cpp:55
#9	0x000000010365e623 in WebCore::InspectorController::connectFrontend(Inspector::FrontendChannel*, bool) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/InspectorController.cpp:247
#10	0x0000000101865ae1 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::MessageDecoder&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/MessageReceiverMap.cpp:102
#11	0x0000000101a208b8 in WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::MessageDecoder&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/WebProcess/WebProcess.cpp:618
#12	0x000000010181f8ec in IPC::Connection::dispatchMessage(IPC::MessageDecoder&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:878
#13	0x000000010181f8df in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:901
#14	0x0000000101821fd5 in IPC::Connection::dispatchOneMessage() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:929
#15	0x0000000102c5ff15 in std::__1::function<void ()>::operator()() const [inlined] at /Applications/Xcode.app/Contents/Developer/Toolchains/OSX10.11.xctoolchain/usr/bin/../include/c++/v1/functional:1793
#16	0x0000000102c5ff0b in WTF::RunLoop::performWork() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WTF/wtf/RunLoop.cpp:104
#17	0x0000000102c605f2 in WTF::RunLoop::performWork(void*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WTF/wtf/cf/RunLoopCF.cpp:38
Comment 1 Timothy Hatcher 2015-08-21 10:36:50 PDT
Pretty much any site now crashes when opening the Web Inspector. Only about:blank seems to work.
Comment 2 Timothy Hatcher 2015-08-21 11:24:31 PDT
Looks like r188714 broke this.
Comment 3 Geoffrey Garen 2015-08-21 11:32:08 PDT
Created attachment 259635 [details]
Patch
Comment 4 Mark Lam 2015-08-21 11:32:57 PDT
Comment on attachment 259635 [details]
Patch

r=me
Comment 5 Geoffrey Garen 2015-08-21 11:39:34 PDT
Committed r188762: <http://trac.webkit.org/changeset/188762>
Comment 6 Joseph Pecoraro 2015-08-21 11:47:26 PDT
Comment on attachment 259635 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=259635&action=review

> Source/JavaScriptCore/ChangeLog:3
> +        REGRESSION (r188714): RELEASE_ASSERT in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net

So this wasn't a RELEASE_ASSERT? Maybe we should retitle before landing.