WIP: ~HashTableAddResult crashes in oilpan builds

Source/core/dom/NodeListsNodeData.h

 /*
  * Copyright (C) 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 David Smith <catfish.man@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 80 matching lines @@
     // Oilpan: keep a weak reference to the collection objects.
     // Explicit object unregistration in a non-Oilpan setting
     // on object destruction is replaced by the garbage collector
     // clearing out their weak reference.
     typedef WillBeHeapHashMap<std::pair<unsigned char, StringImpl*>, RawPtrWillBeWeakMember<LiveNodeListBase>, NodeListAtomicCacheMapEntryHash> NodeListAtomicNameCacheMap;
     typedef WillBeHeapHashMap<QualifiedName, RawPtrWillBeWeakMember<TagCollection> > TagCollectionCacheNS;
 
     template<typename T>
     PassRefPtrWillBeRawPtr<T> addCache(ContainerNode& node, CollectionType collectionType, const AtomicString& name)
     {
-        NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, name), nullptr);
-        if (!result.isNewEntry) {
+        RefPtrWillBeRawPtr<T> list;
+        {
+            NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, name), nullptr);
+            if (!result.isNewEntry) {
 #if ENABLE(OILPAN)
-            return static_cast<T*>(result.storedValue->value.get());
+                return static_cast<T*>(result.storedValue->value.get());
 #else
-            return static_cast<T*>(result.storedValue->value);
+                return static_cast<T*>(result.storedValue->value);
 #endif
+            }
+
+            fprintf(stderr, "a %ld %ld %p %p\n", result.m_containerModifications, result.m_container->modifications(), result.m_container, &m_atomicNameCaches.m_impl);
+            Heap::collectAllGarbage();
+            fprintf(stderr, "b %ld %ld %p %p\n", result.m_containerModifications, result.m_container->modifications(), result.m_container, &m_atomicNameCaches.m_impl);
+            fprintf(stderr, "c\n");
+            list = T::create(node, collectionType, name);
+            fprintf(stderr, "d\n");
+            result.storedValue->value = list.get();
+            fprintf(stderr, "e\n");
         }
-
-        RefPtrWillBeRawPtr<T> list = T::create(node, collectionType, name);
-        result.storedValue->value = list.get();
+        fprintf(stderr, "f\n");

[haraken, 2014/08/13 07:54:32]

This code prints the following crash log. The crash always happens in
jquery/manipulation.html.

a 1 1 0x1f6cb1c10b88 0x1f6cb1c10b88
b 1 707406378 0x1f6cb1c10b88 0x1f6cb1c10b88
c
1 1
d
e
1 707406378
ASSERTION FAILED: m_containerModifications == m_container->modifications()
../../third_party/WebKit/Source/wtf/HashTable.h(292) :
WTF::HashTableAddResult<WTF::HashTable<std::pair<unsigned char, WTF::StringImpl
*>, WTF::KeyValuePair<std::pair<unsigned char, WTF::StringImpl *>,
blink::WeakMember<blink::LiveNodeListBase> >, WTF::KeyValuePairKeyExtractor,
blink::NodeListsNodeData::NodeListAtomicCacheMapEntryHash,
WTF::HashMapValueTraits<WTF::HashTraits<std::pair<unsigned char, WTF::StringImpl
*> >, WTF::HashTraits<blink::WeakMember<blink::LiveNodeListBase> > >,
WTF::HashTraits<std::pair<unsigned char, WTF::StringImpl *> >,
blink::HeapAllocator>, WTF::KeyValuePair<std::pair<unsigned char,
WTF::StringImpl *>, blink::WeakMember<blink::LiveNodeListBase> >
>::~HashTableAddResult() [HashTableType = WTF::HashTable<std::pair<unsigned
char, WTF::StringImpl *>, WTF::KeyValuePair<std::pair<unsigned char,
WTF::StringImpl *>, blink::WeakMember<blink::LiveNodeListBase> >,
WTF::KeyValuePairKeyExtractor,
blink::NodeListsNodeData::NodeListAtomicCacheMapEntryHash,
WTF::HashMapValueTraits<WTF::HashTraits<std::pair<unsigned char, WTF::StringImpl
*> >, WTF::HashTraits<blink::WeakMember<blink::LiveNodeListBase> > >,
WTF::HashTraits<std::pair<unsigned char, WTF::StringImpl *> >,
blink::HeapAllocator>, ValueType = WTF::KeyValuePair<std::pair<unsigned char,
WTF::StringImpl *>, blink::WeakMember<blink::LiveNodeListBase> >]

This log means the following fact:

- The hash map (i.e., m_atomicNameCaches) is already collected in
Heap::collectAllGarbage(). In other words, the AddResult doesn't keep the hash
map alive.

Do you have any idea on what's going on? If no, I can investigate more.

(FYI, if I introduce 'Persistent<NodeListAtomicNameCacheMap>
protect(m_atomicNameCaches)', the above crash goes away. However, instead I hit
the checkHeader assertion in Heap::collectAllGarbage().)

         return list.release();
     }
 
     template<typename T>
     PassRefPtrWillBeRawPtr<T> addCache(ContainerNode& node, CollectionType collectionType)
     {
         NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, starAtom), nullptr);
         if (!result.isNewEntry) {
 #if ENABLE(OILPAN)
             return static_cast<T*>(result.storedValue->value.get());
@@ skipping 136 matching lines @@
 template <typename Collection>
 inline Collection* ContainerNode::cachedCollection(CollectionType type)
 {
     NodeListsNodeData* nodeLists = this->nodeLists();
     return nodeLists ? nodeLists->cached<Collection>(type) : 0;
 }
 
 } // namespace blink
 
 #endif // NodeListsNodeData_h