<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - void ThreadTimers::sharedTimerFiredInternal() is not thread safe...."
href="https://bugs.webkit.org/show_bug.cgi?id=164442">164442</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>void ThreadTimers::sharedTimerFiredInternal() is not thread safe....
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Macintosh
</td>
</tr>
<tr>
<th>OS</th>
<td>macOS 10.12
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Major
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>WebCore JavaScript
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>milarson@nvidia.com
</td>
</tr></table>
<p>
<div>
<pre>I am looking at a driver level bug that backtraces to Webkit, upon inspecting the code in sharedTimerFiredInternal it's obvious that this is not thread safe code
The issue is here...
void ThreadTimers::sharedTimerFiredInternal()
...
// Do a re-entrancy check.
if (m_firingTimers)
return;
m_firingTimers = true;
m_pendingSharedTimerFireTime = 0;
Where is the lock on m_firingTimers? on a multicore CPU any numbers of threads could be inspecting m_firingTimers and believe its ok.. there should be a true locked access on m_firingTimers to make it thread safe.
Maybe there are no additional threads but I have 73 instances of the same crash trace and it looks wildly suspicious of a threading issue..
* APPLICATION: com.apple.WebKit.WebContent
* SIGNATURE: com.apple.GeForceMTLDriver: -[NVMTLRenderPipelineState dealloc] + 69
* MORE INFORMATION: <a href="https://crashtracer.apple.com/signature/show/52146254?app=com.apple.WebKit.WebContent&build=16A313a&users=external">https://crashtracer.apple.com/signature/show/52146254?app=com.apple.WebKit.WebContent&build=16A313a&users=external</a>
Summary of a selection of backtraces attributed to this bug. The stack frame considered to be the unique "crash signature" is highlighted ==> like this <==. This frame is used for aggregation when filing these bugs and does not necessarily imply fault.
50 libobjc.A.dylib: objc_msgSend
==> 50 GeForceMTLDriver: -[NVMTLRenderPipelineState dealloc] <==
50 QuartzCore: CA::OGL::metal_delete_state(CA::OGL::MetalPipeState*, CA::OGL::MetalPipeState*, void*)
50 QuartzCore: x_hash_table_foreach
50 QuartzCore: CA::OGL::MetalContext::purge_shaders()
50 QuartzCore: CA::OGL::MetalContext::purge(bool)
50 QuartzCore: CA::CG::Renderer::invalidate_context()
50 QuartzCore: CA::CG::IOSurfaceRenderer::~IOSurfaceRenderer()
50 QuartzCore: CA::CG::IOSurfaceRenderer::~IOSurfaceRenderer()
50 QuartzCore: CA::CG::IOSurfaceRenderer::will_suspend_callback(void*)
50 libdispatch.dylib: _dispatch_client_callout
50 libdispatch.dylib: _dispatch_barrier_sync_f_invoke
34 QuartzCore: CA::Render::post_notification(CA::Render::NotificationName, CA::Render::Object*, void*, bool)
| 34 QuartzCore: CABackingStoreCollectBlocking
| 34 WebCore: WebCore::ThreadTimers::sharedTimerFiredInternal()
| 34 WebCore: WebCore::timerFired(__CFRunLoopTimer*, void*)
| 34 CoreFoundation: __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
| 34 CoreFoundation: __CFRunLoopDoTimer
| 34 CoreFoundation: __CFRunLoopDoTimers
| 34 CoreFoundation: __CFRunLoopRun
| 34 CoreFoundation: CFRunLoopRunSpecific
| 34 HIToolbox: RunCurrentEventLoopInMode
| 34 HIToolbox: ReceiveNextEventCommon
| 34 HIToolbox: _BlockUntilNextEventMatchingListInModeWithFilter
| 34 AppKit: _DPSNextEvent
| 34 AppKit: -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
| 34 AppKit: -[NSApplication run]
| 34 AppKit: NSApplicationMain
| 34 libxpc.dylib: _xpc_objc_main
| 34 libxpc.dylib: xpc_main
| 34 com.apple.WebKit.WebContent: main
| 34 libdyld.dylib: start
16 libdispatch.dylib: _dispatch_barrier_sync_f_slow
16 QuartzCore: CA::Render::post_notification(CA::Render::NotificationName, CA::Render::Object*, void*, bool)
16 QuartzCore: CABackingStoreCollectBlocking
16 WebCore: WebCore::ThreadTimers::sharedTimerFiredInternal()
16 WebCore: WebCore::timerFired(__CFRunLoopTimer*, void*)
16 CoreFoundation: __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
16 CoreFoundation: __CFRunLoopDoTimer
16 CoreFoundation: __CFRunLoopDoTimers
16 CoreFoundation: __CFRunLoopRun
16 CoreFoundation: CFRunLoopRunSpecific
16 HIToolbox: RunCurrentEventLoopInMode
16 HIToolbox: ReceiveNextEventCommon
16 HIToolbox: _BlockUntilNextEventMatchingListInModeWithFilter
16 AppKit: _DPSNextEvent
16 AppKit: -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
16 AppKit: -[NSApplication run]
16 AppKit: NSApplicationMain
16 libxpc.dylib: _xpc_objc_main
16 libxpc.dylib: xpc_main
16 com.apple.WebKit.WebContent: main
16 libdyld.dylib: start</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>