Bug 201908 - [JSC] Make IsoSubspace scalable
Summary: [JSC] Make IsoSubspace scalable
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yusuke Suzuki
URL:
Keywords: InRadar
Depends on:
Blocks: 204124
  Show dependency treegraph
 
Reported: 2019-09-18 00:50 PDT by Yusuke Suzuki
Modified: 2019-11-12 16:23 PST (History)
9 users (show)

See Also:


Attachments
Patch (14.17 KB, patch)
2019-09-23 16:00 PDT, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (10.28 KB, patch)
2019-10-28 18:56 PDT, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (14.95 KB, patch)
2019-11-01 11:29 PDT, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (32.76 KB, patch)
2019-11-06 19:04 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (34.88 KB, patch)
2019-11-06 19:17 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (33.19 KB, patch)
2019-11-06 21:11 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (34.29 KB, patch)
2019-11-06 22:05 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (33.91 KB, patch)
2019-11-06 23:15 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (47.78 KB, patch)
2019-11-07 15:34 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (51.52 KB, patch)
2019-11-07 16:21 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews210 for win-future (13.57 MB, application/zip)
2019-11-08 14:34 PST, Build Bot
no flags Details
Patch (13.19 KB, patch)
2019-11-11 13:37 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (13.19 KB, patch)
2019-11-11 13:42 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (14.18 KB, patch)
2019-11-11 13:44 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (14.41 KB, patch)
2019-11-11 13:48 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (14.59 KB, patch)
2019-11-11 13:51 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yusuke Suzuki 2019-09-18 00:50:46 PDT
Make it scalable for various objects so that we can start applying IsoSubspace to many JS objects as much as possible.
This change will introduce shared tier optimization done in bmalloc IsoHeap.
Comment 1 Yusuke Suzuki 2019-09-18 00:51:20 PDT
Final goal of this way is making all objects in IsoSubspace in JSC.
Comment 2 Radar WebKit Bug Importer 2019-09-18 00:51:52 PDT
<rdar://problem/55469823>
Comment 3 Yusuke Suzuki 2019-09-23 16:00:29 PDT
Created attachment 379401 [details]
Patch
Comment 4 Yusuke Suzuki 2019-09-23 17:32:09 PDT
Plan:

- Sharing one Iso MarkedBlock for multiple IsoSubspaces if the CellKind is the same to allow sweep from MarkedBlock
- Mark bits in MarkedBlock is used
- Never becomes empty state
Comment 5 Yusuke Suzuki 2019-09-24 13:11:31 PDT
(In reply to Yusuke Suzuki from comment #4)
> Plan:
> 
> - Sharing one Iso MarkedBlock for multiple IsoSubspaces if the CellKind is
> the same to allow sweep from MarkedBlock
> - Mark bits in MarkedBlock is used
> - Never becomes empty state

While Block can destroy objects, we do not have a way to chain free-cells to each IsoSubspace after that. So we should have some ideas.
One idea is that,

1. While sweeping WeakSet is done per MarkBlock,
2. Sweeping objects and chain them to IsoSubspace is done per BlockDirectory.
Comment 6 Yusuke Suzuki 2019-09-24 15:01:37 PDT
Discussed with Saam and Phil, we should use LargeAllocation for this purpose.
Comment 7 Yusuke Suzuki 2019-10-28 18:39:56 PDT
(In reply to Yusuke Suzuki from comment #6)
> Discussed with Saam and Phil, we should use LargeAllocation for this purpose.

Landed JSGlobalObject* change, starting making this patch.
Comment 8 Yusuke Suzuki 2019-10-28 18:56:13 PDT
Created attachment 382147 [details]
Patch
Comment 9 Yusuke Suzuki 2019-11-01 11:29:25 PDT
Created attachment 382602 [details]
Patch
Comment 10 Yusuke Suzuki 2019-11-06 19:04:33 PST
Created attachment 383006 [details]
Patch
Comment 11 Yusuke Suzuki 2019-11-06 19:17:10 PST
Created attachment 383008 [details]
Patch
Comment 12 Yusuke Suzuki 2019-11-06 21:11:19 PST
Created attachment 383021 [details]
Patch
Comment 13 Yusuke Suzuki 2019-11-06 22:05:05 PST
Created attachment 383024 [details]
Patch
Comment 14 Yusuke Suzuki 2019-11-06 23:15:04 PST
Created attachment 383025 [details]
Patch
Comment 15 Build Bot 2019-11-07 01:40:51 PST
Comment on attachment 383025 [details]
Patch

