Bug 161893 - ParkingLot is going to have a bad time with threads dying
Summary: ParkingLot is going to have a bad time with threads dying
Alias: None
Product: WebKit
Classification: Unclassified
Component: Web Template Framework (show other bugs)
Version: WebKit Nightly Build
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
Keywords: InRadar
Depends on:
Reported: 2016-09-12 22:12 PDT by Filip Pizlo
Modified: 2016-09-13 12:27 PDT (History)
16 users (show)

See Also:

the patch (3.64 KB, patch)
2016-09-12 22:14 PDT, Filip Pizlo
msaboff: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2016-09-12 22:12:56 PDT
If a thread dies right as it falls out of parkConditionally, then unparkOne() and friends might die because they will dereference a deallocated ThreadData.

The solution is to ref-count ThreadData's.  When unparkOne() and friends want to hold onto a ThreadData past the queue lock, they can +1 the ref count.
Comment 1 Filip Pizlo 2016-09-12 22:14:15 PDT
Created attachment 288674 [details]
the patch
Comment 2 Michael Saboff 2016-09-13 07:31:16 PDT
Comment on attachment 288674 [details]
the patch

Comment 3 Filip Pizlo 2016-09-13 09:01:48 PDT
Landed in https://trac.webkit.org/changeset/205859
Comment 4 David Kilzer (:ddkilzer) 2016-09-13 12:27:02 PDT