Closed Bug 1533526 Opened 6 years ago Closed 4 years ago

Data race on _pr_fd_cache.head

Categories

(NSPR :: NSPR, defect, P3)

Product:
NSPR
Component:
NSPR
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED WORKSFORME

People

(Reporter: ytausky, Unassigned)

References

(Blocks 1 open bug)

Details

I got the following report:

WARNING: ThreadSanitizer: data race (pid=65550)
  Read of size 8 at 0x000103872f00 by thread T36:
    #0 _PR_Getfd prfdcach.c:66 (libnss3.dylib:x86_64+0x1deb2b)
    #1 PR_OpenFile ptio.c:3404 (libnss3.dylib:x86_64+0x215b3d)
    #2 PR_Open ptio.c:3690 (libnss3.dylib:x86_64+0x215c99)
    #3 nsLocalFile::OpenNSPRFileDesc(int, int, PRFileDesc**) nsLocalFileUnix.cpp:394 (XUL:x86_64+0x1219e1)
    #4 mozilla::ReadIntoArray(nsIFile*, nsTArray<unsigned char>&, unsigned long) GMPUtils.cpp:96 (XUL:x86_64+0x46edb69)
    #5 mozilla::ReadIntoString(nsIFile*, nsTString<char>&, unsigned long) GMPUtils.cpp:117 (XUL:x86_64+0x46edd8f)
    #6 mozilla::gmp::GMPParent::ReadChromiumManifestFile(nsIFile*) GMPParent.cpp:655 (XUL:x86_64+0x46a3b69)
    #7 mozilla::gmp::GMPParent::ReadGMPMetaData() GMPParent.cpp:587 (XUL:x86_64+0x469f38c)
    #8 mozilla::gmp::GMPParent::Init(mozilla::gmp::GeckoMediaPluginServiceParent*, nsIFile*) GMPParent.cpp:130 (XUL:x86_64+0x469ec30)
    #9 mozilla::gmp::GeckoMediaPluginServiceParent::AddOnGMPThread(nsTString<char16_t>) GMPServiceParent.cpp:849 (XUL:x86_64+0x46decfd)
    #10 mozilla::detail::ProxyRunnable<mozilla::MozPromise<bool, nsresult, true>, RefPtr<mozilla::MozPromise<bool, nsresult, true> > (mozilla::gmp::GeckoMediaPluginServiceParent::*)(nsTString<char16_t>), mozilla::gmp::GeckoMediaPluginServiceParent, StoreCopyPassByRRef<nsTString<char16_t> > >::Run() nsThreadUtils.h:1122 (XUL:x86_64+0x470afa4)
    #11 mozilla::EventTargetWrapper::Runner::Run() AbstractThread.cpp:113 (XUL:x86_64+0x1bf25e)
    #12 nsThread::ProcessNextEvent(bool, bool*) nsThread.cpp:1179 (XUL:x86_64+0x1e1c38)
    #13 NS_ProcessNextEvent(nsIThread*, bool) nsThreadUtils.cpp:482 (XUL:x86_64+0x1e7842)
    #14 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) MessagePump.cpp:303 (XUL:x86_64+0xbe88bf)
    #15 MessageLoop::RunInternal() message_loop.cc:315 (XUL:x86_64+0xb54d5d)
    #16 MessageLoop::Run() message_loop.cc:308 (XUL:x86_64+0xb54c08)
    #17 nsThread::ThreadFunc(void*) nsThread.cpp:454 (XUL:x86_64+0x1dccff)
    #18 _pt_root ptthread.c:201 (libnss3.dylib:x86_64+0x22280c)

