Closed Bug 1645710 Opened 1 year ago Closed 1 year ago

Intermittent SUMMARY: ThreadSanitizer: data race /builds/worker/checkouts/gecko/js/src/gc/Cell.h:122:37 in isForwarded

Categories

(Core :: JavaScript: GC, defect, P5)

defect

Tracking

()

RESOLVED FIXED
mozilla80
Tracking Status
firefox80 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: intermittent-failure)

Attachments

(1 file)

Filed by: ncsoregi [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=306305475&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/NNF_S124Tf2H-clZA1_iCw/runs/0/artifacts/public/logs/live_backing.log


[task 2020-06-14T21:59:24.027Z] 21:59:24 INFO - GECKO(4037) | ==================
[task 2020-06-14T21:59:24.028Z] 21:59:24 INFO - GECKO(4037) | WARNING: ThreadSanitizer: data race (pid=4037)
[task 2020-06-14T21:59:24.028Z] 21:59:24 INFO - GECKO(4037) | Read of size 8 at 0x7f3d61bebc20 by thread T10:
[task 2020-06-14T21:59:24.029Z] 21:59:24 INFO - GECKO(4037) | #0 isForwarded /builds/worker/checkouts/gecko/js/src/gc/Cell.h:122:37 (libxul.so+0x6cf7a58)
[task 2020-06-14T21:59:24.030Z] 21:59:24 INFO - GECKO(4037) | #1 isForwarded /builds/worker/checkouts/gecko/js/src/gc/Cell.h:182:55 (libxul.so+0x6cf7a58)
[task 2020-06-14T21:59:24.031Z] 21:59:24 INFO - GECKO(4037) | #2 IsForwarded<js::Scope> /builds/worker/checkouts/gecko/js/src/gc/Marking-inl.h:81:13 (libxul.so+0x6cf7a58)
[task 2020-06-14T21:59:24.031Z] 21:59:24 INFO - GECKO(4037) | #3 updateEdge<js::Scope> /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2119:53 (libxul.so+0x6cf7a58)
[task 2020-06-14T21:59:24.032Z] 21:59:24 INFO - GECKO(4037) | #4 js::gc::MovingTracer::onScopeEdge(js::Scope**) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2137:57 (libxul.so+0x6cf7a58)
[task 2020-06-14T21:59:24.033Z] 21:59:24 INFO - GECKO(4037) | #5 dispatchToOnEdge /builds/worker/workspace/obj-build/dist/include/js/TracingAPI.h:276:54 (libxul.so+0x6d6e3cf)
[task 2020-06-14T21:59:24.034Z] 21:59:24 INFO - GECKO(4037) | #6 DoCallback<js::Scope> /builds/worker/checkouts/gecko/js/src/gc/Tracer.cpp:45:15 (libxul.so+0x6d6e3cf)
[task 2020-06-14T21:59:24.035Z] 21:59:24 INFO - GECKO(4037) | #7 operator()<js::Scope > /builds/worker/checkouts/gecko/js/src/gc/Tracer.cpp:57:10 (libxul.so+0x6d6e3cf)
[task 2020-06-14T21:59:24.035Z] 21:59:24 INFO - GECKO(4037) | #8 ZN2JS15MapGCThingTypedIZ10DoCallbackINS_5ValueEEbPNS_14CallbackTracerEPT_PKcEUlTyS5_E_EEDaNS_9GCCellPtrEOS5 /builds/worker/workspace/obj-build/dist/include/js/HeapAPI.h:409:5 (libxul.so+0x6d6e3cf)
[task 2020-06-14T21:59:24.037Z] 21:59:24 INFO - GECKO(4037) | #9 ZN2js15MapGCThingTypedIZ10DoCallbackIN2JS5ValueEEbPNS2_14CallbackTracerEPT_PKcEUlTyS6_E_EEDaRKS3_OS6 /builds/worker/workspace/obj-build/dist/include/js/Value.h:1294:28 (libxul.so+0x6d6372f)
[task 2020-06-14T21:59:24.037Z] 21:59:24 INFO - GECKO(4037) | #10 bool DoCallback<JS::Value>(JS::CallbackTracer
, JS::Value*, char const*) /builds/worker/checkouts/gecko/js/src/gc/Tracer.cpp:56:16 (libxul.so+0x6d6357b)
[task 2020-06-14T21:59:24.039Z] 21:59:24 INFO - GECKO(4037) | #11 bool js::gc::TraceEdgeInternal<JS::Value>(JSTracer*, JS::Value*, char const*) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:714:10 (libxul.so+0x6d315d4)
[task 2020-06-14T21:59:24.040Z] 21:59:24 INFO - GECKO(4037) | #12 TraceEdge<JS::Value> /builds/worker/checkouts/gecko/js/src/gc/Tracer.h:125:3 (libxul.so+0x684985d)
[task 2020-06-14T21:59:24.041Z] 21:59:24 INFO - GECKO(4037) | #13 JSObject::traceChildren(JSTracer*) /builds/worker/checkouts/gecko/js/src/vm/JSObject.cpp:3910:9 (libxul.so+0x684985d)
