1681681 - JS shell and fuzz-tests crash when libFuzzer calls `exit`

Status: REOPENED

(Core :: Fuzzing, defect)

Description

[Christian Holler (:decoder)]

Since the refactoring in bug 1664810, both the JS shell (when used in jsrtfuzzing mode) and the fuzz-tests binary crash when libFuzzer calls exit, because an in-use mutex is being destroyed. This affects mostly merge jobs and coverage runs because in these situations, libFuzzer will exit eventually (in regular fuzzing, libFuzzer just keeps going forever until it crashes).

Right now, the easiest solution seems to be another atexit handler, just like we have in Firefox already for deinitializing XPCOM.

Comment 1

[Christian Holler (:decoder)]

Attachment: Bug 1681681 - Call JS_ShutDown when libFuzzer exits in JS. r?jandem

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2a964c5fd1a9
Call JS_ShutDown when libFuzzer exits in JS. r=jandem

Comment 3

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/2a964c5fd1a9

Comment 4

[Christian Holler (:decoder)]

Reopening this, because we need a follow-up to silence a warning I am seeing now in some targets. The problem is that we should also free any active runtimes before calling shutdown. This isn't a blocker like the previous issue, but it would still be much cleaner to properly shutdown all runtimes instead of leaking them.