Attachment 383025 [details] did not pass jsc-ews (mac):
Output: https://webkit-queues.webkit.org/results/13221838

New failing tests:
stress/sampling-profiler-wasm.js.default
Comment 16 Yusuke Suzuki 2019-11-07 15:34:57 PST
Created attachment 383083 [details]
Patch
Comment 17 Yusuke Suzuki 2019-11-07 16:21:49 PST
Created attachment 383088 [details]
Patch
Comment 18 Yusuke Suzuki 2019-11-07 16:24:46 PST
Comment on attachment 383088 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=383088&action=review

> Source/JavaScriptCore/ChangeLog:31
> +        We also make sizeof(LargeAllocation) small since it is now used for non-large allocations.

The name `LargeAllocation` is a bit weird, but anyway, in this patch, I don't change it.
Comment 19 Yusuke Suzuki 2019-11-07 16:26:17 PST
Comment on attachment 383088 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=383088&action=review

> Source/JavaScriptCore/heap/LocalAllocator.cpp:140
> +    if (void* result = m_directory->tryAllocateFromLowerTier())
>          return result;

It would be possible that we could introduce some heuristics like, "If several MarkedBlock are allocated to this type, we think this is frequently allocated and avoid using lower-tier cels".
For now, we are just using it since I don't see regression.
Comment 20 Yusuke Suzuki 2019-11-07 16:35:54 PST
Comment on attachment 383088 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=383088&action=review

> Source/JavaScriptCore/heap/MarkedSpace.cpp:218
> +    });

Note that, this forEach works well even if `allocation->destroy()` removes itself from this m_sweptLowerTierCells.forEach list.
Comment 21 Keith Miller 2019-11-07 18:13:28 PST
Comment on attachment 383088 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=383088&action=review

r=me with comments.

> Source/JavaScriptCore/ChangeLog:13
> +        We use LargeAllocation for this lower-tier objects. Each IsoSubspace holds up to 8 lower-tier objects

nit: this => these

> Source/JavaScriptCore/ChangeLog:15
> +        allocated via LargeAllocation. And use it when MarkedBlock of IsoSubspace exhausts (like, zero MarekdBlock
> +        here). And once this LargeAllocation is allocated to a certain type, we do not deallocate it until VM

Can you clarify this slightly. I think you are saying something like:

 The allocation order for any given cell type is:
try to allocate in an existing MarkedBlock (there won't be one to start).
try to allocate in an existing LargeAllocation.
allocate a new MarkedBlock and/or GC.

> Source/JavaScriptCore/ChangeLog:26
> +        that is pointing at the middle of the JSCell in sampling profiler, just registering cell address is enough. And we
> +        maintain this hash-set only when sampling profiler is enabled to save memory in major cases.

Did you benchmark how much this impacts the sampling profiler's regression on the rest of the system?

>> Source/JavaScriptCore/ChangeLog:31
>> +        We also make sizeof(LargeAllocation) small since it is now used for non-large allocations.
> 
> The name `LargeAllocation` is a bit weird, but anyway, in this patch, I don't change it.

Can you do a follow up patch to rename `LargeAllocation` to `CustomAllocation` or something?

> Source/JavaScriptCore/heap/HeapUtil.h:165
> +    // It does not find the cell if the pointer is pointing at the middle of a JSCell.

Nit: It does => This does.

> Source/JavaScriptCore/heap/IsoSubspace.cpp:123
> +    m_lowerTierFreeList.append(largeAllocation);
> +    m_space.m_sweptLowerTierCells.append(largeAllocation);

Can a largeAllocation ever be on the m_sweptLowerTierCells list but not in the m_lowerTierFreeList? If not, why have the m_lowerTierFreeList at all? Why not just take objects from m_sweptLowerTierCells? As far as I can tell they seem like they contain the same information.

