Bug 88449 – Worker tear-down can re-enter JSC during GC finalization

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore JavaScript

[Mark Hahnenberg]

~AbstractWorker can enter JS during GC finalization due to attempting to update the Web Inspector when the worker is being torn down, which is not allowed by JSC.

~Worker has a similar story. Both of these should be fixed to prevent this.

[Mark Hahnenberg]

Created attachment 146116 [details]
Patch

[Mark Hahnenberg]

> ~AbstractWorker can enter JS during GC finalization due to attempting to update the Web Inspector when the worker is being torn down, which is not allowed by JSC.

To make this more clear:

~AbstractWorker can re-enter JS during GC finalization, which is not allowed by JSC, due to attempting to update the Web Inspector when the worker is being torn down.

[Geoffrey Garen]

Comment on attachment 146116 [details]
Patch

r=me

[Mark Hahnenberg]

Committed r119624: <http://trac.webkit.org/changeset/119624>

[Ryosuke Niwa]

A bunch of worker tests started crashing after this patch:
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=fast%2Fworkers%2Fworker-event-listener.html%2Cfast%2Fworkers%2Fstorage%2Fchange-version-handle-reuse-worker.html%2Chttp%2Ftests%2Fhistory%2Fback-during-onload-triggered-by-back.html%2Cfast%2Fworkers%2Fstorage%2Fread-and-write-transactions-dont-run-together.html

[WebKit Review Bot]

Re-opened since this is blocked by 88472

[Mark Hahnenberg]

Created attachment 146165 [details]
Patch

[Mark Hahnenberg]

Let's try landing each piece of the patch separately to determine which half caused the regression. I think this first patch is the safer of the two.

[Geoffrey Garen]

Comment on attachment 146165 [details]
Patch

r=me

[WebKit Review Bot]

Comment on attachment 146165 [details]
Patch

Clearing flags on attachment: 146165

Committed r119740: <http://trac.webkit.org/changeset/119740>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.