1263218 - OOMTest can race with background threads

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

I'm hitting this with a local (testing) patch. 

In OOMTest, the code looks like this:

    HelperThreadState().waitForAllThreads();
    ...
    do {
        ...
        js::oom::SimulateOOMAfter(allocation, thread, false);
        ...
        JS_CallFunction(...);
        ...
    } while (handledOOM);

JS_CallFunction can end up starting new background jobs, and the next loop iteration SimulateOOMAfter will modify oom::maxAllocations. This can race when the background thread is in an AutoEnterOOMUnsafeRegion section (we will fail the assert in ~AutoEnterOOMUnsafeRegion).

Comment 1

[Jan de Mooij [:jandem]]

Adding a call to waitForAllThreads after JS_CallFunction seems to fix this for me, but not sure if that's the best fix.

Comment 2

[Jon Coppeard (:jonco)]

Nice catch.  This could be what's causing bug 1235677.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: bug1263218-oom-test-race

This mainly waits for the helper threads in ResetSimulatedOOM if we were simulating OOM on a background thread.  I tested that this didn't noticeably slow down the tests.

Comment 4

[Terrence Cole [:terrence]]

Comment on attachment 8740067 [details] [diff] [review]
bug1263218-oom-test-race

Review of attachment 8740067 [details] [diff] [review]:
-----------------------------------------------------------------

Great find!

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fd676a6ad20b

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/fd676a6ad20b