[task 2020-06-14T21:59:24.041Z] 21:59:24 INFO - GECKO(4037) | #14 UpdateCellPointers<JSObject> /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2207:9 (libxul.so+0x6cf9e67)
[task 2020-06-14T21:59:24.042Z] 21:59:24 INFO - GECKO(4037) | #15 UpdateArenaPointersTyped<JSObject> /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2213:5 (libxul.so+0x6cf9e67)
[task 2020-06-14T21:59:24.043Z] 21:59:24 INFO - GECKO(4037) | #16 UpdateArenaPointers /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2242:5 (libxul.so+0x6cf9e67)
[task 2020-06-14T21:59:24.043Z] 21:59:24 INFO - GECKO(4037) | #17 UpdateArenaListSegmentPointers(js::gc::GCRuntime*, ArenaListSegment const&) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2266:5 (libxul.so+0x6cf9e67)
[task 2020-06-14T21:59:24.044Z] 21:59:24 INFO - GECKO(4037) | #18 js::gc::ParallelWorker<ArenaListSegment, ArenasToUpdate>::run() /builds/worker/checkouts/gecko/js/src/gc/ParallelWork.h:55:22 (libxul.so+0x6d2d330)
[task 2020-06-14T21:59:24.046Z] 21:59:24 INFO - GECKO(4037) | #19 js::GCParallelTask::runTask() /builds/worker/checkouts/gecko/js/src/gc/GCParallelTask.cpp:146:3 (libxul.so+0x6d2105f)
[task 2020-06-14T21:59:24.047Z] 21:59:24 INFO - GECKO(4037) | #20 js::GCParallelTask::runFromHelperThread(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/GCParallelTask.cpp:131:5 (libxul.so+0x6d20eee)
[task 2020-06-14T21:59:24.048Z] 21:59:24 INFO - GECKO(4037) | #21 js::HelperThread::handleGCParallelWorkload(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:1726:21 (libxul.so+0x6771fa2)
[task 2020-06-14T21:59:24.049Z] 21:59:24 INFO - GECKO(4037) | #22 js::HelperThread::threadLoop() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:2544:5 (libxul.so+0x6773df7)
[task 2020-06-14T21:59:24.049Z] 21:59:24 INFO - GECKO(4037) | #23 js::HelperThread::ThreadMain(void*) /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:2062:11 (libxul.so+0x677010d)
[task 2020-06-14T21:59:24.050Z] 21:59:24 INFO - GECKO(4037) | #24 callMain<0> /builds/worker/checkouts/gecko/js/src/threading/Thread.h:217:5 (libxul.so+0x677d700)
[task 2020-06-14T21:59:24.051Z] 21:59:24 INFO - GECKO(4037) | #25 js::detail::ThreadTrampoline<void (&)(void*), js::HelperThread*>::Start(void*) /builds/worker/checkouts/gecko/js/src/threading/Thread.h:206:11 (libxul.so+0x677d700)
[task 2020-06-14T21:59:24.051Z] 21:59:24 INFO - GECKO(4037) | Previous write of size 8 at 0x7f3d61bebc20 by thread T12:
[task 2020-06-14T21:59:24.052Z] 21:59:24 INFO - GECKO(4037) | [failed to restore the stack]
[task 2020-06-14T21:59:24.053Z] 21:59:24 INFO - GECKO(4037) | Thread T10 'JS Helper' (tid=4054, running) created by main thread at:
[task 2020-06-14T21:59:24.054Z] 21:59:24 INFO - GECKO(4037) | #0 pthread_create /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:967:3 (firefox+0x584db)
[task 2020-06-14T21:59:24.054Z] 21:59:24 INFO - GECKO(4037) | #1 js::Thread::create(void* ()(void), void*) /builds/worker/checkouts/gecko/js/src/threading/posix/PosixThread.cpp:52:7 (libxul.so+0x66d6d31)
[task 2020-06-14T21:59:24.055Z] 21:59:24 INFO - GECKO(4037) | #2 bool js::Thread::init<void (&)(void*), js::HelperThread*>(void (&)(void*), js::HelperThread*&&) /builds/worker/checkouts/gecko/js/src/threading/Thread.h:90:12 (libxul.so+0x6770022)
[task 2020-06-14T21:59:24.058Z] 21:59:24 INFO - GECKO(4037) | #3 js::GlobalHelperThreadState::ensureInitialized() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:1160:27 (libxul.so+0x676ac1a)
[task 2020-06-14T21:59:24.059Z] 21:59:24 INFO - GECKO(4037) | #4 js::EnsureHelperThreadsInitialized() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:94:30 (libxul.so+0x676a862)