> Source/JavaScriptCore/heap/LargeAllocation.cpp:163
> +LargeAllocation* LargeAllocation::reuseForLowerTier()
> +{
> +    Heap& heap = *this->heap();
> +    size_t size = m_cellSize;
> +    Subspace* subspace = m_subspace;
> +    bool adjustedAlignment = m_adjustedAlignment;
> +    uint8_t lowerTierIndex = m_lowerTierIndex;
> +
> +    void* space = this->basePointer();
> +    this->~LargeAllocation();
> +
> +    LargeAllocation* largeAllocation = new (NotNull, space) LargeAllocation(heap, size, subspace, 0, adjustedAlignment);
> +    largeAllocation->m_lowerTierIndex = lowerTierIndex;
> +    largeAllocation->m_hasValidCell = false;
> +    return largeAllocation;
> +}

Does this do anything? You only call this from sweepLowerTierCell() but that's only called if the cell is already lower tier?
Comment 22 Build Bot 2019-11-07 19:14:40 PST
Comment on attachment 383088 [details]
Patch

Attachment 383088 [details] did not pass jsc-ews (mac):
Output: https://webkit-queues.webkit.org/results/13224718

New failing tests:
stress/llint-put-to-scope-global-cache-watchpoint-invalidate.js.dfg-eager
Comment 23 Build Bot 2019-11-08 14:34:44 PST
Comment on attachment 383088 [details]
Patch

Attachment 383088 [details] did not pass win-ews (win):
Output: https://webkit-queues.webkit.org/results/13227668

Number of test failures exceeded the failure limit.
Comment 24 Build Bot 2019-11-08 14:34:46 PST
Created attachment 383166 [details]
Archive of layout-test-results from ews210 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews210  Port: win-future  Platform: CYGWIN_NT-10.0-17763-3.0.5-338.x86_64-x86_64-64bit
Comment 25 Yusuke Suzuki 2019-11-08 17:33:51 PST
Comment on attachment 383088 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=383088&action=review

Thanks!

>> Source/JavaScriptCore/ChangeLog:13
>> +        We use LargeAllocation for this lower-tier objects. Each IsoSubspace holds up to 8 lower-tier objects
> 
> nit: this => these

Fixed.

>> Source/JavaScriptCore/ChangeLog:15
>> +        here). And once this LargeAllocation is allocated to a certain type, we do not deallocate it until VM
> 
> Can you clarify this slightly. I think you are saying something like:
> 
>  The allocation order for any given cell type is:
> try to allocate in an existing MarkedBlock (there won't be one to start).
> try to allocate in an existing LargeAllocation.
> allocate a new MarkedBlock and/or GC.

Fixed.

>> Source/JavaScriptCore/ChangeLog:26
>> +        maintain this hash-set only when sampling profiler is enabled to save memory in major cases.
> 
> Did you benchmark how much this impacts the sampling profiler's regression on the rest of the system?

This only happens when the sampling-profiler is enabled (so, in usual web-browsing, this does not happen). And I don't have any data about the score of sampling-profiler enabled/disabled.
And I quickly run JetStream2 w/ old and new builds while enabling sampling-profiler and it is neutral. Maybe because lower-tier cells are by definition limited.

>>> Source/JavaScriptCore/ChangeLog:31
>>> +        We also make sizeof(LargeAllocation) small since it is now used for non-large allocations.
>> 
>> The name `LargeAllocation` is a bit weird, but anyway, in this patch, I don't change it.
> 
> Can you do a follow up patch to rename `LargeAllocation` to `CustomAllocation` or something?

Will change it to PreciseAllocation.

>> Source/JavaScriptCore/heap/HeapUtil.h:165
>> +    // It does not find the cell if the pointer is pointing at the middle of a JSCell.
> 
> Nit: It does => This does.

Fixed.

>> Source/JavaScriptCore/heap/IsoSubspace.cpp:123
>> +    m_space.m_sweptLowerTierCells.append(largeAllocation);
> 
> Can a largeAllocation ever be on the m_sweptLowerTierCells list but not in the m_lowerTierFreeList? If not, why have the m_lowerTierFreeList at all? Why not just take objects from m_sweptLowerTierCells? As far as I can tell they seem like they contain the same information.

I intentionally did not do that because I do not want to iterate all Subspaces when destroying VM due to performance. But maybe, it does not matter much. Just iterating Subspace for now.

