1336866 - Assertion failure: TlsContext.get()->runtime()->gc.currentThreadHasLockedGC(), at js/src/threading/ProtectedData.cpp:70

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision f8d696a34c17 (build with --enable-debug, run with --fuzzing-safe --ion-offthread-compile=off):

JSON.stringify(this);

Backtrace:

0   js-dbg-64-clang-darwin-f8d696a34c17	0x00000001010e3606 js::CheckGlobalLock<(js::GlobalLock)0, (js::AllowedBackgroundThread)0>::check() const + 102 (ProtectedData.cpp:70)
1   js-dbg-64-clang-darwin-f8d696a34c17	0x0000000101022874 js::gc::MemInfo::ZoneGCHeapGrowthFactorGetter(JSContext*, unsigned int, JS::Value*) + 276 (ProtectedData.h:108)
2   js-dbg-64-clang-darwin-f8d696a34c17	0x0000000100b4c859 js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) + 201 (jscntxtinlines.h:282)
3   js-dbg-64-clang-darwin-f8d696a34c17	0x0000000100b4c513 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) + 611 (Interpreter.cpp:460)
4   js-dbg-64-clang-darwin-f8d696a34c17	0x0000000100b4d4fa js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) + 154 (Interpreter.cpp:524)
/snip

For detailed crash information, see attachment.

This happens quite often, setting [fuzzblocker].

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d2758f635f72
user:        Brian Hackett
date:        Thu Feb 02 12:12:43 2017 -0700
summary:     Bug 1325050 - Structure reorganization for multithreaded runtimes, r=jandem,jonco,h4writer,luke,lhansen,nbp.

Brian, is bug 1325050 a likely regressor?

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b37fc0d40d06
Lock GC while getting heap growth factor in testing function, r=jonco.

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/b37fc0d40d06