1652281 - Assertion failure: emptyChunks(lock).count() == 0, at gc/GC.cpp:3279 with --nursery-strings=off

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase.js

The testcase is almost fully-reduced, but is fairly reliable. Tested on m-c rev 576f33282a08, run with --fuzzing-safe --no-threads --no-baseline --no-ion --nursery-strings=off, compiled with GCC 9.3.0

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/77a3b9246b5b
user:        Jon Coppeard
date:        Fri Jul 10 17:02:42 2020 +0000
summary:     Bug 1652019 - Move more of decommit logic off-thread r=sfink

Unsure how bad this is, but setting s-s as it is a GC assert and the assert does not seem to be in #ifdef code.

However, it involves oomTest, and --nursery-strings=off, and requires more-deterministic mode, so maybe not, I'll leave it to the GC gurus.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(gdb) bt
#0  js::gc::GCRuntime::decommitFreeArenasWithoutUnlocking (this=0x7ffff6929728, lock=...) at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:3279
#1  0x0000555557a3d48f in js::gc::GCRuntime::decommitFreeArenas (this=0x7ffff6929728, cancel=@0x7fffffffa590: false, lock=...) at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:3257
#2  0x0000555557a3d0ac in js::gc::BackgroundDecommitTask::run (this=0x7ffff692af58) at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:3233
#3  0x0000555557a661ec in js::GCParallelTask::runTask (this=0x7ffff692af58) at /home/skygentoo/trees/mozilla-central/js/src/gc/GCParallelTask.cpp:146
#4  0x0000555557a3cc10 in js::GCParallelTask::runFromMainThread (this=0x7ffff692af58) at /home/skygentoo/trees/mozilla-central/js/src/gc/GCParallelTask.cpp:120
#5  js::gc::GCRuntime::startDecommit (this=0x7ffff6929728) at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:3220
#6  0x0000555557a58a42 in js::gc::GCRuntime::incrementalSlice (this=0x7ffff6929728, budget=..., gckind=..., reason=<optimized out>, session=...) at /home/skygentoo/trees/mozilla-central/js/src/gc/GC.cpp:6758

Comment 2

[Jon Coppeard (:jonco)]

Attachment: Bug 1652281 - Remove assertion about empty chunks pool that no longer always holds r?sfink

GCRuntime::decommitFreeArenasWithoutUnlocking can now get called in situations when we do have empty chunks, e.g. when handling OOM in GCRuntime::decommitFreeArenas. We can just remove this assertion.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1652019

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/981dac52307ecb57fc43a29bd3c55df97d450fe2
https://hg.mozilla.org/mozilla-central/rev/981dac52307e

Comment 5

[Daniel Veditz [:dveditz]]

Looks like not a security bug.