<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - We probably have some races between how we validate that structures are registered and how we tell AI what structures we produce"
href="https://bugs.webkit.org/show_bug.cgi?id=164576">164576</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>We probably have some races between how we validate that structures are registered and how we tell AI what structures we produce
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>sbarati@apple.com
</td>
</tr>
<tr>
<th>CC</th>
<td>benjamin@webkit.org, fpizlo@apple.com, ggaren@apple.com, gskachkov@gmail.com, jfbastien@apple.com, keith_miller@apple.com, mark.lam@apple.com, msaboff@apple.com, oliver@apple.com, ticaiolima@gmail.com, utatane.tea@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>For example, consider two threads, the JS thread (JST), and the compiler thread (CT)
Consider this interleaving of execution:
CT: Runs structure registration phase and registers arrayStructureForIndexingTypeDuringAllocation(ArrayWithInt32)
JST: fires having a bad time
CT: We tell AI that this node results in a value with arrayStructureForIndexingTypeDuringAllocation(ArrayWithInt32) structure.
We will no longer properly verify this code. I think this is mostly an innocuous bug, since such array allocation nodes will usually watch the having a bad time node, so if it fires during the compilation, we will eventually invalidate the compilation. However, it's probably worth having a more sound story here. What I'm doing in the patch I'm writing now is always registering and telling AI that I'm producing the original allocation structure if the compilation is watching the having a bad time watchpoint. Otherwise, I register the current allocation structure. The assumption here is that the compilation will always watch the having a bad time watchpoint for this particular node if it hasn't fired. If it's already fired, then using the current allocation structure is OK. However, this probably still leaves us a window to be racy about what structure we say we're producing.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>