[task 2020-06-14T21:59:24.060Z] 21:59:24 INFO - GECKO(4037) | #5 JSRuntime::init(JSContext*, unsigned int) /builds/worker/checkouts/gecko/js/src/vm/Runtime.cpp:200:32 (libxul.so+0x68e1162)
[task 2020-06-14T21:59:24.062Z] 21:59:24 INFO - GECKO(4037) | #6 js::NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/vm/JSContext.cpp:182:17 (libxul.so+0x681313f)
[task 2020-06-14T21:59:24.063Z] 21:59:24 INFO - GECKO(4037) | #7 JS_NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:394:10 (libxul.so+0x66659f4)
[task 2020-06-14T21:59:24.063Z] 21:59:24 INFO - GECKO(4037) | #8 mozilla::CycleCollectedJSContext::Initialize(JSRuntime*, unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:123:16 (libxul.so+0xa1afcb)
[task 2020-06-14T21:59:24.064Z] 21:59:24 INFO - GECKO(4037) | #9 XPCJSContext::Initialize() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1136:32 (libxul.so+0x193b78a)
[task 2020-06-14T21:59:24.064Z] 21:59:24 INFO - GECKO(4037) | #10 XPCJSContext::NewXPCJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1332:23 (libxul.so+0x193c397)
[task 2020-06-14T21:59:24.065Z] 21:59:24 INFO - GECKO(4037) | #11 nsXPConnect::InitJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:80:25 (libxul.so+0x19761e3)
[task 2020-06-14T21:59:24.065Z] 21:59:24 INFO - GECKO(4037) | #12 xpc::InitializeJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:98:35 (libxul.so+0x197629f)
[task 2020-06-14T21:59:24.065Z] 21:59:24 INFO - GECKO(4037) | #13 XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4438:5 (libxul.so+0x648306f)
[task 2020-06-14T21:59:24.067Z] 21:59:24 INFO - GECKO(4037) | #14 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4812:8 (libxul.so+0x6484303)
[task 2020-06-14T21:59:24.067Z] 21:59:24 INFO - GECKO(4037) | #15 XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4866:21 (libxul.so+0x6484664)
[task 2020-06-14T21:59:24.067Z] 21:59:24 INFO - GECKO(4037) | #16 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:45:12 (libxul.so+0x648f262)
[task 2020-06-14T21:59:24.068Z] 21:59:24 INFO - GECKO(4037) | #17 do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:217:22 (firefox+0xca433)
[task 2020-06-14T21:59:24.068Z] 21:59:24 INFO - GECKO(4037) | #18 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:331:16 (firefox+0xca433)
[task 2020-06-14T21:59:24.068Z] 21:59:24 INFO - GECKO(4037) | Thread T12 'JS Helper' (tid=4056, running) created by main thread at:
[task 2020-06-14T21:59:24.069Z] 21:59:24 INFO - GECKO(4037) | #0 pthread_create /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:967:3 (firefox+0x584db)
[task 2020-06-14T21:59:24.069Z] 21:59:24 INFO - GECKO(4037) | #1 js::Thread::create(void* ()(void), void*) /builds/worker/checkouts/gecko/js/src/threading/posix/PosixThread.cpp:52:7 (libxul.so+0x66d6d31)
[task 2020-06-14T21:59:24.070Z] 21:59:24 INFO - GECKO(4037) | #2 bool js::Thread::init<void (&)(void*), js::HelperThread*>(void (&)(void*), js::HelperThread*&&) /builds/worker/checkouts/gecko/js/src/threading/Thread.h:90:12 (libxul.so+0x6770022)
[task 2020-06-14T21:59:24.070Z] 21:59:24 INFO - GECKO(4037) | #3 js::GlobalHelperThreadState::ensureInitialized() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:1160:27 (libxul.so+0x676ac1a)
[task 2020-06-14T21:59:24.070Z] 21:59:24 INFO - GECKO(4037) | #4 js::EnsureHelperThreadsInitialized() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:94:30 (libxul.so+0x676a862)
[task 2020-06-14T21:59:24.070Z] 21:59:24 INFO - GECKO(4037) | #5 JSRuntime::init(JSContext*, unsigned int) /builds/worker/checkouts/gecko/js/src/vm/Runtime.cpp:200:32 (libxul.so+0x68e1162)
