1645710 - Intermittent SUMMARY: ThreadSanitizer: data race /builds/worker/checkouts/gecko/js/src/gc/Cell.h:122:37 in isForwarded

Reporter

Description

•

4 years ago

treeherder

Filed by: ncsoregi [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=306305475&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/NNF_S124Tf2H-clZA1_iCw/runs/0/artifacts/public/logs/live_backing.log

[task 2020-06-14T21:59:24.027Z] 21:59:24 [task 2020-06-14T21:59:24.028Z] 21:59:24 [task 2020-06-14T21:59:24.028Z] 21:59:24 [task 2020-06-14T21:59:24.029Z] 21:59:24 [task 2020-06-14T21:59:24.030Z] 21:59:24 [task 2020-06-14T21:59:24.031Z] 21:59:24 [task 2020-06-14T21:59:24.031Z] 21:59:24 [task 2020-06-14T21:59:24.032Z] 21:59:24 [task 2020-06-14T21:59:24.033Z] 21:59:24 [task 2020-06-14T21:59:24.034Z] 21:59:24 [task 2020-06-14T21:59:24.035Z] 21:59:24 [task 2020-06-14T21:59:24.035Z] 21:59:24 [task 2020-06-14T21:59:24.037Z] 21:59:24 [task 2020-06-14T21:59:24.037Z] 21:59:24 [task 2020-06-14T21:59:24.039Z] 21:59:24 [task 2020-06-14T21:59:24.040Z] 21:59:24 [task 2020-06-14T21:59:24.041Z] 21:59:24 [task 2020-06-14T21:59:24.041Z] 21:59:24 [task 2020-06-14T21:59:24.042Z] 21:59:24 [task 2020-06-14T21:59:24.043Z] 21:59:24 [task 2020-06-14T21:59:24.043Z] 21:59:24 [task 2020-06-14T21:59:24.044Z] 21:59:24 [task 2020-06-14T21:59:24.046Z] 21:59:24 [task 2020-06-14T21:59:24.047Z] 21:59:24 [task 2020-06-14T21:59:24.048Z] 21:59:24 [task 2020-06-14T21:59:24.049Z] 21:59:24 [task 2020-06-14T21:59:24.049Z] 21:59:24 [task 2020-06-14T21:59:24.050Z] 21:59:24 [task 2020-06-14T21:59:24.051Z] 21:59:24 [task 2020-06-14T21:59:24.051Z] 21:59:24 [task 2020-06-14T21:59:24.052Z] 21:59:24 [task 2020-06-14T21:59:24.053Z] 21:59:24 [task 2020-06-14T21:59:24.054Z] 21:59:24 [task 2020-06-14T21:59:24.054Z] 21:59:24 [task 2020-06-14T21:59:24.055Z] 21:59:24 [task 2020-06-14T21:59:24.058Z] 21:59:24 [task 2020-06-14T21:59:24.059Z] 21:59:24 [task 2020-06-14T21:59:24.060Z] 21:59:24 [task 2020-06-14T21:59:24.062Z] 21:59:24 [task 2020-06-14T21:59:24.063Z] 21:59:24 [task 2020-06-14T21:59:24.063Z] 21:59:24 [task 2020-06-14T21:59:24.064Z] 21:59:24 [task 2020-06-14T21:59:24.064Z] 21:59:24 [task 2020-06-14T21:59:24.065Z] 21:59:24 [task 2020-06-14T21:59:24.065Z] 21:59:24 [task 2020-06-14T21:59:24.065Z] 21:59:24 [task 2020-06-14T21:59:24.067Z] 21:59:24 [task 2020-06-14T21:59:24.067Z] 21:59:24 [task 2020-06-14T21:59:24.067Z] 21:59:24 [task 2020-06-14T21:59:24.068Z] 21:59:24 [task 2020-06-14T21:59:24.068Z] 21:59:24 [task 2020-06-14T21:59:24.068Z] 21:59:24 [task 2020-06-14T21:59:24.069Z] 21:59:24 [task 2020-06-14T21:59:24.069Z] 21:59:24 [task 2020-06-14T21:59:24.070Z] 21:59:24 [task 2020-06-14T21:59:24.070Z] 21:59:24 [task 2020-06-14T21:59:24.070Z] 21:59:24 [task 2020-06-14T21:59:24.070Z] 21:59:24 [task 2020-06-14T21:59:24.070Z] 21:59:24 [task 2020-06-14T21:59:24.070Z] 21:59:24 [task 2020-06-14T21:59:24.071Z] 21:59:24 [task 2020-06-14T21:59:24.071Z] 21:59:24 [task 2020-06-14T21:59:24.071Z] 21:59:24 [task 2020-06-14T21:59:24.072Z] 21:59:24 [task 2020-06-14T21:59:24.072Z] 21:59:24 [task 2020-06-14T21:59:24.073Z] 21:59:24 [task 2020-06-14T21:59:24.073Z] 21:59:24 [task 2020-06-14T21:59:24.073Z] 21:59:24 [task 2020-06-14T21:59:24.073Z] 21:59:24 [task 2020-06-14T21:59:24.074Z] 21:59:24 [task 2020-06-14T21:59:24.075Z] 21:59:24 [task 2020-06-14T21:59:24.075Z] 21:59:24 [task 2020-06-14T21:59:24.075Z] 21:59:24 INFO - GECKO(4037) | ==================
