Bug 148312 – REGRESSION (r188714): Crash in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Timothy Hatcher]

Thread 1 Queue : com.apple.main-thread (serial)
#0	0x000000010284b9cd in JSC::Heap::incrementDeferralDepth() [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/HeapInlines.h:302
#1	0x000000010284b9cd in JSC::DeferGC::DeferGC(JSC::Heap&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/DeferGC.h:41
#2	0x000000010284b9cd in JSC::DeferGC::DeferGC(JSC::Heap&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/heap/DeferGC.h:40
#3	0x000000010284b9cd in JSC::DFG::Worklist::completeAllPlansForVM(JSC::VM&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/dfg/DFGWorklist.cpp:205
#4	0x000000010284cdd8 in JSC::DFG::completeAllPlansForVM(JSC::VM&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/dfg/DFGWorklist.cpp:455
#5	0x0000000102689c6c in JSC::Debugger::recompileAllJSFunctions(JSC::VM*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/debugger/Debugger.cpp:353
#6	0x0000000103b713d2 in WebCore::PageScriptDebugServer::recompileAllJSFunctions() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/PageScriptDebugServer.cpp:91
#7	0x00000001036c4e50 in WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend(Inspector::FrontendChannel*, Inspector::BackendDispatcher*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/InspectorTimelineAgent.cpp:100
#8	0x00000001028fb2e4 in Inspector::AgentRegistry::didCreateFrontendAndBackend(Inspector::FrontendChannel*, Inspector::BackendDispatcher*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/JavaScriptCore/inspector/InspectorAgentRegistry.cpp:55
#9	0x000000010365e623 in WebCore::InspectorController::connectFrontend(Inspector::FrontendChannel*, bool) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebCore/inspector/InspectorController.cpp:247
#10	0x0000000101865ae1 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::MessageDecoder&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/MessageReceiverMap.cpp:102
#11	0x0000000101a208b8 in WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::MessageDecoder&) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/WebProcess/WebProcess.cpp:618
#12	0x000000010181f8ec in IPC::Connection::dispatchMessage(IPC::MessageDecoder&) [inlined] at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:878
#13	0x000000010181f8df in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:901
#14	0x0000000101821fd5 in IPC::Connection::dispatchOneMessage() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WebKit2/Platform/IPC/Connection.cpp:929
#15	0x0000000102c5ff15 in std::__1::function<void ()>::operator()() const [inlined] at /Applications/Xcode.app/Contents/Developer/Toolchains/OSX10.11.xctoolchain/usr/bin/../include/c++/v1/functional:1793
#16	0x0000000102c5ff0b in WTF::RunLoop::performWork() at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WTF/wtf/RunLoop.cpp:104
#17	0x0000000102c605f2 in WTF::RunLoop::performWork(void*) at /Users/Timothy/Work/Safari-TOT.git/OpenSource/Source/WTF/wtf/cf/RunLoopCF.cpp:38

[Timothy Hatcher]

Pretty much any site now crashes when opening the Web Inspector. Only about:blank seems to work.

[Timothy Hatcher]

Looks like r188714 broke this.

[Geoffrey Garen]

Created attachment 259635 [details]
Patch

[Mark Lam]

Comment on attachment 259635 [details]
Patch

r=me

[Geoffrey Garen]

Committed r188762: <http://trac.webkit.org/changeset/188762>

[Joseph Pecoraro]

Comment on attachment 259635 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=259635&action=review

> Source/JavaScriptCore/ChangeLog:3
> +        REGRESSION (r188714): RELEASE_ASSERT in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net

So this wasn't a RELEASE_ASSERT? Maybe we should retitle before landing.