Title: [199423] releases/WebKitGTK/webkit-2.12/Source/_javascript_Core
- Revision
- 199423
- Author
- [email protected]
- Date
- 2016-04-13 00:51:42 -0700 (Wed, 13 Apr 2016)
Log Message
Merge r198477 - Crash on DFG::WorkList thread in JSC::Heap::isCollecting for destroyed Web Worker
https://bugs.webkit.org/show_bug.cgi?id=155678
<rdar://problem/25251439>
Reviewed by Filip Pizlo.
This fixes a crash that we saw with GuardMalloc. If the Plan was
Cancelled it may not be safe to access the VM. If the Plan was
cancelled we are just going to bail anyways, so keep the ASSERT but
short-circuit if the plan was Cancelled.
* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::runThread):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog (199422 => 199423)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog 2016-04-13 07:39:03 UTC (rev 199422)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog 2016-04-13 07:51:42 UTC (rev 199423)
@@ -1,3 +1,19 @@
+2016-03-20 Joseph Pecoraro <[email protected]>
+
+ Crash on DFG::WorkList thread in JSC::Heap::isCollecting for destroyed Web Worker
+ https://bugs.webkit.org/show_bug.cgi?id=155678
+ <rdar://problem/25251439>
+
+ Reviewed by Filip Pizlo.
+
+ This fixes a crash that we saw with GuardMalloc. If the Plan was
+ Cancelled it may not be safe to access the VM. If the Plan was
+ cancelled we are just going to bail anyways, so keep the ASSERT but
+ short-circuit if the plan was Cancelled.
+
+ * dfg/DFGWorklist.cpp:
+ (JSC::DFG::Worklist::runThread):
+
2016-03-15 Filip Pizlo <[email protected]>
ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGWorklist.cpp (199422 => 199423)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGWorklist.cpp 2016-04-13 07:39:03 UTC (rev 199422)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/dfg/DFGWorklist.cpp 2016-04-13 07:51:42 UTC (rev 199423)
@@ -367,7 +367,7 @@
RELEASE_ASSERT(!plan->vm.heap.isCollecting());
plan->compileInThread(longLivedState, data);
- RELEASE_ASSERT(!plan->vm.heap.isCollecting());
+ RELEASE_ASSERT(plan->stage == Plan::Cancelled || !plan->vm.heap.isCollecting());
{
LockHolder locker(m_lock);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