  Previous write of size 8 at 0x000103872f00 by main thread (mutexes: write M345):
    #0 _PR_Getfd prfdcach.c:80 (libnss3.dylib:x86_64+0x1ded2f)
    #1 PR_OpenFile ptio.c:3404 (libnss3.dylib:x86_64+0x215b3d)
    #2 PR_Open ptio.c:3690 (libnss3.dylib:x86_64+0x215c99)
    #3 nsLocalFile::OpenNSPRFileDesc(int, int, PRFileDesc**) nsLocalFileUnix.cpp:394 (XUL:x86_64+0x1219e1)
    #4 mozilla::loader::AutoMemMap::init(nsIFile*, int, int, PRFileMapProtect) AutoMemMap.cpp:36 (XUL:x86_64+0x1320381)
    #5 mozJSComponentLoader::ObjectForLocation(ComponentLoaderInfo&, nsIFile*, JS::MutableHandle<JSObject*>, JS::MutableHandle<JSScript*>, char**, bool, JS::MutableHandle<JS::Value>) mozJSComponentLoader.cpp:853 (XUL:x86_64+0x1316e26)
    #6 mozJSComponentLoader::Import(JSContext*, nsTSubstring<char> const&, JS::MutableHandle<JSObject*>, JS::MutableHandle<JSObject*>, bool) mozJSComponentLoader.cpp:1331 (XUL:x86_64+0x131cf1e)
    #7 mozilla::dom::ChromeUtils::Import(mozilla::dom::GlobalObject const&, nsTSubstring<char16_t> const&, mozilla::dom::Optional<JS::Handle<JSObject*> > const&, JS::MutableHandle<JSObject*>, mozilla::ErrorResult&) ChromeUtils.cpp:420 (XUL:x86_64+0x21815f5)
    #8 mozilla::dom::ChromeUtils_Binding::import(JSContext*, unsigned int, JS::Value*) ChromeUtilsBinding.cpp:5642 (XUL:x86_64+0x2f7d66d)
    #9 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) Interpreter.cpp:440 (XUL:x86_64+0x7b3a834)
    #10 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:532 (XUL:x86_64+0x7b39d9c)
    #11 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #12 js::CallFromStack(JSContext*, JS::CallArgs const&) Interpreter.cpp:591 (XUL:x86_64+0x7b3afb0)
    #13 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) BaselineIC.cpp:3881 (XUL:x86_64+0x875ec18)
    #14 <null> <null> (0x00011e698403)
    #15 Interpret(JSContext*, js::RunState&) Interpreter.cpp:1980 (XUL:x86_64+0x7b1fcee)
    #16 js::RunScript(JSContext*, js::RunState&) Interpreter.cpp:420 (XUL:x86_64+0x7b1e259)
    #17 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:560 (XUL:x86_64+0x7b39d66)
    #18 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #19 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) Interpreter.cpp:603 (XUL:x86_64+0x7b3b494)
    #20 JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) jsapi.cpp:2560 (XUL:x86_64+0x83232ed)
    #21 nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) XPCWrappedJSClass.cpp:993 (XUL:x86_64+0x13ccaba)
    #22 nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) XPCWrappedJS.cpp:611 (XUL:x86_64+0x13cb6e3)
    #23 PrepareAndDispatch xptcstubs_x86_64_darwin.cpp:129 (XUL:x86_64+0x2132b9)
    #24 SharedStub <null>:2670320 (XUL:x86_64+0x211dba)
    #25 XREMain::XRE_mainRun() nsAppRunner.cpp:4364 (XUL:x86_64+0x7990d65)
    #26 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) nsAppRunner.cpp:4682 (XUL:x86_64+0x799326d)
    #27 XRE_main(int, char**, mozilla::BootstrapConfig const&) nsAppRunner.cpp:4766 (XUL:x86_64+0x7993c62)
    #28 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) Bootstrap.cpp:39 (XUL:x86_64+0x79a7bb7)
    #29 main nsBrowserApp.cpp:214 (firefox:x86_64+0x100001b63)

  Location is global '_pr_fd_cache.2' at 0x000103872f00 (libnss3.dylib+0x0000003d2f00)

  Mutex M345 (0x7b3000001f80) created at:
    #0 pthread_mutex_init tsan_interceptors.cc:1184 (libclang_rt.tsan_osx_dynamic.dylib:x86_64h+0xa303)
    #1 PR_NewLock ptsynch.c:139 (libnss3.dylib:x86_64+0x204eee)
    #2 _PR_InitFdCache prfdcach.c:208 (libnss3.dylib:x86_64+0x1df689)
    #3 _PR_InitIO ptio.c:1138 (libnss3.dylib:x86_64+0x214e5d)
    #4 _PR_ImplicitInitialization prinit.c:202 (libnss3.dylib:x86_64+0x1f76bf)
    #5 PR_NewThreadPrivateIndex prtpd.c:103 (libnss3.dylib:x86_64+0x224754)
    #6 NS_LogInit nsTraceRefcnt.cpp:1182 (XUL:x86_64+0xdb72a)
    #7 mozilla::BootstrapImpl::NS_LogInit() Bootstrap.cpp:24 (XUL:x86_64+0x79a7b01)
    #8 main nsBrowserApp.cpp:231 (firefox:x86_64+0x100001773)

