Changeset 198229 in webkit

Timestamp:

Mar 15, 2016 2:48:15 PM (8 years ago)

Author:

commit-queue@webkit.org

Message:

REGRESSION: ASSERTION FAILED: !m_lastActiveBlock on js/function-apply.html
​https://bugs.webkit.org/show_bug.cgi?id=155411
<rdar://problem/25134537>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-15
Reviewed by Mark Lam.

Source/JavaScriptCore:

• heap/Heap.cpp:

(JSC::Heap::collectImpl):
(JSC::Heap::didFinishCollection):
During collection allocators are stop/reset. The HeapProfiler tasks
were using HeapIterationScope (to satisfy MarkedSpace forEachCell API
contracts) which was doing its own stop/resume of allocators. Doing a
stop/resume in between the normal stop/reset of collection is unexpected.

Move this to didFinishCollection, alongside other heap iterations
like zombies and immortal objects. Putting this after those tasks
also means the heap snapshots will respect the zombies/immortal options
when deciding if the cell is alive or not.

LayoutTests:

• platform/mac/TestExpectations:

Unmark test as flakey.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/mac/TestExpectations (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/heap/Heap.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-03-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION: ASSERTION FAILED: !m_lastActiveBlock on js/function-apply.html
+        https://bugs.webkit.org/show_bug.cgi?id=155411
+        <rdar://problem/25134537>
+
+        Reviewed by Mark Lam.
+
+        * platform/mac/TestExpectations:
+        Unmark test as flakey.
+
 2016-03-15  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/LayoutTests/platform/mac/TestExpectations

@@ -1343 +1343 @@
 [ Yosemite ElCapitan ] fast/scrolling/rtl-scrollbars-overflow-simple.html [ ImageOnlyFailure ]
 [ Yosemite ElCapitan ] fast/scrolling/rtl-scrollbars-overflow.html [ ImageOnlyFailure ]
-
-webkit.org/b/155411 [ Debug ] js/function-apply.html [ Pass Crash ]

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-03-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION: ASSERTION FAILED: !m_lastActiveBlock on js/function-apply.html
+        https://bugs.webkit.org/show_bug.cgi?id=155411
+        <rdar://problem/25134537>
+
+        Reviewed by Mark Lam.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::didFinishCollection):
+        During collection allocators are stop/reset. The HeapProfiler tasks
+        were using HeapIterationScope (to satisfy MarkedSpace forEachCell API
+        contracts) which was doing its own stop/resume of allocators. Doing a
+        stop/resume in between the normal stop/reset of collection is unexpected.
+
+        Move this to didFinishCollection, alongside other heap iterations
+        like zombies and immortal objects. Putting this after those tasks
+        also means the heap snapshots will respect the zombies/immortal options
+        when deciding if the cell is alive or not.
+
 2016-03-15  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -1177 +1177 @@
     deleteSourceProviderCaches();
 
-    if (HeapProfiler* heapProfiler = m_vm->heapProfiler()) {
-        gatherExtraHeapSnapshotData(*heapProfiler);
-        removeDeadHeapSnapshotNodes(*heapProfiler);
-    }
-
     notifyIncrementalSweeper();
     writeBarrierCurrentlyExecutingCodeBlocks();
@@ -1463 +1458 @@
         GCLogging::dumpObjectGraph(this);
 
+    if (HeapProfiler* heapProfiler = m_vm->heapProfiler()) {
+        gatherExtraHeapSnapshotData(*heapProfiler);
+        removeDeadHeapSnapshotNodes(*heapProfiler);
+    }
+
     RELEASE_ASSERT(m_operationInProgress == EdenCollection || m_operationInProgress == FullCollection);
     m_operationInProgress = NoOperation;