>> Source/JavaScriptCore/heap/LargeAllocation.cpp:163
>> +}
> 
> Does this do anything? You only call this from sweepLowerTierCell() but that's only called if the cell is already lower tier?

It destroying previous LargeAllocation and reconstructing it, LargeAllocation includes WeakSet etc.
I think destroying the previous one here is better since we do not need to rely on the destructor's behavior of LargeAllocation if we destroy it here anyway.
Comment 26 Yusuke Suzuki 2019-11-08 17:38:02 PST
Committed r252298: <https://trac.webkit.org/changeset/252298>
Comment 27 Truitt Savell 2019-11-11 10:08:03 PST
It looks like the changes in https://trac.webkit.org/changeset/252298/webkit

has caused windows testing to exit early with crashes.

Build: https://build.webkit.org/builders/Apple%20Win%2010%20Release%20%28Tests%29/builds/3907

can this be looked at soon?
Comment 28 Truitt Savell 2019-11-11 11:21:13 PST
Results page with crash log links:
https://build.webkit.org/results/Apple%20Win%2010%20Release%20(Tests)/r252302%20(3907)/results.html
Comment 29 Truitt Savell 2019-11-11 11:31:03 PST
Pulled this from the bot:

SIGTERM signal receivedTraceback(most recent call last):
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py", line 459, in <module>
    sys.exit(main(sys.argv[1:], sys.stdout, sys.stderr))
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py", line 91, in main
    run_details = run(port, options, args, stderr)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py", line 452, in run
    run_details = manager.run(args)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py", line 275, in run
    temp_initial_results, temp_retry_results, temp_enabled_pixel_tests_in_retry = self._run_test_subset(tests_to_run_by_device[device_type], tests_to_skip, device_type=device_type)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py", line 339, in _run_test_subset
    initial_results = self._run_tests(tests_to_run, tests_to_skip, self._options.repeat_each, self._options.iterations, int(self._options.child_processes), retrying=False, device_type=device_type)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py", line 400, in _run_tests
    return self._runner.run_tests(self._expectations[device_type], test_inputs, tests_to_skip, num_workers, retrying)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py", line 126, in run_tests
    pool.run(('test_list', shard.name, shard.test_inputs) for shard in all_shards)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/common/message_pool.py", line 100, in run
    self.wait()
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/common/message_pool.py", line 130, in wait
    self._start_workers()
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/common/message_pool.py", line 112, in _start_workers
    worker.start()
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/common/message_pool.py", line 250, in start
    super(_Worker, self).start()
  File "/usr/lib/python2.7/multiprocessing/process.py", line 130, in start
    self._popen = Popen(self)
  File "/usr/lib/python2.7/multiprocessing/forking.py", line 126, in __init__
    code = process_obj._bootstrap()
  File "/usr/lib/python2.7/multiprocessing/process.py", line 267, in _bootstrap
    self.run()
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/common/message_pool.py", line 268, in run
    worker.handle(message.name, message.src, *message.args)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py", line 290, in handle
    self._run_test(test_input, test_list_name)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py", line 316, in _run_test
    result = self._run_test_with_or_without_timeout(test_input, test_timeout_sec, stop_when_done)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py", line 382, in _run_test_with_or_without_timeout
