1285186 - Assertion failure: !waitingOnGC[i]->runtimeMatches(rt), at js/src/vm/HelperThreads.cpp:313

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 95ffbc4ff635 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --ion-offthread-compile=off --ion-eager --gc-zeal=10):

// jsfunfuzz-generated
function f() {};
// Adapted from randomly chosen testcase: js/src/jit-test/tests/auto-regress/bug1268034.js
offThreadCompileScript("");
// jsfunfuzz-generated
abortgc();


Backtrace:

0   js-dbg-64-dm-clang-darwin-95ffbc4ff635	0x000000010afdd2cb js::CancelOffThreadParses(JSRuntime*) + 1163 (HelperThreads.cpp:313)
1   js-dbg-64-dm-clang-darwin-95ffbc4ff635	0x000000010b063f5b JSRuntime::destroyRuntime() + 363 (GCRuntime.h:1380)
2   js-dbg-64-dm-clang-darwin-95ffbc4ff635	0x000000010ade5560 JSContext::~JSContext() + 32 (jscntxt.cpp:897)
3   js-dbg-64-dm-clang-darwin-95ffbc4ff635	0x000000010ade2a6a js::DestroyContext(JSContext*) + 282 (Utility.h:256)
4   js-dbg-64-dm-clang-darwin-95ffbc4ff635	0x000000010a7c5a30 main + 13392 (js.cpp:7461)
/snip

For detailed crash information, see attachment.

GC assert, setting s-s first as a start.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/eef71b01a821
user:        Jan de Mooij
date:        Mon Jul 04 19:44:26 2016 +0200
summary:     Bug 1283169 - Finish incremental GC before cancelling off-threaad parse tasks. r=jonco

Jan, is bug 1283169 a likely regressor?

Comment 3

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Patch

Another issue with CancelOffThreadParses. When we abort an incremental gc, we were not emptying the parseWaitingOnGC list.

Good catch, this is also a pre-existing issue.

Comment 5

[Jon Coppeard (:jonco)]

Comment on attachment 8769070 [details] [diff] [review]
Patch

Review of attachment 8769070 [details] [diff] [review]:
-----------------------------------------------------------------

Nice, thanks for fixing this.

Comment 6

[Jan de Mooij [:jandem]]

Try uncovered some issues, I'll look into that today or tomorrow...

Comment 7

[Jan de Mooij [:jandem]]

Attachment: Patch v2

Updated patch. This one is green on Try.

The AutoEnqueuePendingParseTasksAfterGC destructor checked !gc_.isIncrementalGCInProgress(), but I think it's better and nicer to call !OffThreadParsingMustWaitForGC, as that one also checks some other things.

Comment 8

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0fe5429f71a75ade5218d48ece9d4345ed7c08c8

Comment 9

[Andrew McCreight [:mccr8]]

This should have had a security rating (and possibly sec-approval) before landing, as per comment 4 it sounds like this is not a Nightly-only regression. How bad of a security issue is this? Thanks.

Comment 10

[Daniel Veditz [:dveditz]]

For example, do we need to get this fix on ESR-45? Jump the trains to ship with 48?

Comment 11

[Jan de Mooij [:jandem]]

(In reply to Andrew McCreight [:mccr8] from comment #9)
> This should have had a security rating (and possibly sec-approval) before
> landing, as per comment 4 it sounds like this is not a Nightly-only
> regression. How bad of a security issue is this? Thanks.

It's not a security issue on anything other than Nightly.

The "pre-existing issue" I mentioned in comment 4 is unrelated and not s-s: we didn't empty the list of "parse tasks waiting on GC" when we aborted an incremental GC, so tasks could stay in that list longer than strictly necessary.

Comment 12

[Andrew McCreight [:mccr8]]

Ah, thanks for the explanation.

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0fe5429f71a7