90568 2012-07-04 10:32:13 -0700 [GTK] Enable parallel GC 2016-02-02 19:52:19 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 141290 1 wingo wingo cgarcia mrobinson webkit.review.bot xinchao.peng zan oldest_to_newest 663052 0 wingo 2012-07-04 10:32:13 -0700 The patch to be attached adds GTK+ to the parallel GC party. 663054 1 150819 wingo 2012-07-04 10:36:42 -0700 Created attachment 150819 Patch 663144 2 150819 webkit.review.bot 2012-07-04 13:32:45 -0700 Comment on attachment 150819 Patch Clearing flags on attachment: 150819 Committed r121869: <http://trac.webkit.org/changeset/121869> 663145 3 webkit.review.bot 2012-07-04 13:32:49 -0700 All reviewed patches have been landed. Closing bug. 693552 4 zan 2012-08-13 05:10:24 -0700 Parallel GC is currently causing flaky crashes in JavaScriptCore. See bug #90957, comment #22 there describes the nature of issues for the GTK port. I believe the parallel GC should be disabled at least before branching out for the next series of stable releases if the crashes are not fixed by then. 693554 5 mrobinson 2012-08-13 05:12:49 -0700 One option is to disable this shortly after branching. 703039 6 cgarcia 2012-08-23 08:51:28 -0700 Should this be reopened? 703064 7 mrobinson 2012-08-23 09:18:51 -0700 Disabling it here: https://bugs.webkit.org/show_bug.cgi?id=94823 1161498 8 xinchao.peng 2016-02-02 19:52:19 -0800 Hello, GC experts. Recently I met a GC crash when PARRALLEL GC is enabled. Crash is like: #0 0x00007ffff72a1671 in isJSString (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSString.h:501 #1 visitChildren (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:351 #2 JSC::SlotVisitor::drain (this=0x7fffeaec0cd8) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:405 #3 0x00007ffff72a19e4 in JSC::SlotVisitor::drainFromShared (this=0x7fffeaec0cd8, sharedDrainMode=JSC::SlotVisitor::MasterDrain) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkStack.cpp:498 #4 0x00007ffff729dd38 in JSC::Heap::markRoots (this=0x7fffeaec0050, fullGC=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.cpp:555 #5 0x00007ffff729df8b in JSC::Heap::collect (this=0x7fffeaec0050, sweepToggle=JSC::Heap::DoNotSweep) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.cpp:717 #6 0x00007ffff72a410c in JSC::MarkedAllocator::allocateSlowCase (this=0x7fffeaec0158) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedAllocator.cpp:75 #7 0x00007ffff72e84ba in JSC::MarkedAllocator::allocate (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedAllocator.h:77 #8 JSC::MarkedSpace::allocateWithDestructor (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/MarkedSpace.h:191 #9 JSC::Heap::allocateWithDestructor (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/heap/Heap.h:362 #10 allocateCell<JSC::JSFinalObject> (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSCell.h:340 #11 JSC::JSFinalObject::create (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSObject.h:439 #12 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSObject.h:515 #13 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.h:431 #14 constructEmptyObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.h:436 #15 operationNewObject (exec=<value optimized out>) at /home/oszi/WebKit/Source/JavaScriptCore/dfg/DFGOperations.cpp:305 #16 0x00007fffaaf8880d in ?? () #17 0x0000000000000000 in ?? () I checked the code of JSCore GC. void SlotVisitor::drain() { StackStats::probe(); ASSERT(m_isInParallelMode); #if ENABLE(PARALLEL_GC) if (Options::numberOfGCMarkers() > 1) { while (!m_stack.isEmpty()) { m_stack.refill(); for (unsigned countdown = Options::minimumNumberOfScansBetweenRebalance(); m_stack.canRemoveLast() && countdown--;) visitChildren(*this, m_stack.removeLast()); donateKnownParallel(); } mergeOpaqueRootsIfNecessary(); return; } #endif while (!m_stack.isEmpty()) { m_stack.refill(); while (m_stack.canRemoveLast()) visitChildren(*this, m_stack.removeLast()); } } Why is m_shared.m_markingLock not added before m_stack.refill() and m_stack.removeLast(), just like inside the function void SlotVisitor::donateKnownParallel() ? It seems that m_stack is operated unsafely when PARRELLEL GC is enabled. What do you think? 