INFO - GECKO(4037) | WARNING: ThreadSanitizer: data race (pid=4037)
INFO - GECKO(4037) | Read of size 8 at 0x7f3d61bebc20 by thread T10:
INFO - GECKO(4037) | #0 isForwarded /builds/worker/checkouts/gecko/js/src/gc/Cell.h:122:37 (libxul.so+0x6cf7a58)
INFO - GECKO(4037) | #1 isForwarded /builds/worker/checkouts/gecko/js/src/gc/Cell.h:182:55 (libxul.so+0x6cf7a58)
INFO - GECKO(4037) | #2 IsForwarded<js::Scope> /builds/worker/checkouts/gecko/js/src/gc/Marking-inl.h:81:13 (libxul.so+0x6cf7a58)
INFO - GECKO(4037) | #3 updateEdge<js::Scope> /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2119:53 (libxul.so+0x6cf7a58)
INFO - GECKO(4037) | #4 js::gc::MovingTracer::onScopeEdge(js::Scope**) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2137:57 (libxul.so+0x6cf7a58)
INFO - GECKO(4037) | #5 dispatchToOnEdge /builds/worker/workspace/obj-build/dist/include/js/TracingAPI.h:276:54 (libxul.so+0x6d6e3cf)
INFO - GECKO(4037) | #6 DoCallback<js::Scope> /builds/worker/checkouts/gecko/js/src/gc/Tracer.cpp:45:15 (libxul.so+0x6d6e3cf)
INFO - GECKO(4037) | #7 operator()<js::Scope > /builds/worker/checkouts/gecko/js/src/gc/Tracer.cpp:57:10 (libxul.so+0x6d6e3cf)
INFO - GECKO(4037) | #8 ZN2JS15MapGCThingTypedIZ10DoCallbackINS_5ValueEEbPNS_14CallbackTracerEPT_PKcEUlTyS5_E_EEDaNS_9GCCellPtrEOS5 /builds/worker/workspace/obj-build/dist/include/js/HeapAPI.h:409:5 (libxul.so+0x6d6e3cf)
INFO - GECKO(4037) | #9 ZN2js15MapGCThingTypedIZ10DoCallbackIN2JS5ValueEEbPNS2_14CallbackTracerEPT_PKcEUlTyS6_E_EEDaRKS3_OS6 /builds/worker/workspace/obj-build/dist/include/js/Value.h:1294:28 (libxul.so+0x6d6372f)
INFO - GECKO(4037) | #10 bool DoCallback<JS::Value>(JS::CallbackTracer, JS::Value*, char const*) /builds/worker/checkouts/gecko/js/src/gc/Tracer.cpp:56:16 (libxul.so+0x6d6357b)
INFO - GECKO(4037) | #11 bool js::gc::TraceEdgeInternal<JS::Value>(JSTracer*, JS::Value*, char const*) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:714:10 (libxul.so+0x6d315d4)
INFO - GECKO(4037) | #12 TraceEdge<JS::Value> /builds/worker/checkouts/gecko/js/src/gc/Tracer.h:125:3 (libxul.so+0x684985d)
INFO - GECKO(4037) | #13 JSObject::traceChildren(JSTracer*) /builds/worker/checkouts/gecko/js/src/vm/JSObject.cpp:3910:9 (libxul.so+0x684985d)
INFO - GECKO(4037) | #14 UpdateCellPointers<JSObject> /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2207:9 (libxul.so+0x6cf9e67)
INFO - GECKO(4037) | #15 UpdateArenaPointersTyped<JSObject> /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2213:5 (libxul.so+0x6cf9e67)
INFO - GECKO(4037) | #16 UpdateArenaPointers /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2242:5 (libxul.so+0x6cf9e67)
INFO - GECKO(4037) | #17 UpdateArenaListSegmentPointers(js::gc::GCRuntime*, ArenaListSegment const&) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2266:5 (libxul.so+0x6cf9e67)
INFO - GECKO(4037) | #18 js::gc::ParallelWorker<ArenaListSegment, ArenasToUpdate>::run() /builds/worker/checkouts/gecko/js/src/gc/ParallelWork.h:55:22 (libxul.so+0x6d2d330)
