[Webkit-unassigned] [Bug 65326] New: Crash on exit due to TCMalloc_PageHeap::m_scavengeQueueTimer not being shutdown

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=65326

           Summary: Crash on exit due to
                    TCMalloc_PageHeap::m_scavengeQueueTimer not being
                    shutdown
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows 7
            Status: UNCONFIRMED
          Severity: Major
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: michaelbraithwaite at turbulenz.com


This isn't from the nightly but with JSC from http://trac.webkit.org/browser/releases/WebKitGTK/webkit-1.4.2. (Perhaps an 'other' in Version would be handy?)

I get a crash on exit using JSC in a custom app.

It due to TCMalloc_PageHeap::m_scavengeQueueTimer not being shutdown. 

If there is a timer scheduled when the app exits the timer event can occur after the TCMalloc_PageHeap context becomes invalid. 

This crashes in CMalloc_PageHeap::scavengerTimerFired() since context passed in is garbage.

Locally I stopped this crash by calling suspendScavenger() but I'm unclear on where the correct place to stop it should be.

BTW DeleteTimerQueueTimer wont delete an already scheduled event - see http://msdn.microsoft.com/en-us/library/ms682569(v=vs.85).aspx. 

so to avoid this edge case I also had to update TCMalloc_PageHeap::periodicScavenge() to avoid it rescheduling...

void TCMalloc_PageHeap::periodicScavenge()
{
    SpinLockHolder h(&pageheap_lock);
    pageheap->scavenge();

    if (isScavengerSuspended() == false)
    {    
        if (shouldScavenge()) {
            rescheduleScavenger();
            return;
        }

        suspendScavenger();
    }
}

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.