    return self._run_test_in_this_thread(test_input, stop_when_done)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py", line 468, in _run_test_in_this_thread
    return self._run_single_test(self._driver, test_input, stop_when_done)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py", line 472, in _run_single_test
    self._name, driver, test_input, stop_when_done)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py", line 46, in run_single_test
    return runner.run()
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py", line 105, in run
    return self._run_compare_test()
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py", line 108, in _run_compare_test
    driver_output = self._driver.run_test(self._driver_input(), self._stop_when_done)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/port/driver.py", line 793, in run_test
    return self._driver.run_test(driver_input, stop_when_done)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/port/driver.py", line 239, in run_test
    self.error_from_test, crash_log = self._get_crash_log(text, self.error_from_test, newer_than=start_time)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/port/driver.py", line 308, in _get_crash_log
    return self._port._get_crash_log(self._crashed_process_name, self._crashed_pid, stdout, stderr, newer_than, target_host=self._target_host)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/port/win.py", line 411, in _get_crash_log
    crash_log = crash_logs.find_newest_log(name, pid, include_errors=True, newer_than=newer_than)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/common/system/crashlogs.py", line 56, in find_newest_log
    return self._find_newest_log_win(process_name, pid, include_errors, newer_than)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/common/system/crashlogs.py", line 109, in _find_newest_log_win
    logs = self._host.filesystem.files_under(self._crash_log_directory, file_filter=is_crash_log)
  File "/home/buildbot/worker/win10-release-tests/build/Tools/Scripts/webkitpy/common/system/filesystem.py", line 133, in files_under
    for (dirpath, dirnames, filenames) in os.walk(path):
  File "/usr/lib/python2.7/os.py", line 296, in walk
    for x in walk(new_path, topdown, onerror, followlinks):
  File "/usr/lib/python2.7/os.py", line 296, in walk
    for x in walk(new_path, topdown, onerror, followlinks):
  File "/usr/lib/python2.7/os.py", line 278, in walk
    names = listdir(top)
Comment 30 Per Arne Vollan 2019-11-11 11:57:11 PST
>	[Inline Frame] JavaScriptCore.dll!JSC::AtomIndices::{ctor}(JSC::HeapCell *) Line 37	C++
 	[Inline Frame] JavaScriptCore.dll!JSC::IsoCellSet::add(JSC::HeapCell *) Line 38	C++
 	JavaScriptCore.dll!JSC::ScriptExecutable::installCode(JSC::VM & vm, JSC::CodeBlock * genericCodeBlock, JSC::CodeType codeType, JSC::CodeSpecializationKind kind) Line 191	C++
 	JavaScriptCore.dll!JSC::ScriptExecutable::prepareForExecutionImpl(JSC::VM & vm, JSC::JSFunction * function, JSC::JSScope * scope, JSC::CodeSpecializationKind kind, JSC::CodeBlock * & resultCodeBlock) Line 435	C++
 	[Inline Frame] JavaScriptCore.dll!JSC::ScriptExecutable::prepareForExecution(JSC::VM &) Line 1051	C++
 	JavaScriptCore.dll!JSC::Interpreter::executeProgram(const JSC::SourceCode & source, JSC::JSGlobalObject * __formal, JSC::JSObject * thisObj) Line 825	C++
 	JavaScriptCore.dll!JSC::evaluate(JSC::JSGlobalObject * globalObject, const JSC::SourceCode & source, JSC::JSValue thisValue, WTF::NakedPtr<JSC::Exception> & returnedException) Line 148	C++
 	JavaScriptCore.dll!JSC::profiledEvaluate(JSC::JSGlobalObject * globalObject, JSC::ProfilingReason reason, const JSC::SourceCode & source, JSC::JSValue thisValue, WTF::NakedPtr<JSC::Exception> & returnedException) Line 161	C++
 	[Inline Frame] WebKit.dll!WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject *) Line 79	C++