INFO - GECKO(4037) | #19 js::GCParallelTask::runTask() /builds/worker/checkouts/gecko/js/src/gc/GCParallelTask.cpp:146:3 (libxul.so+0x6d2105f)
INFO - GECKO(4037) | #20 js::GCParallelTask::runFromHelperThread(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/GCParallelTask.cpp:131:5 (libxul.so+0x6d20eee)
INFO - GECKO(4037) | #21 js::HelperThread::handleGCParallelWorkload(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:1726:21 (libxul.so+0x6771fa2)
INFO - GECKO(4037) | #22 js::HelperThread::threadLoop() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:2544:5 (libxul.so+0x6773df7)
INFO - GECKO(4037) | #23 js::HelperThread::ThreadMain(void*) /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:2062:11 (libxul.so+0x677010d)
INFO - GECKO(4037) | #24 callMain<0> /builds/worker/checkouts/gecko/js/src/threading/Thread.h:217:5 (libxul.so+0x677d700)
INFO - GECKO(4037) | #25 js::detail::ThreadTrampoline<void (&)(void*), js::HelperThread*>::Start(void*) /builds/worker/checkouts/gecko/js/src/threading/Thread.h:206:11 (libxul.so+0x677d700)
INFO - GECKO(4037) | Previous write of size 8 at 0x7f3d61bebc20 by thread T12:
INFO - GECKO(4037) | [failed to restore the stack]
INFO - GECKO(4037) | Thread T10 'JS Helper' (tid=4054, running) created by main thread at:
INFO - GECKO(4037) | #0 pthread_create /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:967:3 (firefox+0x584db)
INFO - GECKO(4037) | #1 js::Thread::create(void* ()(void), void*) /builds/worker/checkouts/gecko/js/src/threading/posix/PosixThread.cpp:52:7 (libxul.so+0x66d6d31)
INFO - GECKO(4037) | #2 bool js::Thread::init<void (&)(void*), js::HelperThread*>(void (&)(void*), js::HelperThread*&&) /builds/worker/checkouts/gecko/js/src/threading/Thread.h:90:12 (libxul.so+0x6770022)
INFO - GECKO(4037) | #3 js::GlobalHelperThreadState::ensureInitialized() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:1160:27 (libxul.so+0x676ac1a)
INFO - GECKO(4037) | #4 js::EnsureHelperThreadsInitialized() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:94:30 (libxul.so+0x676a862)
INFO - GECKO(4037) | #5 JSRuntime::init(JSContext*, unsigned int) /builds/worker/checkouts/gecko/js/src/vm/Runtime.cpp:200:32 (libxul.so+0x68e1162)
INFO - GECKO(4037) | #6 js::NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/vm/JSContext.cpp:182:17 (libxul.so+0x681313f)
INFO - GECKO(4037) | #7 JS_NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:394:10 (libxul.so+0x66659f4)
INFO - GECKO(4037) | #8 mozilla::CycleCollectedJSContext::Initialize(JSRuntime*, unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:123:16 (libxul.so+0xa1afcb)
INFO - GECKO(4037) | #9 XPCJSContext::Initialize() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1136:32 (libxul.so+0x193b78a)
INFO - GECKO(4037) | #10 XPCJSContext::NewXPCJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1332:23 (libxul.so+0x193c397)
INFO - GECKO(4037) | #11 nsXPConnect::InitJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:80:25 (libxul.so+0x19761e3)
INFO - GECKO(4037) | #12 xpc::InitializeJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:98:35 (libxul.so+0x197629f)
INFO - GECKO(4037) | #13 XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4438:5 (libxul.so+0x648306f)
