NIO-ELT-0-#5 EXC_BAD_ACCESS Crashes when working with multiple JSContexts

[maartene]

NIO-ELT-0-#5 EXC_BAD_ACCESS Crashes when working with multiple JSContexts

[SusanDoggie]

Have you any example that reproduce the problem?

[SusanDoggie]

I have google the error message. It seems that it is caused by the caller itself.

here is a example
vapor/fluent#487

you can store the JSContext with thread local variable.

[maartene]

Hi Susan,

Thank you for your response.

I've attached a sample program. After build & run, call the 'ink' example page a couple of times (i.e. curl localhost:8081/ink). Eventually the application crashes. See also the attached screengrab (video).

I assume one reason for these crashes is the Vapor frameworks' inherent multithreaded/async architecture. The issue does not seem to happen when using the regular JavaScriptCore classes. Perhaps because the Swift wrapper in there is 'safer' than the C-function calls that use opaque pointers?

Thread Sanitizer did not provide any errors/warnings.
When running with Address Sanitizer turned on, I can't replicate the behavior.

Thanks again.

Cheers!

Maarten

https://user-images.githubusercontent.com/5150271/103753138-f2e63400-500a-11eb-91fc-5d47ad08dc3a.mp4
VaporInk.zip

[SusanDoggie]

The global variable var stories = [InkStory]() in route.swift is the code causing the error.

swift array is not safe for mutation with multi-thread. That would destroy the array’s internal structure.

[maartene]

That's a plausible explanation. I've tried without the array and with just a local variable in the closure:
`
app.get("ink") { req -> String in

    let inkStory: InkStory = {
        let story = InkStory()
        let storyJson = story.inkStoryJson(fileName: "Data/story.ink", fileExtension: "json")
        story.loadStory(json: storyJson)
        return story
    }()
            
    var result = inkStory.currentText + "\n"
    while inkStory.canContinue {
        result += inkStory.continueStory() + "\n"
        print(inkStory.currentTags)
        print(inkStory.options)
    }
    
    return result
}

`

Unfortunately, this also crashes. Tyically in JSVirtualMachine.swift line 47 JSContextGroupRelease(group).

See also this movie:

Schermopname.2021-01-06.om.13.33.11.mp4

[SusanDoggie]

It’s seems to be bugs of JSC. I have test your code in my computer, and the execution isn’t in parallel.

I will try more tests later.

[SusanDoggie]

I minimize the app for testing first.
VaporInk.zip

you can also ask for help in apple’s forum. That may help to fix the bug if that’s the bug of JSC.
https://developer.apple.com/forums/tags/javascriptcore/

[maartene]

I submitted bug https://bugs.webkit.org/show_bug.cgi?id=220458 in the WebKit JavaScriptCore bug tracking system. I used your minimal project as an example.

[SusanDoggie]

bug has been fixed
076bbf0

it's no need to release the property name.

[maartene]

Cool! Just tested this and it works. Thanks for the fix!