Bug 187157

Summary: IsoCellSet::sweepToFreeList() not safe when Full GC in process
Product: WebKit Reporter: Michael Saboff <msaboff>
Component: JavaScriptCoreAssignee: Michael Saboff <msaboff>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, fpizlo, keith_miller, mark.lam, saam, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch mark.lam: review+

Description Michael Saboff 2018-06-28 14:33:06 PDT 
If we are in the process of a full GC and we call into IsoCellSet::sweepToFreeList(), the IsoCellSet's bits may be improperly cleared due to incomplete stale marks logic.  The stale marks logic needs to match what is in MarkedBlock::Handle::specializedSweep where it takes into account whether or not we are in the process of marking during a full GC.
Comment 1 Michael Saboff 2018-06-28 14:33:27 PDT 
<rdar://problem/41400293>
Comment 2 Michael Saboff 2018-06-28 15:52:45 PDT 
Created attachment 343866 [details]
Patch
Comment 3 Mark Lam 2018-06-28 16:00:14 PDT 
Comment on attachment 343866 [details]
Patch

r=me
Comment 4 Michael Saboff 2018-06-28 20:27:30 PDT 
Committed r233346: <https://trac.webkit.org/changeset/233346>