Bug 164433 - REGRESSION: Crashes in StringImpl destructor during GC when clearing the HasOwnPropertyCache
Summary: REGRESSION: Crashes in StringImpl destructor during GC when clearing the HasO...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P1 Normal
Assignee: Saam Barati
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2016-11-04 14:30 PDT by Jim Oase
Modified: 2016-11-08 18:53 PST (History)
16 users (show)

See Also:

Attachments
Crash log (87.54 KB, text/plain)
2016-11-04 15:54 PDT, Jim Oase 		no flags Details
patch (1.82 KB, patch)
2016-11-07 15:24 PST, Saam Barati 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jim Oase 2016-11-04 14:30:02 PDT 
Every load results in a error message.  The reload appears to work.  http://www.video.theblaze.com/video/e187-274027 is the last site to fail
Comment 1 Jim Oase 2016-11-04 15:54:48 PDT 
Created attachment 293945 [details]
Crash log
Comment 2 Alexey Proskuryakov 2016-11-05 10:01:02 PDT 
I couldn't reproduce this.
Comment 4 Alexey Proskuryakov 2016-11-05 15:22:12 PDT 
First occurrence that I see was on 2016-11-02 16:21:01.

Filip, could this be caused by threaded GC (r208306)?
Comment 5 Filip Pizlo 2016-11-05 15:30:00 PDT 
(In reply to comment #4)
> First occurrence that I see was on 2016-11-02 16:21:01.
> 
> Filip, could this be caused by threaded GC (r208306)?

Yup, that's the patch at fault.  Should be really easy to fix.  Basically, we just need to move anything in the GC that touches strings off the GC thread.  It's usually easy to do this.  Here we see the collector calling some HasOwnPropertyCache thing, which it shouldn't be doing.
Comment 6 Saam Barati 2016-11-07 15:08:34 PST 
This looks like the HasOwnPropertyCache at work. It derefs StringImpls from the collector thread.
Comment 7 Saam Barati 2016-11-07 15:24:56 PST 
Created attachment 294094 [details]
patch
Comment 8 Mark Lam 2016-11-07 15:27:58 PST 
Comment on attachment 294094 [details]
patch

r=me
Comment 9 Saam Barati 2016-11-07 16:49:42 PST 
<rdar://problem/29079741>
Comment 10 Ryosuke Niwa 2016-11-08 18:52:38 PST 
Landing this patch as a test as a pre-reopening test.
Comment 11 Ryosuke Niwa 2016-11-08 18:53:08 PST 
Comment on attachment 294094 [details]
patch

Clearing flags on attachment: 294094

Committed r208426: <http://trac.webkit.org/changeset/208426>
Comment 12 Ryosuke Niwa 2016-11-08 18:53:14 PST 
All reviewed patches have been landed.  Closing bug.