1340010 - Crash [@ js::gc::Cell::address] or Assertion failure: !waitingOnGC[i]->runtimeMatches(rt), at js/src/vm/HelperThreads.cpp:437

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 0a7831d838f7 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --ion-offthread-compile=off --ion-eager):

See attachment.

Backtrace:

0   js-dbg-64-dm-clang-darwin-0a7831d838f7	0x00000001039d240d js::CancelOffThreadParses(JSRuntime*) + 845 (HelperThreads.cpp:437)
1   js-dbg-64-dm-clang-darwin-0a7831d838f7	0x0000000103a21938 JSRuntime::destroyRuntime() + 232 (Runtime.cpp:286)
2   js-dbg-64-dm-clang-darwin-0a7831d838f7	0x00000001037ba536 js::DestroyContext(JSContext*) + 294 (atomic:848)
/snip

For detailed crash information, see attachment.

Setting s-s as a start because this is a gc assert, however it might just be related to the off thread parsing stuff.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Testcase

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

There are crashes [@ js::gc::Cell::address] on opt builds that eventually reduce to this assert for debug builds.

Comment 4

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/67160e6118d1
user:        Jon Coppeard
date:        Wed Feb 08 13:35:49 2017 +0000
summary:     Bug 1337450 - Simplify GC resets and aborts r=sfink

Jon, is bug 1337450 a likely regressor?

Comment 6

[Jon Coppeard (:jonco)]

Yes, bug 1337450 caused this because IsDeterministicGCReason() doesn't recognise the ABORT_GC reason I added.

This bug is only present when the engine is built with --enable-more-deterministic so it's not a security issue.

Comment 7

[Jon Coppeard (:jonco)]

Attachment: bug1340010-abort-reason

Patch to add ABORT_GC to the list of deterministic GC reasons, otherwise GCRuntime::checkIfGCAllowedInCurrentState() won't allow abort GCs to happen if deterministicgc(true) is called.

I tidied this up to make it clearer what is and is not considered deterministic.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/58594006a6fa
Make ABORT_GC a deterministic GC reason r=sfink

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9c5f58a4c7dd
Fix test bustage r=me

Comment 10

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/58594006a6fa
https://hg.mozilla.org/mozilla-central/rev/9c5f58a4c7dd