Closed Bug 1328222 Opened 7 years ago Closed 7 years ago

Assertion failure: !joinable(), at js/src/threading/Thread.h:122

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla53
Tracking Status
firefox52 --- unaffected
firefox53 --- fixed

People

(Reporter: gkw, Assigned: ehoogeveen)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:ignore])

Attachments

(2 files)

The js shell crashes on mozilla-central revision 31ffcb82ced8 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --ion-pgo=o --no-baseline --no-ion) with an empty testcase.

Basically I had typed a flag incorrectly (--ion-pgo=o) and the shell threw an assertion failure.

Backtrace:

0   js-dbg-64-dm-clang-darwin-31ffcb82ced8	0x000000010fd4a77d js::ExceptionHandlerState::~ExceptionHandlerState() + 93 (Thread.h:122)
1   libsystem_c.dylib             	0x00007fffe7544178 __cxa_finalize_ranges + 332
2   libsystem_c.dylib             	0x00007fffe75444b2 exit + 55
3   js-dbg-64-dm-clang-darwin-31ffcb82ced8	0x000000010f5b9cab start + 59
/snip

For detailed crash information, see attachment.
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a70dda2a48b4
user:        Emanuel Hoogeveen
date:        Wed Sep 28 21:09:00 2016 +0200
summary:     Bug 1305360 - Part 2: Add an exception handler to annotate memory protection crashes in regions of interest. r=jandem r=luke

Emanuel, is bug 1305360 a likely regressor?
Blocks: 1305360
Flags: needinfo?(emanuel.hoogeveen)
Heh, interesting find! I guess the problem is that if something in the shell initialization fails after [1] we just return, but the exception handler is expecting to be uninstalled. I can add a destructor for ExceptionHandlerState that runs in case we didn't uninstall the handler before that point.

[1] https://dxr.mozilla.org/mozilla-central/source/js/src/shell/js.cpp#7870
Flags: needinfo?(emanuel.hoogeveen)
This should do the trick. Gary, can you confirm this works?
Assignee: nobody → emanuel.hoogeveen
Status: NEW → ASSIGNED
Flags: needinfo?(gary)
Attachment #8823209 - Flags: review?(jdemooij)
Attachment #8823209 - Flags: review?(jdemooij) → review+
52 should be unaffected because we unconditionally disable the exception handler there.
Green on try aside from some pre-existing arm simulator bustage: https://treeherder.mozilla.org/#/jobs?repo=try&revision=5d5446fcfa629710f194e6bcce99f25df3ba2a3e
Keywords: checkin-needed
Pushed by cbook@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/91575284650d
Ensure that the exception handler thread on OSX is terminated before we quit. r=jandem
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/91575284650d
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/91575284650d
user:        Emanuel Hoogeveen
date:        Tue Jan 03 02:14:00 2017 +0100
summary:     Bug 1328222 - Ensure that the exception handler thread on OSX is terminated before we quit. r=jandem

Yes, I verified that m-c rev 91575284650d does fix this!
Status: RESOLVED → VERIFIED
Flags: needinfo?(gary)
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: