Bug 167220 - Structure::pin() needs to be called while holding a lock
Summary: Structure::pin() needs to be called while holding a lock
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-01-19 16:50 PST by Filip Pizlo
Modified: 2017-01-19 18:40 PST (History)
8 users (show)

See Also:


Attachments
the patch (12.70 KB, patch)
2017-01-19 16:56 PST, Filip Pizlo
saam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2017-01-19 16:50:08 PST
Otherwise the GC could blow away the table as we are pinning it.
Comment 1 Filip Pizlo 2017-01-19 16:56:15 PST
Created attachment 299285 [details]
the patch
Comment 2 Filip Pizlo 2017-01-19 17:00:23 PST
This fixes crashes with this signature:

Termination Signal:    Trace/BPT trap: 5
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010d3b3df5 0x10c970000 + 10763765
1   com.apple.JavaScriptCore      	0x000000010d3b49cb bool JSC::Structure::checkOffsetConsistency<JSC::Structure::materializePropertyTable(JSC::VM&, bool)::$_0>(JSC::PropertyTable*, JSC::Structure::materializePropertyTable(JSC::VM&, bool)::$_0 const&) const::'lambda'(char const*)::operator()(char const*) const + 1179
2   com.apple.JavaScriptCore      	0x000000010d3afa2c JSC::Structure::materializePropertyTable(JSC::VM&, bool) + 1228 (StructureInlines.h:276)
3   com.apple.JavaScriptCore      	0x000000010c97861a int JSC::Structure::add<JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*)::'lambda'(JSC::GCSafeConcurrentJSLocker const&, int, int)>(JSC::VM&, JSC::PropertyName, unsigned int, JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*)::'lambda'(JSC::GCSafeConcurrentJSLocker const&, int, int) const&) + 58 (Structure.h:688)
4   com.apple.JavaScriptCore      	0x000000010cb33d07 JSC::JSObject::putDirectWithoutTransition(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int) + 231 (PropertyOffset.h:108)
5   com.apple.JavaScriptCore      	0x000000010d1133bf JSC::JSGlobalObject::init(JSC::VM&) + 15599 (WriteBarrier.h:108)
6   com.apple.JavaScriptCore      	0x000000010d11a285 JSC::JSGlobalObject::finishCreation(JSC::VM&, JSC::JSObject*) + 149 (WriteBarrierInlines.h:53)
Comment 3 Radar WebKit Bug Importer 2017-01-19 17:05:23 PST
<rdar://problem/30108809>
Comment 4 Filip Pizlo 2017-01-19 18:40:20 PST
Landed in http://trac.webkit.org/changeset/210947