 	WebKit.dll!WebCore::ScriptController::evaluateInWorld(const WebCore::ScriptSourceCode & sourceCode, WebCore::DOMWrapperWorld & world, WebCore::ExceptionDetails * exceptionDetails) Line 134	C++
 	WebKit.dll!WebCore::ScriptController::evaluate(const WebCore::ScriptSourceCode & sourceCode, WebCore::ExceptionDetails * exceptionDetails) Line 150	C++
 	WebKit.dll!WebCore::ScriptElement::executeClassicScript(const WebCore::ScriptSourceCode & sourceCode) Line 391	C++
 	WebKit.dll!WebCore::LoadableClassicScript::execute(WebCore::ScriptElement & scriptElement) Line 123	C++
 	[Inline Frame] WebKit.dll!WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript &) Line 429	C++
 	WebKit.dll!WebCore::ScriptElement::executePendingScript(WebCore::PendingScript & pendingScript) Line 437	C++
 	[Inline Frame] WebKit.dll!WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript &) Line 114	C++
 	WebKit.dll!WebCore::HTMLScriptRunner::executeParsingBlockingScripts() Line 164	C++
 	WebKit.dll!WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement,WTF::DumbPtrTraits<WebCore::ScriptElement>> && element, const WTF::TextPosition & scriptStartPosition) Line 150	C++
 	WebKit.dll!WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() Line 234	C++
 	WebKit.dll!WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode mode, bool parsingFragment, WebCore::PumpSession & session) Line 255	C++
 	WebKit.dll!WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode mode) Line 309	C++
 	[Inline Frame] WebKit.dll!WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) Line 186	C++
 	WebKit.dll!WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl,WTF::DumbPtrTraits<WTF::StringImpl>> && inputSource) Line 419	C++
 	WebKit.dll!WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter & writer, const char * data, unsigned int length) Line 50	C++
 	WebKit.dll!WebCore::DocumentWriter::addData(const char * bytes, unsigned int length) Line 258	C++
 	WebKit.dll!WebCore::DocumentLoader::commitData(const char * bytes, unsigned int length) Line 1125	C++
 	WebKit.dll!WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader * loader, const char * data, int length) Line 689	C++
 	WebKit.dll!WebCore::DocumentLoader::commitLoad(const char * data, int length) Line 1013	C++
 	WebKit.dll!WebCore::DocumentLoader::dataReceived(const char * data, int length) Line 1158	C++
 	WebKit.dll!WebCore::DocumentLoader::dataReceived(WebCore::CachedResource & resource, const char * data, int length) Line 1131	C++
 	WebKit.dll!WebCore::CachedRawResource::notifyClientsDataWasReceived(const char * data, unsigned int length) Line 135	C++
 	WebKit.dll!WebCore::CachedRawResource::updateBuffer(WebCore::SharedBuffer & data) Line 74	C++
 	WebKit.dll!WebCore::SubresourceLoader::didReceiveDataOrBuffer(const char * data, int length, WTF::RefPtr<WebCore::SharedBuffer,WTF::DumbPtrTraits<WebCore::SharedBuffer>> && buffer, __int64 encodedDataLength, WebCore::DataPayloadType dataPayloadType) Line 505	C++
 	WebKit.dll!WebCore::SubresourceLoader::didReceiveBuffer(WTF::Ref<WebCore::SharedBuffer,WTF::DumbPtrTraits<WebCore::SharedBuffer>> && buffer, __int64 encodedDataLength, WebCore::DataPayloadType dataPayloadType) Line 485	C++
 	WebKit.dll!WebCore::ResourceLoader::didReceiveBuffer(WebCore::ResourceHandle * __formal, WTF::Ref<WebCore::SharedBuffer,WTF::DumbPtrTraits<WebCore::SharedBuffer>> && buffer, int encodedDataLength) Line 694	C++
 	[Inline Frame] WebKit.dll!WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveData::__l2::<lambda_5f349daa7f72b184051aee54a6289cd4>::operator()() Line 225	C++
 	WebKit.dll!WTF::Detail::CallableWrapper<<lambda_5f349daa7f72b184051aee54a6289cd4>,void>::call() Line 52	C++
 	[Inline Frame] WTF.dll!WTF::Function<void __cdecl(void)>::operator()() Line 79	C++
 	WTF.dll!WTF::dispatchFunctionsFromMainThread() Line 97	C++