INFO - GECKO(4037) | #14 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4812:8 (libxul.so+0x6484303)
INFO - GECKO(4037) | #15 XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4866:21 (libxul.so+0x6484664)
INFO - GECKO(4037) | #16 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:45:12 (libxul.so+0x648f262)
INFO - GECKO(4037) | #17 do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:217:22 (firefox+0xca433)
INFO - GECKO(4037) | #18 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:331:16 (firefox+0xca433)
INFO - GECKO(4037) | Thread T12 'JS Helper' (tid=4056, running) created by main thread at:
INFO - GECKO(4037) | #0 pthread_create /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:967:3 (firefox+0x584db)
INFO - GECKO(4037) | #1 js::Thread::create(void* ()(void), void*) /builds/worker/checkouts/gecko/js/src/threading/posix/PosixThread.cpp:52:7 (libxul.so+0x66d6d31)
INFO - GECKO(4037) | #2 bool js::Thread::init<void (&)(void*), js::HelperThread*>(void (&)(void*), js::HelperThread*&&) /builds/worker/checkouts/gecko/js/src/threading/Thread.h:90:12 (libxul.so+0x6770022)
INFO - GECKO(4037) | #3 js::GlobalHelperThreadState::ensureInitialized() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:1160:27 (libxul.so+0x676ac1a)
INFO - GECKO(4037) | #4 js::EnsureHelperThreadsInitialized() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:94:30 (libxul.so+0x676a862)
INFO - GECKO(4037) | #5 JSRuntime::init(JSContext*, unsigned int) /builds/worker/checkouts/gecko/js/src/vm/Runtime.cpp:200:32 (libxul.so+0x68e1162)
INFO - GECKO(4037) | #6 js::NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/vm/JSContext.cpp:182:17 (libxul.so+0x681313f)
INFO - GECKO(4037) | #7 JS_NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:394:10 (libxul.so+0x66659f4)
INFO - GECKO(4037) | #8 mozilla::CycleCollectedJSContext::Initialize(JSRuntime*, unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:123:16 (libxul.so+0xa1afcb)
INFO - GECKO(4037) | #9 XPCJSContext::Initialize() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1136:32 (libxul.so+0x193b78a)
INFO - GECKO(4037) | #10 XPCJSContext::NewXPCJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1332:23 (libxul.so+0x193c397)
INFO - GECKO(4037) | #11 nsXPConnect::InitJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:80:25 (libxul.so+0x19761e3)
INFO - GECKO(4037) | #12 xpc::InitializeJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:98:35 (libxul.so+0x197629f)
INFO - GECKO(4037) | #13 XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4438:5 (libxul.so+0x648306f)
INFO - GECKO(4037) | #14 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4812:8 (libxul.so+0x6484303)
INFO - GECKO(4037) | #15 XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4866:21 (libxul.so+0x6484664)
INFO - GECKO(4037) | #16 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:45:12 (libxul.so+0x648f262)
INFO - GECKO(4037) | #17 do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:217:22 (firefox+0xca433)
INFO - GECKO(4037) | #18 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:331:16 (firefox+0xca433)
INFO - GECKO(4037) | SUMMARY: ThreadSanitizer: data race /builds/worker/checkouts/gecko/js/src/gc/Cell.h:122:37 in isForwarded
INFO - GECKO(4037) | ==================