[task 2020-06-14T21:59:24.070Z] 21:59:24 INFO - GECKO(4037) | #6 js::NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/vm/JSContext.cpp:182:17 (libxul.so+0x681313f)
[task 2020-06-14T21:59:24.070Z] 21:59:24 INFO - GECKO(4037) | #7 JS_NewContext(unsigned int, JSRuntime*) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:394:10 (libxul.so+0x66659f4)
[task 2020-06-14T21:59:24.071Z] 21:59:24 INFO - GECKO(4037) | #8 mozilla::CycleCollectedJSContext::Initialize(JSRuntime*, unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:123:16 (libxul.so+0xa1afcb)
[task 2020-06-14T21:59:24.071Z] 21:59:24 INFO - GECKO(4037) | #9 XPCJSContext::Initialize() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1136:32 (libxul.so+0x193b78a)
[task 2020-06-14T21:59:24.071Z] 21:59:24 INFO - GECKO(4037) | #10 XPCJSContext::NewXPCJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1332:23 (libxul.so+0x193c397)
[task 2020-06-14T21:59:24.072Z] 21:59:24 INFO - GECKO(4037) | #11 nsXPConnect::InitJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:80:25 (libxul.so+0x19761e3)
[task 2020-06-14T21:59:24.072Z] 21:59:24 INFO - GECKO(4037) | #12 xpc::InitializeJSContext() /builds/worker/checkouts/gecko/js/xpconnect/src/nsXPConnect.cpp:98:35 (libxul.so+0x197629f)
[task 2020-06-14T21:59:24.073Z] 21:59:24 INFO - GECKO(4037) | #13 XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4438:5 (libxul.so+0x648306f)
[task 2020-06-14T21:59:24.073Z] 21:59:24 INFO - GECKO(4037) | #14 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4812:8 (libxul.so+0x6484303)
[task 2020-06-14T21:59:24.073Z] 21:59:24 INFO - GECKO(4037) | #15 XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:4866:21 (libxul.so+0x6484664)
[task 2020-06-14T21:59:24.073Z] 21:59:24 INFO - GECKO(4037) | #16 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:45:12 (libxul.so+0x648f262)
[task 2020-06-14T21:59:24.074Z] 21:59:24 INFO - GECKO(4037) | #17 do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:217:22 (firefox+0xca433)
[task 2020-06-14T21:59:24.075Z] 21:59:24 INFO - GECKO(4037) | #18 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:331:16 (firefox+0xca433)
[task 2020-06-14T21:59:24.075Z] 21:59:24 INFO - GECKO(4037) | SUMMARY: ThreadSanitizer: data race /builds/worker/checkouts/gecko/js/src/gc/Cell.h:122:37 in isForwarded
[task 2020-06-14T21:59:24.075Z] 21:59:24 INFO - GECKO(4037) | ==================

Component: DOM: Core & HTML → JavaScript: GC
Duplicate of this bug: 1648860
Regressed by: 1647702
Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)

Currently Scope stores the pointer to the enclosing scope in its cell header. This can be both read and written to while updating scopes during compacting GC. The result is the same regardless of the order the operations, since the read is to check the forwarded flag (which is always clear in this case) and the write doesn't change the value of the flag. I don't think this is causing problems at the moment, but it is undefined behaviour and should be fixed. This race was previously suppressed.

The patch stores the data pointer in the cell header which doesn't need updating during compacting GC.

Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b0cc716aa5c0
Store Scope's data pointer in the cell header to avoid race during compacting r=jandem
Pushed by dluca@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/ac0253e65a22
Store Scope's data pointer in the cell header to avoid race during compacting r=jandem. CLOSED TREE
Flags: needinfo?(jcoppeard)
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
Duplicate of this bug: 1649430
See Also: → 1658013
You need to log in before you can comment on or make changes to this bug.