 	WTF.dll!WTF::ThreadingWindowWndProc(HWND__ * hWnd, unsigned int message, unsigned int wParam, long lParam) Line 51	C++
 	[External Code]	
 	user32.dll![Frames below may be incorrect and/or missing, no symbols loaded for user32.dll]	Unknown
 	DumpRenderTreeLib.dll!runTest(const std::string & inputLine) Line 1272	C++
 	DumpRenderTreeLib.dll!main(int argc, const char * * argv) Line 1642	C++
 	DumpRenderTreeLib.dll!dllLauncherEntryPoint(int argc, const char * * argv) Line 1682	C++
 	DumpRenderTree.exe!main(int argc, const char * * argv) Line 230	C++
 	[External Code]
Comment 31 Yusuke Suzuki 2019-11-11 11:58:20 PST
(In reply to Per Arne Vollan from comment #30)
> >	[Inline Frame] JavaScriptCore.dll!JSC::AtomIndices::{ctor}(JSC::HeapCell *) Line 37	C++
>  	[Inline Frame] JavaScriptCore.dll!JSC::IsoCellSet::add(JSC::HeapCell *)
> Line 38	C++
>  	JavaScriptCore.dll!JSC::ScriptExecutable::installCode(JSC::VM & vm,
> JSC::CodeBlock * genericCodeBlock, JSC::CodeType codeType,
> JSC::CodeSpecializationKind kind) Line 191	C++
>  	JavaScriptCore.dll!JSC::ScriptExecutable::prepareForExecutionImpl(JSC::VM
> & vm, JSC::JSFunction * function, JSC::JSScope * scope,
> JSC::CodeSpecializationKind kind, JSC::CodeBlock * & resultCodeBlock) Line
> 435	C++
>  	[Inline Frame]
> JavaScriptCore.dll!JSC::ScriptExecutable::prepareForExecution(JSC::VM &)
> Line 1051	C++
>  	JavaScriptCore.dll!JSC::Interpreter::executeProgram(const JSC::SourceCode
> & source, JSC::JSGlobalObject * __formal, JSC::JSObject * thisObj) Line 825
> C++
>  	JavaScriptCore.dll!JSC::evaluate(JSC::JSGlobalObject * globalObject, const
> JSC::SourceCode & source, JSC::JSValue thisValue,
> WTF::NakedPtr<JSC::Exception> & returnedException) Line 148	C++
>  	JavaScriptCore.dll!JSC::profiledEvaluate(JSC::JSGlobalObject *
> globalObject, JSC::ProfilingReason reason, const JSC::SourceCode & source,
> JSC::JSValue thisValue, WTF::NakedPtr<JSC::Exception> & returnedException)
> Line 161	C++
>  	[Inline Frame]
> WebKit.dll!WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject *)
> Line 79	C++
>  	WebKit.dll!WebCore::ScriptController::evaluateInWorld(const
> WebCore::ScriptSourceCode & sourceCode, WebCore::DOMWrapperWorld & world,
> WebCore::ExceptionDetails * exceptionDetails) Line 134	C++
>  	WebKit.dll!WebCore::ScriptController::evaluate(const
> WebCore::ScriptSourceCode & sourceCode, WebCore::ExceptionDetails *
> exceptionDetails) Line 150	C++
>  	WebKit.dll!WebCore::ScriptElement::executeClassicScript(const
> WebCore::ScriptSourceCode & sourceCode) Line 391	C++
>  	WebKit.dll!WebCore::LoadableClassicScript::execute(WebCore::ScriptElement
> & scriptElement) Line 123	C++
>  	[Inline Frame]
> WebKit.dll!WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::
> LoadableScript &) Line 429	C++
>  
> WebKit.dll!WebCore::ScriptElement::executePendingScript(WebCore::
> PendingScript & pendingScript) Line 437	C++
>  	[Inline Frame]
> WebKit.dll!WebCore::HTMLScriptRunner::
> executePendingScriptAndDispatchEvent(WebCore::PendingScript &) Line 114	C++
>  	WebKit.dll!WebCore::HTMLScriptRunner::executeParsingBlockingScripts() Line
> 164	C++
>  
> WebKit.dll!WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::
> ScriptElement,WTF::DumbPtrTraits<WebCore::ScriptElement>> && element, const
> WTF::TextPosition & scriptStartPosition) Line 150	C++
>  	WebKit.dll!WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder()
> Line 234	C++
>  
> WebKit.dll!WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::
> HTMLDocumentParser::SynchronousMode mode, bool parsingFragment,
> WebCore::PumpSession & session) Line 255	C++
>  
> WebKit.dll!WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::
> HTMLDocumentParser::SynchronousMode mode) Line 309	C++
>  	[Inline Frame]
> WebKit.dll!WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::
> HTMLDocumentParser::SynchronousMode) Line 186	C++
>  
