1592487 - Assertion failure: CurrentThreadCanAccessRuntime(cx->runtime()), at js/src/threading/ProtectedData.cpp:65

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 25bf8e097e60 (build with --enable-debug --disable-profiling, run with --fuzzing-safe --ion-offthread-compile=off --ion-eager --gc-zeal=25,68):

try {} catch (e) {}
try {} catch (e) {}
try {
    (function() {
        (function() {});
    })
} catch (e) {}
try {
    t;
} catch (e) {}
try {} catch (e) {}
try {
    try {
        gcparam("markStackLimit", 1);
    } catch (e) {}
} catch (e) {}
try {
    (function() {
        ""(function() {});
    })
} catch (e) {}
try {
    for (t of Number) {
        (function() {
            (function() {});
        })
    }
} catch (e) {}

Backtrace:

#0  js::CheckMainThread<(js::AllowedHelperThread)0>::check (this=<optimized out>) at js/src/threading/ProtectedData.cpp:65
#1  0x000055c4d105c299 in js::ProtectedData<js::CheckMainThread<(js::AllowedHelperThread)0>, bool>::ref (this=0x7f6022c2a7c0) at js/src/threading/ProtectedData.h:140
#2  js::ProtectedData<js::CheckMainThread<(js::AllowedHelperThread)0>, bool>::operator=<bool> (this=0x7f6022c2a7c0, p=<optimized out>) at js/src/threading/ProtectedData.h:104
#3  js::GCMarker::processDelayedMarkingList (this=0x7f6022c2a728, color=(unknown: -80), budget=...) at js/src/gc/Marking.cpp:2636
#4  0x000055c4d1059db7 in js::GCMarker::markAllDelayedChildren (this=0x7f6022c2a728, budget=...) at js/src/gc/Marking.cpp:2672
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/e9b1077e6b4a
user: Yoshi Cheng-Hao Huang
date: Wed Oct 16 11:16:08 2019 +0000
summary: Bug 1564136 - Part 1: SweepMarkTask. r=jonco

Yoshi, is bug 1564136 a likely regressor?

Comment 3

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: Bug 1592487 - update 'delayedMarkingWorkAdded' and 'markLaterArenas' to MainThreadOrGCTaskData.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e1838571c234
update 'delayedMarkingWorkAdded' and 'markLaterArenas' to MainThreadOrGCTaskData. r=jonco

Comment 5

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/e1838571c234

Comment 6

[Intermittent Failures Robot]

10 failures in 4314 pushes (0.002 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 10

Platform breakdown:

• linux64: 10

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1592487&startday=2019-10-28&endday=2019-11-03&tree=all

Comment 7

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e1838571c234