Bug 90568 - [GTK] Enable parallel GC
Summary: [GTK] Enable parallel GC
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Andy Wingo
URL:
Keywords:
Depends on: 141290
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-04 10:32 PDT by Andy Wingo
Modified: 2016-02-02 19:52 PST (History)
5 users (show)

See Also:


Attachments
Patch (2.29 KB, patch)
2012-07-04 10:36 PDT, Andy Wingo
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andy Wingo 2012-07-04 10:32:13 PDT
The patch to be attached adds GTK+ to the parallel GC party.
Comment 1 Andy Wingo 2012-07-04 10:36:42 PDT
Created attachment 150819 [details]
Patch
Comment 2 WebKit Review Bot 2012-07-04 13:32:45 PDT
Comment on attachment 150819 [details]
Patch

Clearing flags on attachment: 150819

Committed r121869: <http://trac.webkit.org/changeset/121869>
Comment 3 WebKit Review Bot 2012-07-04 13:32:49 PDT
All reviewed patches have been landed.  Closing bug.
Comment 4 Zan Dobersek 2012-08-13 05:10:24 PDT
Parallel GC is currently causing flaky crashes in JavaScriptCore. See bug #90957, comment #22 there describes the nature of issues for the GTK port.

I believe the parallel GC should be disabled at least before branching out for the next series of stable releases if the crashes are not fixed by then.
Comment 5 Martin Robinson 2012-08-13 05:12:49 PDT
One option is to disable this shortly after branching.
Comment 6 Carlos Garcia Campos 2012-08-23 08:51:28 PDT
Should this be reopened?
Comment 7 Martin Robinson 2012-08-23 09:18:51 PDT
Disabling it here: https://bugs.webkit.org/show_bug.cgi?id=94823
Comment 8 Peng Xinchao 2016-02-02 19:52:19 PST
Hello, GC experts.

Recently I met a GC crash when PARRALLEL GC is enabled. Crash is like:

#0  0x00007ffff72a1671 in isJSString (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSString.h:501
#1  visitChildren (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:351
#2  JSC::SlotVisitor::drain (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:405
#3  0x00007ffff72a19e4 in JSC::SlotVisitor::drainFromShared (this=0x7fffeaec0cd8, sharedDrainMode=JSC::SlotVisitor::MasterDrain) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:498
#4  0x00007ffff729dd38 in JSC::Heap::markRoots (this=0x7fffeaec0050, fullGC=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.cpp:555
#5  0x00007ffff729df8b in JSC::Heap::collect (this=0x7fffeaec0050, sweepToggle=JSC::Heap::DoNotSweep) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.cpp:717
#6  0x00007ffff72a410c in JSC::MarkedAllocator::allocateSlowCase (this=0x7fffeaec0158) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedAllocator.cpp:75
#7  0x00007ffff72e84ba in JSC::MarkedAllocator::allocate (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedAllocator.h:77
#8  JSC::MarkedSpace::allocateWithDestructor (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedSpace.h:191
#9  JSC::Heap::allocateWithDestructor (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.h:362
#10 allocateCell<JSC::JSFinalObject> (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSCell.h:340
#11 JSC::JSFinalObject::create (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSObject.h:439
#12 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSObject.h:515
#13 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.h:431
#14 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.h:436
#15 operationNewObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGOperations.cpp:305
#16 0x00007fffaaf8880d in ?? ()
#17 0x0000000000000000 in ?? ()


I checked the code of JSCore GC.

void SlotVisitor::drain()
{
    StackStats::probe();
    ASSERT(m_isInParallelMode);

#if ENABLE(PARALLEL_GC)
    if (Options::numberOfGCMarkers() > 1) {
        while (!m_stack.isEmpty()) {
            m_stack.refill();
            for (unsigned countdown = Options::minimumNumberOfScansBetweenRebalance(); m_stack.canRemoveLast() && countdown--;)
                visitChildren(*this, m_stack.removeLast());
            donateKnownParallel();
        }

        mergeOpaqueRootsIfNecessary();
        return;
    }
#endif

    while (!m_stack.isEmpty()) {
        m_stack.refill();
        while (m_stack.canRemoveLast())
            visitChildren(*this, m_stack.removeLast());
    }
}

Why is m_shared.m_markingLock not added before m_stack.refill() and m_stack.removeLast(), just like inside the function void SlotVisitor::donateKnownParallel() ?

It seems that m_stack is operated unsafely when PARRELLEL GC is enabled.

What do you think?