150819 2012-07-04 10:36:42 -0700 2012-07-04 13:32:45 -0700 Patch bug-90568-20120704193640.patch text/plain 2344 wingo U3VidmVyc2lvbiBSZXZpc2lvbjogMTIxODM5CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBi ZDc0OWExMGQ4MDk5NjdjZTQ5OThiMjg4M2Q4ODkxZjZlMzVlYTQ0Li43YWZhOTVkM2MxNjVjMzkx N2VhNmJkODc2ZThmOGQxYTU3YjlmYzkxIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxMiBAQAorMjAxMi0wNy0wNCAgQW5keSBXaW5nbyAgPHdpbmdvQGlnYWxpYS5jb20+CisK KyAgICAgICAgW0dUS10gRW5hYmxlIHBhcmFsbGVsIEdDCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05MDU2OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorCisgICAgICAgICogcnVudGltZS9PcHRpb25zLmNwcDogSW5jbHVkZSA8 YWxnb3JpdGhtLmg+IGZvciBzdGQ6Om1pbi4KKwogMjAxMi0wNy0wMyAgTWljaGFlbCBTYWJvZmYg IDxtc2Fib2ZmQGFwcGxlLmNvbT4KIAogICAgICAgICBFbmg6IEhhc2ggQ29uc3QgSlNTdHJpbmcg aW4gQmFja2luZyBTdG9yZXMgdG8gU2F2ZSBNZW1vcnkKZGlmZiAtLWdpdCBhL1NvdXJjZS9XVEYv Q2hhbmdlTG9nIGIvU291cmNlL1dURi9DaGFuZ2VMb2cKaW5kZXggZWQyZDlhNzc2YjQzZmNhNzFj NTZhMmY3MGJjOTczYzE2YjRhYjVkOS4uZDc5YTE3MmRlZjViMDFlODE5M2QyMWRmNjBjYjA0ZjNk ZjJlOGMzNyAxMDA2NDQKLS0tIGEvU291cmNlL1dURi9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dU Ri9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMiBAQAorMjAxMi0wNy0wNCAgQW5keSBXaW5nbyAgPHdp bmdvQGlnYWxpYS5jb20+CisKKyAgICAgICAgW0dUS10gRW5hYmxlIHBhcmFsbGVsIEdDCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05MDU2OAorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogd3RmL1BsYXRmb3Jt Lmg6IEFkZCBHVEsgdG8gdGhlIEVOQUJMRV9QQVJBTExFTF9HQyBwYXJ0eS4KKwogMjAxMi0wNy0w MyAgWW9uZyBMaSAgPHlvbGlAcmltLmNvbT4KIAogICAgICAgICBbQmxhY2tCZXJyeV0gVHVybiBv biBERkdKSVQgaW4gUGxhdGZvcm0uaApkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3Jl L3J1bnRpbWUvT3B0aW9ucy5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9PcHRp b25zLmNwcAppbmRleCAzNDAwMDk4ZTU0NzZlNjBmZGY3ZWEzODZiYThkYmZiN2I5ZDI2N2U2Li4x Nzc0M2QzNDAxYTY0YjM2ZTU5NDRjODQyMzAzYTc3NGU2YTJmZGQ1IDEwMDY0NAotLS0gYS9Tb3Vy Y2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9PcHRpb25zLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNj cmlwdENvcmUvcnVudGltZS9PcHRpb25zLmNwcApAQCAtMjYsNiArMjYsNyBAQAogI2luY2x1ZGUg ImNvbmZpZy5oIgogI2luY2x1ZGUgIk9wdGlvbnMuaCIKIAorI2luY2x1ZGUgPGFsZ29yaXRobT4K ICNpbmNsdWRlIDxsaW1pdHM+CiAjaW5jbHVkZSA8c3RkaW8uaD4KICNpbmNsdWRlIDxzdGRsaWIu aD4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XVEYvd3RmL1BsYXRmb3JtLmggYi9Tb3VyY2UvV1RGL3d0 Zi9QbGF0Zm9ybS5oCmluZGV4IDc1YTlhODY5MDVmZmMwMjk0NzNkMGZiMDk2ZDUwOGEyMWRmNTVk ZjkuLjlhN2M3NWMwYmQwN2M2ZWU1ODc0OGM0NDg2ZjYzMTg4ODljNDYxNjYgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9XVEYvd3RmL1BsYXRmb3JtLmgKKysrIGIvU291cmNlL1dURi93dGYvUGxhdGZvcm0u aApAQCAtMTA3NSw3ICsxMDc1LDcgQEAKIAogI2RlZmluZSBFTkFCTEVfT0JKRUNUX01BUktfTE9H R0lORyAwCiAKLSNpZiAhZGVmaW5lZChFTkFCTEVfUEFSQUxMRUxfR0MpICYmICFFTkFCTEUoT0JK RUNUX01BUktfTE9HR0lORykgJiYgKFBMQVRGT1JNKE1BQykgfHwgUExBVEZPUk0oSU9TKSB8fCBQ TEFURk9STShRVCkgfHwgUExBVEZPUk0oQkxBQ0tCRVJSWSkpICYmIEVOQUJMRShDT01QQVJFX0FO RF9TV0FQKQorI2lmICFkZWZpbmVkKEVOQUJMRV9QQVJBTExFTF9HQykgJiYgIUVOQUJMRShPQkpF Q1RfTUFSS19MT0dHSU5HKSAmJiAoUExBVEZPUk0oTUFDKSB8fCBQTEFURk9STShJT1MpIHx8IFBM QVRGT1JNKFFUKSB8fCBQTEFURk9STShCTEFDS0JFUlJZKSB8fCBQTEFURk9STShHVEspKSAmJiBF TkFCTEUoQ09NUEFSRV9BTkRfU1dBUCkKICNkZWZpbmUgRU5BQkxFX1BBUkFMTEVMX0dDIDEKICNl bmRpZgogCg==