RESOLVED INVALID 95764
Crashes in fast/profiler layout tests after r127202 
https://bugs.webkit.org/show_bug.cgi?id=95764
Summary Crashes in fast/profiler layout tests after r127202
Mark Hahnenberg
Reported 2012-09-04 11:26:22 PDT
On Mountain Lion on WebKit trunk r127470, I usually get at least one crash in the fast/profiler layout tests when looking up the scope on a JSFunction during recompilation. Since http://trac.webkit.org/changeset/127202 changed how this stuff works in JSC recently, I'm choosing it as the revision to blame :-) Here's a stack trace (from fast/profiler/document-dot-write.html): Process: DumpRenderTree [6124] Path: /Volumes/VOLUME/*/DumpRenderTree Identifier: DumpRenderTree Version: 0 Code Type: X86-64 (Native) Parent Process: Python [6082] User ID: 501 Date/Time: 2012-09-04 11:22:28.458 -0700 OS Version: Mac OS X 10.8.1 (12B19) Report Version: 10 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000008 VM Regions Near 0x8: --> __TEXT 0000000100ae9000-0000000100b8a000 [ 644K] r-x/rwx SM=COW /Volumes/VOLUME/* Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000100d747dc JSC::WriteBarrierBase<JSC::Structure>::unvalidatedGet() const + 12 (WriteBarrier.h:139) 1 com.apple.JavaScriptCore 0x0000000100d6fe8c JSC::JSCell::unvalidatedStructure() + 28 (JSCell.h:147) 2 com.apple.JavaScriptCore 0x0000000100f8a4b7 JSC::slowValidateCell(JSC::JSCell*) + 71 (JSCell.cpp:167) 3 com.apple.JavaScriptCore 0x0000000100d6d035 void JSC::validateCell<JSC::JSCell*>(JSC::JSCell*) + 21 (WriteBarrier.h:56) 4 com.apple.JavaScriptCore 0x0000000100d8132d JSC::WriteBarrierBase<JSC::JSScope>::get() const + 45 (WriteBarrier.h:104) 5 com.apple.JavaScriptCore 0x0000000100d80f57 JSC::JSFunction::scope() + 119 (JSFunction.h:75) 6 com.apple.JavaScriptCore 0x0000000100e16bcf (anonymous namespace)::Recompiler::operator()(JSC::JSCell*) + 207 (Debugger.cpp:81) 7 com.apple.JavaScriptCore 0x0000000100e16ada void JSC::MarkedBlock::forEachCell<(anonymous namespace)::Recompiler>((anonymous namespace)::Recompiler&) + 122 (MarkedBlock.h:411) 8 com.apple.JavaScriptCore 0x0000000100e167af (anonymous namespace)::Recompiler::ReturnType JSC::MarkedSpace::forEachCell<(anonymous namespace)::Recompiler>((anonymous namespace)::Recompiler&) + 159 (MarkedSpace.h:148) 9 com.apple.JavaScriptCore 0x0000000100e166ce JSC::Debugger::recompileAllJSFunctions(JSC::JSGlobalData*) + 174 (Debugger.cpp:121) 10 com.apple.WebCore 0x000000010333b289 WebCore::PageScriptDebugServer::recompileAllJSFunctions(WebCore::Timer<WebCore::ScriptDebugServer>*) + 105 (PageScriptDebugServer.cpp:118) 11 com.apple.WebCore 0x00000001036c04b3 WebCore::Timer<WebCore::ScriptDebugServer>::fired() + 115 (Timer.h:100) 12 com.apple.WebCore 0x0000000103a06b4d WebCore::ThreadTimers::sharedTimerFiredInternal() + 285 (ThreadTimers.cpp:118) 13 com.apple.WebCore 0x0000000103a068e9 WebCore::ThreadTimers::sharedTimerFired() + 25 (ThreadTimers.cpp:94) 14 com.apple.WebCore 0x0000000103747d23 WebCore::timerFired(__CFRunLoopTimer*, void*) + 67 (SharedTimerMac.mm:167) 15 com.apple.CoreFoundation 0x00007fff8a7314b4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 16 com.apple.CoreFoundation 0x00007fff8a730fcd __CFRunLoopDoTimer + 557 17 com.apple.CoreFoundation 0x00007fff8a7167b9 __CFRunLoopRun + 1513 18 com.apple.CoreFoundation 0x00007fff8a715dd2 CFRunLoopRunSpecific + 290 19 com.apple.Foundation 0x00007fff85555ace -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268 20 DumpRenderTree 0x0000000100b00df1 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 4977 (DumpRenderTree.mm:1362) 21 DumpRenderTree 0x0000000100aff9fa runTestingServerLoop() + 282 (DumpRenderTree.mm:832) 22 DumpRenderTree 0x0000000100aff2b7 dumpRenderTree(int, char const**) + 391 (DumpRenderTree.mm:879) 23 DumpRenderTree 0x0000000100b015f9 main + 105 (DumpRenderTree.mm:916) 24 libdyld.dylib 0x00007fff835a17e1 start + 1
Attachments
Add attachment proposed patch, testcase, etc.
Geoffrey Garen
Comment 1 2012-09-04 22:29:03 PDT
<rdar://problem/12235021>
Joseph Pecoraro
Comment 2 2016-06-06 19:58:35 PDT
Legacy Profiler has been removed. This test no longer exists. Also this seems to have been passing in early 2013 without issue.
Note You need to log in before you can comment on or make changes to this bug.