> WebKit.dll!WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl,
> WTF::DumbPtrTraits<WTF::StringImpl>> && inputSource) Line 419	C++
>  
> WebKit.dll!WebCore::DecodedDataDocumentParser::appendBytes(WebCore::
> DocumentWriter & writer, const char * data, unsigned int length) Line 50	C++
>  	WebKit.dll!WebCore::DocumentWriter::addData(const char * bytes, unsigned
> int length) Line 258	C++
>  	WebKit.dll!WebCore::DocumentLoader::commitData(const char * bytes,
> unsigned int length) Line 1125	C++
>  	WebKit.dll!WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader *
> loader, const char * data, int length) Line 689	C++
>  	WebKit.dll!WebCore::DocumentLoader::commitLoad(const char * data, int
> length) Line 1013	C++
>  	WebKit.dll!WebCore::DocumentLoader::dataReceived(const char * data, int
> length) Line 1158	C++
>  	WebKit.dll!WebCore::DocumentLoader::dataReceived(WebCore::CachedResource &
> resource, const char * data, int length) Line 1131	C++
>  	WebKit.dll!WebCore::CachedRawResource::notifyClientsDataWasReceived(const
> char * data, unsigned int length) Line 135	C++
>  	WebKit.dll!WebCore::CachedRawResource::updateBuffer(WebCore::SharedBuffer
> & data) Line 74	C++
>  	WebKit.dll!WebCore::SubresourceLoader::didReceiveDataOrBuffer(const char *
> data, int length,
> WTF::RefPtr<WebCore::SharedBuffer,WTF::DumbPtrTraits<WebCore::SharedBuffer>>
> && buffer, __int64 encodedDataLength, WebCore::DataPayloadType
> dataPayloadType) Line 505	C++
>  
> WebKit.dll!WebCore::SubresourceLoader::didReceiveBuffer(WTF::Ref<WebCore::
> SharedBuffer,WTF::DumbPtrTraits<WebCore::SharedBuffer>> && buffer, __int64
> encodedDataLength, WebCore::DataPayloadType dataPayloadType) Line 485	C++
>  
> WebKit.dll!WebCore::ResourceLoader::didReceiveBuffer(WebCore::ResourceHandle
> * __formal,
> WTF::Ref<WebCore::SharedBuffer,WTF::DumbPtrTraits<WebCore::SharedBuffer>> &&
> buffer, int encodedDataLength) Line 694	C++
>  	[Inline Frame]
> WebKit.dll!WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::
> didReceiveData::__l2::<lambda_5f349daa7f72b184051aee54a6289cd4>::
> operator()() Line 225	C++
>  
> WebKit.dll!WTF::Detail::
> CallableWrapper<<lambda_5f349daa7f72b184051aee54a6289cd4>,void>::call() Line
> 52	C++
>  	[Inline Frame] WTF.dll!WTF::Function<void __cdecl(void)>::operator()()
> Line 79	C++
>  	WTF.dll!WTF::dispatchFunctionsFromMainThread() Line 97	C++
>  	WTF.dll!WTF::ThreadingWindowWndProc(HWND__ * hWnd, unsigned int message,
> unsigned int wParam, long lParam) Line 51	C++
>  	[External Code]	
>  	user32.dll![Frames below may be incorrect and/or missing, no symbols
> loaded for user32.dll]	Unknown
>  	DumpRenderTreeLib.dll!runTest(const std::string & inputLine) Line 1272	C++
>  	DumpRenderTreeLib.dll!main(int argc, const char * * argv) Line 1642	C++
>  	DumpRenderTreeLib.dll!dllLauncherEntryPoint(int argc, const char * * argv)
> Line 1682	C++
>  	DumpRenderTree.exe!main(int argc, const char * * argv) Line 230	C++
>  	[External Code]

Nice! Thanks, looking.
Comment 32 Yusuke Suzuki 2019-11-11 13:37:02 PST
Reopening to attach new patch.
Comment 33 Yusuke Suzuki 2019-11-11 13:37:03 PST
Created attachment 383292 [details]
Patch
Comment 34 Yusuke Suzuki 2019-11-11 13:42:35 PST
Created attachment 383293 [details]
Patch
Comment 35 Yusuke Suzuki 2019-11-11 13:44:28 PST
Created attachment 383294 [details]
Patch
Comment 36 Yusuke Suzuki 2019-11-11 13:48:38 PST
Created attachment 383295 [details]
Patch
Comment 37 Yusuke Suzuki 2019-11-11 13:51:49 PST
Created attachment 383298 [details]
Patch
Comment 38 Yusuke Suzuki 2019-11-11 15:57:45 PST
Committed r252341: <https://trac.webkit.org/changeset/252341>
Comment 39 Yusuke Suzuki 2019-11-11 17:18:54 PST
Committed r252347: <https://trac.webkit.org/changeset/252347>
Comment 40 Yusuke Suzuki 2019-11-12 16:22:23 PST
Follow-up fix, waiting for review. https://bugs.webkit.org/show_bug.cgi?id=204124