Changeset 216637 in webkit

Timestamp:

May 10, 2017, 4:43:44 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

Crash in JavaScriptCore GC when using JSC on dispatch queues (thread_get_state returns NULL stack pointer).
​https://bugs.webkit.org/show_bug.cgi?id=160337
<rdar://problem/27611733>

Not reviewed.

Updated a comment per Geoff's suggestion.

• heap/MachineStackMarker.cpp:

(JSC::MachineThreads::tryCopyOtherThreadStack):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• heap/MachineStackMarker.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-05-10  Mark Lam  <mark.lam@apple.com>
+
+        Crash in JavaScriptCore GC when using JSC on dispatch queues (thread_get_state returns NULL stack pointer).
+        https://bugs.webkit.org/show_bug.cgi?id=160337
+        <rdar://problem/27611733>
+
+        Not reviewed.
+
+        Updated a comment per Geoff's suggestion.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::tryCopyOtherThreadStack):
+
 2017-05-10  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/heap/MachineStackMarker.cpp

@@ -313 +313 @@
     size_t registersSize = thread->getRegisters(registers);
 
-    // This is a workaround for <rdar://problem/27607384>. During thread initialization,
-    // for some target platforms, thread state is momentarily set to 0 before being
-    // filled in with the target thread's real register values. As a result, there's
-    // a race condition that may result in us getting a null stackPointer.
-    // This issue may manifest with workqueue threads where the OS may choose to recycle
-    // a thread for an expired task.
-    //
-    // The workaround is simply to indicate that there's nothing to copy and return.
-    // This is correct because we will only ever observe a null pointer during thread
-    // initialization. Hence, by definition, there's nothing there that we need to scan
-    // yet, and therefore, nothing that needs to be copied.
+    // This is a workaround for <rdar://problem/27607384>. libdispatch recycles work
+    // queue threads without running pthread exit destructors. This can cause us to scan a
+    // thread during work queue initialization, when the stack pointer is null.
     if (UNLIKELY(!registers.stackPointer())) {
         *size = 0;