1192067 - TSan: data race js/src/vm/ObjectGroup.h:507 ObjectGroup::generation (ObjectGroup::flags_)

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Nathan Froyd [:froydnj]]

The attached logfile shows a thread/data race detected by TSan (ThreadSanitizer).

* Specific information about this bug

We have other races on ObjectGroup::flags_ (bug 1141644, for instance); this one is similar to them.  We touch |flags_| on different threads.  This race is interesting because flags_ is getting touched by multiple helper threads simultaneously, instead of the main-thread/helper-thread races seen elsewhere.

* General information about TSan, data races, etc.

Typically, races reported by TSan are not false positives, but it is possible that the race is benign. Even in this case though, we should try to come up with a fix unless this would cause unacceptable performance issues. Also note that seemingly benign races can possibly be harmful (also depending on the compiler and the architecture) [1][2].

If the bug cannot be fixed, then this bug should be used to either make a compile-time annotation for blacklisting or add an entry to the runtime blacklist.

[1] http://software.intel.com/en-us/blogs/2013/01/06/benign-data-races-what-could-possibly-go-wrong
[2] _How to miscompile programs with "benign" data races_: https://www.usenix.org/legacy/events/hotpar11/tech/final_files/Boehm.pdf

Comment 1

[Jan de Mooij [:jandem]]

ObjectGroup::generation no longer exists post-TI-removal.