1328222 - Assertion failure: !joinable(), at js/src/threading/Thread.h:122

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The js shell crashes on mozilla-central revision 31ffcb82ced8 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --ion-pgo=o --no-baseline --no-ion) with an empty testcase.

Basically I had typed a flag incorrectly (--ion-pgo=o) and the shell threw an assertion failure.

Backtrace:

0   js-dbg-64-dm-clang-darwin-31ffcb82ced8	0x000000010fd4a77d js::ExceptionHandlerState::~ExceptionHandlerState() + 93 (Thread.h:122)
1   libsystem_c.dylib             	0x00007fffe7544178 __cxa_finalize_ranges + 332
2   libsystem_c.dylib             	0x00007fffe75444b2 exit + 55
3   js-dbg-64-dm-clang-darwin-31ffcb82ced8	0x000000010f5b9cab start + 59
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a70dda2a48b4
user:        Emanuel Hoogeveen
date:        Wed Sep 28 21:09:00 2016 +0200
summary:     Bug 1305360 - Part 2: Add an exception handler to annotate memory protection crashes in regions of interest. r=jandem r=luke

Emanuel, is bug 1305360 a likely regressor?

Comment 3

[Emanuel Hoogeveen [:ehoogeveen]]

Heh, interesting find! I guess the problem is that if something in the shell initialization fails after [1] we just return, but the exception handler is expecting to be uninstalled. I can add a destructor for ExceptionHandlerState that runs in case we didn't uninstall the handler before that point.

[1] https://dxr.mozilla.org/mozilla-central/source/js/src/shell/js.cpp#7870

Comment 4

[Emanuel Hoogeveen [:ehoogeveen]]

Attachment: Ensure that the exception handler thread on OSX is terminated before we quit.

This should do the trick. Gary, can you confirm this works?

Comment 5

[Emanuel Hoogeveen [:ehoogeveen]]

52 should be unaffected because we unconditionally disable the exception handler there.

Comment 6

[Emanuel Hoogeveen [:ehoogeveen]]

Green on try aside from some pre-existing arm simulator bustage: https://treeherder.mozilla.org/#/jobs?repo=try&revision=5d5446fcfa629710f194e6bcce99f25df3ba2a3e

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/91575284650d
Ensure that the exception handler thread on OSX is terminated before we quit. r=jandem

Comment 8

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/91575284650d

Comment 9

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/91575284650d
user:        Emanuel Hoogeveen
date:        Tue Jan 03 02:14:00 2017 +0100
summary:     Bug 1328222 - Ensure that the exception handler thread on OSX is terminated before we quit. r=jandem

Yes, I verified that m-c rev 91575284650d does fix this!