  Thread T36 (tid=1567009, running) created by main thread at:
    #0 pthread_create tsan_interceptors.cc:965 (libclang_rt.tsan_osx_dynamic.dylib:x86_64h+0x931d)
    #1 _PR_CreateThread ptthread.c:433 (libnss3.dylib:x86_64+0x21befe)
    #2 PR_CreateThread ptthread.c:518 (libnss3.dylib:x86_64+0x20e237)
    #3 nsThread::Init(nsTSubstring<char> const&) nsThread.cpp:660 (XUL:x86_64+0x1de6b5)
    #4 nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) nsThreadManager.cpp:416 (XUL:x86_64+0x1e67eb)
    #5 NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) nsThreadUtils.cpp:135 (XUL:x86_64+0x1ea7bf)
    #6 mozilla::gmp::GeckoMediaPluginService::GetThread(nsIThread**) nsThreadUtils.h:71 (XUL:x86_64+0x46cfa73)
    #7 mozilla::gmp::GeckoMediaPluginService::Init() GMPService.cpp:217 (XUL:x86_64+0x46ce32b)
    #8 mozilla::gmp::GeckoMediaPluginServiceParent::InitStorage() GMPServiceParent.cpp:244 (XUL:x86_64+0x46d8693)
    #9 mozilla::gmp::GeckoMediaPluginServiceParent::Init() GMPServiceParent.cpp:124 (XUL:x86_64+0x46d7b75)
    #10 mozilla::gmp::GMPServiceCreateHelper::GetOrCreateOnMainThread() GMPService.cpp:103 (XUL:x86_64+0x46f6e24)
    #11 mozilla::gmp::GMPServiceCreateHelper::GetOrCreate() GMPService.cpp:76 (XUL:x86_64+0x46ccd7c)
    #12 mozilla::gmp::GeckoMediaPluginService::GetGeckoMediaPluginService() GMPService.cpp:130 (XUL:x86_64+0x46ccd29)
    #13 mozilla::xpcom::CreateInstanceImpl(mozilla::xpcom::ModuleID, nsISupports*, nsID const&, void**) StaticComponents.cpp:10169 (XUL:x86_64+0x18a6c3)
    #14 mozilla::xpcom::StaticModule::CreateInstance(nsISupports*, nsID const&, void**) const StaticComponents.cpp:10492 (XUL:x86_64+0x1845c2)
    #15 nsComponentManagerImpl::GetServiceLocked((anonymous namespace)::MutexLock&, (anonymous namespace)::EntryWrapper&, nsID const&, void**) nsComponentManager.cpp:220 (XUL:x86_64+0x19ed9d)
    #16 nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) nsComponentManager.cpp:1587 (XUL:x86_64+0x198e6a)
    #17 CallGetService(char const*, nsID const&, void**) nsComponentManagerUtils.cpp:61 (XUL:x86_64+0x1a3af1)
    #18 xpc::CIGSHelper(JSContext*, unsigned int, JS::Value*, bool) XPCJSID.cpp:512 (XUL:x86_64+0x13ab17a)
    #19 xpc::CID_GetService(JSContext*, unsigned int, JS::Value*) XPCJSID.cpp:537 (XUL:x86_64+0x13aaa8e)
    #20 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) Interpreter.cpp:440 (XUL:x86_64+0x7b3a834)
    #21 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:532 (XUL:x86_64+0x7b39d9c)
    #22 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #23 Interpret(JSContext*, js::RunState&) Interpreter.cpp:591 (XUL:x86_64+0x7b2ad78)
    #24 js::RunScript(JSContext*, js::RunState&) Interpreter.cpp:420 (XUL:x86_64+0x7b1e259)
    #25 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:560 (XUL:x86_64+0x7b39d66)
    #26 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #27 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) Interpreter.cpp:603 (XUL:x86_64+0x7b3b494)
    #28 js::fun_call(JSContext*, unsigned int, JS::Value*) JSFunction.cpp:1142 (XUL:x86_64+0x7e957af)
    #29 js::fun_apply(JSContext*, unsigned int, JS::Value*) JSFunction.cpp:1162 (XUL:x86_64+0x7e96285)
    #30 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) Interpreter.cpp:440 (XUL:x86_64+0x7b3a834)
    #31 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:532 (XUL:x86_64+0x7b39d9c)
    #32 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #33 js::CallFromStack(JSContext*, JS::CallArgs const&) Interpreter.cpp:591 (XUL:x86_64+0x7b3afb0)
    #34 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) BaselineIC.cpp:3881 (XUL:x86_64+0x875ec18)
    #35 <null> <null> (0x00011e698403)
    #36 js::RunScript(JSContext*, js::RunState&) Interpreter.cpp:405 (XUL:x86_64+0x7b1e202)
    #37 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:560 (XUL:x86_64+0x7b39d66)
    #38 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #39 js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) Interpreter.cpp:603 (XUL:x86_64+0x7b3c9e4)
