130177 2014-03-12 21:41:41 -0700 [EFL] Enable Parallel GC 2016-02-02 21:47:18 -0800 1 1 1 Unclassified WebKit WebKit EFL 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 141290 1 ryuan.choi ryuan.choi lucas.de.marchi xinchao.peng oldest_to_newest 989921 0 ryuan.choi 2014-03-12 21:41:41 -0700 Turn on Parallel GC for the EFL port 989922 1 226573 ryuan.choi 2014-03-12 21:43:06 -0700 Created attachment 226573 Patch 989930 2 226573 ggaren 2014-03-12 22:21:52 -0700 Comment on attachment 226573 Patch r=me 989941 3 226573 ryuan.choi 2014-03-12 23:00:03 -0700 Comment on attachment 226573 Patch Clearing flags on attachment: 226573 Committed r165527: <http://trac.webkit.org/changeset/165527> 989942 4 ryuan.choi 2014-03-12 23:00:11 -0700 All reviewed patches have been landed. Closing bug. 1161526 5 xinchao.peng 2016-02-02 21:16:00 -0800 Hello, GC experts. Recently I met a GC crash when PARRALLEL GC is enabled. Crash is like: #0 0x00007ffff72a1671 in isJSString (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSString.h:501 #1 visitChildren (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:351 #2 JSC::SlotVisitor::drain (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:405 #3 0x00007ffff72a19e4 in JSC::SlotVisitor::drainFromShared (this=0x7fffeaec0cd8, sharedDrainMode=JSC::SlotVisitor::MasterDrain) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:498 #4 0x00007ffff729dd38 in JSC::Heap::markRoots (this=0x7fffeaec0050, fullGC=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.cpp:555 #5 0x00007ffff729df8b in JSC::Heap::collect (this=0x7fffeaec0050, sweepToggle=JSC::Heap::DoNotSweep) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.cpp:717 #6 0x00007ffff72a410c in JSC::MarkedAllocator::allocateSlowCase (this=0x7fffeaec0158) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedAllocator.cpp:75 #7 0x00007ffff72e84ba in JSC::MarkedAllocator::allocate (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedAllocator.h:77 #8 JSC::MarkedSpace::allocateWithDestructor (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedSpace.h:191 #9 JSC::Heap::allocateWithDestructor (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.h:362 #10 allocateCell<JSC::JSFinalObject> (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSCell.h:340 #11 JSC::JSFinalObject::create (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSObject.h:439 #12 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSObject.h:515 #13 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.h:431 #14 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.h:436 #15 operationNewObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGOperations.cpp:305 #16 0x00007fffaaf8880d in ?? () #17 0x0000000000000000 in ?? () I checked the code of JSCore GC. void SlotVisitor::drain() { StackStats::probe(); ASSERT(m_isInParallelMode); #if ENABLE(PARALLEL_GC) if (Options::numberOfGCMarkers() > 1) { while (!m_stack.isEmpty()) { m_stack.refill(); for (unsigned countdown = Options::minimumNumberOfScansBetweenRebalance(); m_stack.canRemoveLast() && countdown--;) visitChildren(*this, m_stack.removeLast()); donateKnownParallel(); } mergeOpaqueRootsIfNecessary(); return; } #endif while (!m_stack.isEmpty()) { m_stack.refill(); while (m_stack.canRemoveLast()) visitChildren(*this, m_stack.removeLast()); } } Why is m_shared.m_markingLock not added before m_stack.refill() and m_stack.removeLast(), just like inside the function void SlotVisitor::donateKnownParallel() ? It seems that m_stack is operated unsafely when PARRELLEL GC is enabled. What do you think? 1161544 6 xinchao.peng 2016-02-02 21:47:18 -0800 1 226573 2014-03-12 21:43:06 -0700 2014-03-12 23:00:03 -0700 Patch bug-130177-20140313134242.patch text/plain 1219 ryuan.choi U3VidmVyc2lvbiBSZXZpc2lvbjogMTY1NDY1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IDJkZWU5YzliN2Y1NWRlMDliNWViY2Rm MmE5MGNiNWMzYzdhNTg4NDEuLjY2ZWE2YzlhMTNhNzc5YzE1ODgyOGUwNTljNGZjNDllNDYyZmUw YmUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTIgQEAKKzIwMTQtMDMtMTIgIFJ5dWFuIENob2kgIDxyeXVhbi5j aG9pQHNhbXN1bmcuY29tPgorCisgICAgICAgIFtFRkxdIEVuYWJsZSBQYXJhbGxlbCBHQworICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTMwMTc3CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiB3dGYvUGxhdGZv cm0uaDogVHVybiBvbiBFTkFCTEVfUEFSQUxMRUxfR0MgZm9yIHRoZSBFRkwgYnVpbGQuCisKIDIw MTQtMDMtMTEgIEJyZW50IEZ1bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CiAKICAgICAgICAg W1dpbl0gVW5yZXZpZXdlZCBnYXJkZW5pbmcuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL3d0Zi9Q bGF0Zm9ybS5oIGIvU291cmNlL1dURi93dGYvUGxhdGZvcm0uaAppbmRleCBkYWI0NTgwMjE2ZjY1 ZWY0NjVmNmM3NGJkYTdlNmIyZmMzN2Q0MTRhLi5lNzhiNTI5MDVhNTg0NDc2ODIzMzcyNTMzNzE1 NjMwNGU0M2U5MzFhIDEwMDY0NAotLS0gYS9Tb3VyY2UvV1RGL3d0Zi9QbGF0Zm9ybS5oCisrKyBi L1NvdXJjZS9XVEYvd3RmL1BsYXRmb3JtLmgKQEAgLTkzMCw3ICs5MzAsNyBAQAogI2RlZmluZSBF TkFCTEVfQ09NUEFSRV9BTkRfU1dBUCAxCiAjZW5kaWYKIAotI2lmICFkZWZpbmVkKEVOQUJMRV9Q QVJBTExFTF9HQykgJiYgIUVOQUJMRShPQkpFQ1RfTUFSS19MT0dHSU5HKSAmJiAoT1MoREFSV0lO KSAmJiAhUExBVEZPUk0oRUZMKSB8fCBQTEFURk9STShHVEspKSAmJiBFTkFCTEUoQ09NUEFSRV9B TkRfU1dBUCkKKyNpZiAhZGVmaW5lZChFTkFCTEVfUEFSQUxMRUxfR0MpICYmICFFTkFCTEUoT0JK RUNUX01BUktfTE9HR0lORykgJiYgKE9TKERBUldJTikgfHwgUExBVEZPUk0oRUZMKSB8fCBQTEFU Rk9STShHVEspKSAmJiBFTkFCTEUoQ09NUEFSRV9BTkRfU1dBUCkKICNkZWZpbmUgRU5BQkxFX1BB UkFMTEVMX0dDIDEKICNlbmRpZgogCg==