1562437 - LeakSanitizer: [@ js::Mutex::heldMutexStack]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 900a0b127043 (build with --enable-debug --enable-more-deterministic --enable-address-sanitizer, run with --fuzzing-safe --no-threads --no-baseline --no-ion and the environment variable ASAN_OPTIONS=detect_leaks=1 LSAN_OPTIONS=max_leaks=1):

x = timeout(1);

Backtrace:

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0xaaaae6c88d33 in malloc (/home/ubuntu/shell-cache/js-dbg-64-dm-asan-linux-aarch64-900a0b127043/js-dbg-64-dm-asan-linux-aarch64-900a0b127043+0xb39d33)
    #1 0xaaaae80882eb in js_arena_malloc(unsigned long, unsigned long) /home/ubuntu/shell-cache/js-dbg-64-dm-asan-linux-aarch64-900a0b127043/objdir-js/dist/include/js/Utility.h:393:10
    #2 0xaaaae80882eb in js_malloc(unsigned long) /home/ubuntu/shell-cache/js-dbg-64-dm-asan-linux-aarch64-900a0b127043/objdir-js/dist/include/js/Utility.h:397
    #3 0xaaaae80882eb in mozilla::Vector<js::Mutex const*, 0ul, mozilla::MallocAllocPolicy>* js_new<mozilla::Vector<js::Mutex const*, 0ul, mozilla::MallocAllocPolicy>>() /home/ubuntu/shell-cache/js-dbg-64-dm-asan-linux-aarch64-900a0b127043/objdir-js/dist/include/js/Utility.h:546
    #4 0xaaaae80882eb in js::Mutex::heldMutexStack() js/src/threading/Mutex.cpp:31
    #5 0xaaaae8088757 in js::Mutex::lock() js/src/threading/Mutex.cpp:41:17
    #6 0xaaaae6d4836f in js::LockGuard<js::Mutex>::LockGuard(js::Mutex&) js/src/threading/LockGuard.h:22:57
    #7 0xaaaae6d4836f in WatchdogMain(JSContext*) js/src/shell/js.cpp:4266
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to skipped revisions, the first bad revision could be any of:
changeset: https://hg.mozilla.org/mozilla-central/rev/32aab5bf983a
parent: 453862:cd696bc79dff
user: Emanuel Hoogeveen
date: Sat Dec 15 14:26:00 2018 +0200
summary: Bug 1502733 - Part 1: Clean up and refactor GC system memory allocation functions. r=sfink

changeset: https://hg.mozilla.org/mozilla-central/rev/ac29aabfda36
user: Emanuel Hoogeveen
date: Sun Jan 13 23:10:00 2019 +0200
summary: Bug 1502733 - Part 2: Allocate at randomly chosen aligned addresses on 64-bit platforms. r=sfink

Emanuel/Steve/Paul, is bug 1502733 a likely regressor?

Comment 3

[Nicolas B. Pierron [:nbp]]

My understanding is that this might be a shell-only issue which is leaking the thread-local HeldMutexStack by not calling js::Mutex::ShutDown on shutdown of the Watchdog thread of the JS shell.

Comment 4

[Paul Bone [:pbone]]

(In reply to Nicolas B. Pierron [:nbp] from comment #3)

My understanding is that this might be a shell-only issue which is leaking the thread-local HeldMutexStack by not calling js::Mutex::ShutDown on shutdown of the Watchdog thread of the JS shell.

You're exactly right.

Comment 5

[Paul Bone [:pbone]]

Attachment: Bug 1562437 - Call Mutex::Shutdown when the watchdog thread exits r=nbp

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2ab78a0e3a04
Call Mutex::Shutdown when the watchdog thread exits r=nbp

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/2ab78a0e3a04