WIP: ~HashTableAddResult crashes in oilpan builds

Source/core/dom/NodeListsNodeData.h

Index: Source/core/dom/NodeListsNodeData.h
diff --git a/Source/core/dom/NodeListsNodeData.h b/Source/core/dom/NodeListsNodeData.h
index 66156ff8daa0d925037efad9808aedd413745fc9..174f19cbe0cd6b9f8be8150a28f8cba83324e7cd 100644
--- a/Source/core/dom/NodeListsNodeData.h
+++ b/Source/core/dom/NodeListsNodeData.h
@@ -98,17 +98,27 @@ public:
     template<typename T>
     PassRefPtrWillBeRawPtr<T> addCache(ContainerNode& node, CollectionType collectionType, const AtomicString& name)
     {
-        NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, name), nullptr);
-        if (!result.isNewEntry) {
+        RefPtrWillBeRawPtr<T> list;
+        {
+            NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(collectionType, name), nullptr);
+            if (!result.isNewEntry) {
 #if ENABLE(OILPAN)
-            return static_cast<T*>(result.storedValue->value.get());
+                return static_cast<T*>(result.storedValue->value.get());
 #else
-            return static_cast<T*>(result.storedValue->value);
+                return static_cast<T*>(result.storedValue->value);
 #endif
+            }
+
+            fprintf(stderr, "a %ld %ld %p %p\n", result.m_containerModifications, result.m_container->modifications(), result.m_container, &m_atomicNameCaches.m_impl);
+            Heap::collectAllGarbage();
+            fprintf(stderr, "b %ld %ld %p %p\n", result.m_containerModifications, result.m_container->modifications(), result.m_container, &m_atomicNameCaches.m_impl);
+            fprintf(stderr, "c\n");
+            list = T::create(node, collectionType, name);
+            fprintf(stderr, "d\n");
+            result.storedValue->value = list.get();
+            fprintf(stderr, "e\n");
         }
-
-        RefPtrWillBeRawPtr<T> list = T::create(node, collectionType, name);
-        result.storedValue->value = list.get();
+        fprintf(stderr, "f\n");

[haraken, 2014/08/13 07:54:32]

This code prints the following crash log. The crash always happens in
jquery/manipulation.html.

a 1 1 0x1f6cb1c10b88 0x1f6cb1c10b88
b 1 707406378 0x1f6cb1c10b88 0x1f6cb1c10b88
c
1 1
d
e
1 707406378
ASSERTION FAILED: m_containerModifications == m_container->modifications()
../../third_party/WebKit/Source/wtf/HashTable.h(292) :
WTF::HashTableAddResult<WTF::HashTable<std::pair<unsigned char, WTF::StringImpl
*>, WTF::KeyValuePair<std::pair<unsigned char, WTF::StringImpl *>,
blink::WeakMember<blink::LiveNodeListBase> >, WTF::KeyValuePairKeyExtractor,
blink::NodeListsNodeData::NodeListAtomicCacheMapEntryHash,
WTF::HashMapValueTraits<WTF::HashTraits<std::pair<unsigned char, WTF::StringImpl
*> >, WTF::HashTraits<blink::WeakMember<blink::LiveNodeListBase> > >,
WTF::HashTraits<std::pair<unsigned char, WTF::StringImpl *> >,
blink::HeapAllocator>, WTF::KeyValuePair<std::pair<unsigned char,
WTF::StringImpl *>, blink::WeakMember<blink::LiveNodeListBase> >
>::~HashTableAddResult() [HashTableType = WTF::HashTable<std::pair<unsigned
char, WTF::StringImpl *>, WTF::KeyValuePair<std::pair<unsigned char,
WTF::StringImpl *>, blink::WeakMember<blink::LiveNodeListBase> >,
WTF::KeyValuePairKeyExtractor,
blink::NodeListsNodeData::NodeListAtomicCacheMapEntryHash,
WTF::HashMapValueTraits<WTF::HashTraits<std::pair<unsigned char, WTF::StringImpl
*> >, WTF::HashTraits<blink::WeakMember<blink::LiveNodeListBase> > >,
WTF::HashTraits<std::pair<unsigned char, WTF::StringImpl *> >,
blink::HeapAllocator>, ValueType = WTF::KeyValuePair<std::pair<unsigned char,
WTF::StringImpl *>, blink::WeakMember<blink::LiveNodeListBase> >]

This log means the following fact:

- The hash map (i.e., m_atomicNameCaches) is already collected in
Heap::collectAllGarbage(). In other words, the AddResult doesn't keep the hash
map alive.

Do you have any idea on what's going on? If no, I can investigate more.

(FYI, if I introduce 'Persistent<NodeListAtomicNameCacheMap>
protect(m_atomicNameCaches)', the above crash goes away. However, instead I hit
the checkHeader assertion in Heap::collectAllGarbage().)

         return list.release();
     }