    #40 bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::Shape*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) NativeObject.cpp:2240 (XUL:x86_64+0x7f41a8a)
    #41 js::NativeGetExistingProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<js::NativeObject*>, JS::Handle<js::Shape*>, JS::MutableHandle<JS::Value>) NativeObject.cpp:2302 (XUL:x86_64+0x7f413b1)
    #42 bool js::FetchName<(js::GetNameMode)0>(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<js::PropertyName*>, JS::Handle<JS::PropertyResult>, JS::MutableHandle<JS::Value>) Interpreter-inl.h:205 (XUL:x86_64+0x7b1d0d7)
    #43 bool js::GetEnvironmentName<(js::GetNameMode)0>(JSContext*, JS::Handle<JSObject*>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) Interpreter-inl.h:256 (XUL:x86_64+0x7b56f56)
    #44 Interpret(JSContext*, js::RunState&) Interpreter.cpp:241 (XUL:x86_64+0x7b2c969)
    #45 js::RunScript(JSContext*, js::RunState&) Interpreter.cpp:420 (XUL:x86_64+0x7b1e259)
    #46 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:560 (XUL:x86_64+0x7b39d66)
    #47 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #48 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) Interpreter.cpp:603 (XUL:x86_64+0x7b3b494)
    #49 js::fun_apply(JSContext*, unsigned int, JS::Value*) JSFunction.cpp:1211 (XUL:x86_64+0x7e96542)
    #50 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) Interpreter.cpp:440 (XUL:x86_64+0x7b3a834)
    #51 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:532 (XUL:x86_64+0x7b39d9c)
    #52 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #53 Interpret(JSContext*, js::RunState&) Interpreter.cpp:591 (XUL:x86_64+0x7b2ad78)
    #54 js::RunScript(JSContext*, js::RunState&) Interpreter.cpp:420 (XUL:x86_64+0x7b1e259)
    #55 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:560 (XUL:x86_64+0x7b39d66)
    #56 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #57 js::CallFromStack(JSContext*, JS::CallArgs const&) Interpreter.cpp:591 (XUL:x86_64+0x7b3afb0)
    #58 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) BaselineIC.cpp:3881 (XUL:x86_64+0x875ec18)
    #59 <null> <null> (0x00011e698403)
    #60 Interpret(JSContext*, js::RunState&) Interpreter.cpp:1980 (XUL:x86_64+0x7b1fcee)
    #61 js::RunScript(JSContext*, js::RunState&) Interpreter.cpp:420 (XUL:x86_64+0x7b1e259)
    #62 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) Interpreter.cpp:560 (XUL:x86_64+0x7b39d66)
    #63 InternalCall(JSContext*, js::AnyInvokeArgs const&) Interpreter.cpp:587 (XUL:x86_64+0x7b3b147)
    #64 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) Interpreter.cpp:603 (XUL:x86_64+0x7b3b494)
    #65 JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) jsapi.cpp:2560 (XUL:x86_64+0x83232ed)
    #66 nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) XPCWrappedJSClass.cpp:993 (XUL:x86_64+0x13ccaba)
    #67 nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) XPCWrappedJS.cpp:611 (XUL:x86_64+0x13cb6e3)
    #68 PrepareAndDispatch xptcstubs_x86_64_darwin.cpp:129 (XUL:x86_64+0x2132b9)
    #69 SharedStub <null>:2670400 (XUL:x86_64+0x211dba)
    #70 XREMain::XRE_mainRun() nsAppRunner.cpp:4364 (XUL:x86_64+0x7990d65)
    #71 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) nsAppRunner.cpp:4682 (XUL:x86_64+0x799326d)
    #72 XRE_main(int, char**, mozilla::BootstrapConfig const&) nsAppRunner.cpp:4766 (XUL:x86_64+0x7993c62)
    #73 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) Bootstrap.cpp:39 (XUL:x86_64+0x79a7bb7)
    #74 main nsBrowserApp.cpp:214 (firefox:x86_64+0x100001b63)

SUMMARY: ThreadSanitizer: data race prfdcach.c:66 in _PR_Getfd

_pr_fd_cache.head is first read from without locking the associated mutex, so the read doesn't synchronize with the locked write that comes later in that function.

Probably related to bug 1519320

Priority: -- → P3
See Also: → 1519320

It looks like this stack is covered in mochitests, but tsan has not run into this stack, so I'm going to assume this isn't an issue anymore.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.