Emilio Cobos Álvarez (:emilio)

Updated

•

4 years ago

Component: DOM: Core & HTML → JavaScript: GC

Comment hidden (Intermittent Failures Robot)

Cosmin Sabou [:CosminS]

Comment 4

•

4 years ago

•

Edited

Jon, I see you've worked on Bug 1627683, could you have a look over this one too? It has a spike in failures in the last couple of days.
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?startday=2020-06-21&endday=2020-06-28&tree=trunk&bug=1645710
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?startday=2020-06-21&endday=2020-06-28&tree=trunk&bug=1648860
Could it be related to changes in Bug 1647702 https://hg.mozilla.org/integration/autoland/rev/9872086a16f9be8b4bbcd9ff459acc13af96a4d1?

Flags: needinfo?(jcoppeard)

Updated

•

4 years ago

Regressed by: 1647702

BMO Automation

Updated

•

4 years ago

Has Regression Range: --- → yes

Keywords: regression

Comment hidden (Intermittent Failures Robot)

Jon Coppeard (:jonco)

Assignee

Updated

•

4 years ago

Assignee: nobody → jcoppeard

Flags: needinfo?(jcoppeard)

Comment hidden (Intermittent Failures Robot)

Jon Coppeard (:jonco)

Assignee

Comment 7

•

4 years ago

Attached file Bug 1645710 - Store Scope's data pointer in the cell header to avoid race during compacting r?jandem — Details

Currently Scope stores the pointer to the enclosing scope in its cell header. This can be both read and written to while updating scopes during compacting GC. The result is the same regardless of the order the operations, since the read is to check the forwarded flag (which is always clear in this case) and the write doesn't change the value of the flag. I don't think this is causing problems at the moment, but it is undefined behaviour and should be fixed. This race was previously suppressed.

The patch stores the data pointer in the cell header which doesn't need updating during compacting GC.

Pulsebot

Comment 8

•

4 years ago

Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b0cc716aa5c0
Store Scope's data pointer in the cell header to avoid race during compacting r=jandem

Dorel Luca [:dluca]

Comment 9

•

4 years ago

•

Edited

Backed out changeset b0cc716aa5c0 (bug 1645710) for causing leaks on Browser-chrome

Log:
https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=308190599&repo=autoland&lineNumber=1791

Also caused this leak:
https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=308191391&repo=autoland&lineNumber=39717

Push with failures:
https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&revision=b0cc716aa5c034ee11a92c5bcd93655b11efd407

Backout:
https://hg.mozilla.org/integration/autoland/rev/096cd111b2309f8f06b0a8b71301b53b40da966d

Relanded this: it was backed out by mistake. Sorry

Flags: needinfo?(jcoppeard)

Pulsebot

Comment 10

•

4 years ago

Pushed by dluca@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/ac0253e65a22
Store Scope's data pointer in the cell header to avoid race during compacting r=jandem. CLOSED TREE

Dorel Luca [:dluca]

Updated

•

4 years ago

Flags: needinfo?(jcoppeard)

Razvan Maries

Comment 11

•

4 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/ac0253e65a22

Status: NEW → RESOLVED

Closed: 4 years ago

status-firefox80: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla80

Comment hidden (Intermittent Failures Robot)

Christian Holler (:decoder)

Updated

•

4 years ago

Blocks: tsan

Comment hidden (Intermittent Failures Robot)

Treeherder Bug Filer

Reporter

Updated

•

4 years ago