1825621 - ThreadSanitizer: data race [@ get] vs. [@ setAtomic]

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 5aa2b55eb19b (built with: --enable-fuzzing --enable-thread-sanitizer).

I don't currently have a reproducible testcase for this issue.

ThreadSanitizer: data race [@ get] vs. [@ setAtomic]

    ==================
    WARNING: ThreadSanitizer: data race (pid=63121)
      Atomic write of size 8 at 0x7efca7ee5be0 by main thread:
        #0 setAtomic /js/src/gc/Cell.h:129:5 (libxul.so+0xc28f8bf) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #1 set /js/src/gc/Cell.h:151:5 (libxul.so+0xc28f8bf)
        #2 setHeaderFlagBit /js/src/gc/Cell.h:681:13 (libxul.so+0xc28f8bf)
        #3 setFlagBit /js/src/vm/StringType.h:644:36 (libxul.so+0xc28f8bf)
        #4 setPinned /js/src/vm/StringType.h:1248:5 (libxul.so+0xc28f8bf)
        #5 maybePinExistingAtom /js/src/vm/JSAtom.cpp:820:9 (libxul.so+0xc28f8bf)
        #6 js::PinAtom(JSContext*, JSAtom*) /js/src/vm/JSAtom.cpp:806:33 (libxul.so+0xc28f8bf)
        #7 JS::PropertySpecNameToPermanentId(JSContext*, JSPropertySpec::Name, JS::PropertyKey*) /js/src/jsapi.cpp:2040:25 (libxul.so+0xc59ae15) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #8 InitPropertyInfos<const JSPropertySpec> /dom/bindings/BindingUtils.cpp:1313:12 (libxul.so+0x71fee59) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #9 mozilla::dom::InitPropertyInfos(JSContext*, mozilla::dom::NativePropertiesN<7> const*) /dom/bindings/BindingUtils.cpp:1344:3 (libxul.so+0x71fee59)
        #10 InitPropertyInfos /dom/bindings/BindingUtils.cpp:1371:10 (libxul.so+0x71e27a0) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #11 mozilla::dom::XrayResolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>, bool&) /dom/bindings/BindingUtils.cpp:1732:8 (libxul.so+0x71e27a0)
        #12 xpc::DOMXrayTraits::resolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>) /js/xpconnect/wrappers/XrayWrapper.cpp:1714:8 (libxul.so+0x51397a9) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #13 xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::DOMXrayTraits>::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>) const /js/xpconnect/wrappers/XrayWrapper.cpp:1893:28 (libxul.so+0x513919f) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #14 js::BaseProxyHandler::hasOwn(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) const /js/src/proxy/BaseProxyHandler.cpp:72:8 (libxul.so+0xc5d39be) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #15 xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::DOMXrayTraits>::hasOwn(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) const /js/xpconnect/wrappers/XrayWrapper.cpp:2120:32 (libxul.so+0x513c285) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #16 js::Proxy::has(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) /js/src/proxy/Proxy.cpp:383:19 (libxul.so+0xc5e0ca2) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #17 js::HasProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) /js/src/vm/ObjectOperations-inl.h:87:12 (libxul.so+0xc5e10fd) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #18 js::Proxy::has(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) /js/src/proxy/Proxy.cpp:398:12 (libxul.so+0xc5e0d62) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #19 HasProperty /js/src/vm/ObjectOperations-inl.h:87:12 (libxul.so+0xc33bc37) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #20 JS_HasPropertyById(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) /js/src/vm/PropertyAndElement.cpp:533:10 (libxul.so+0xc33bc37)
        #21 mozilla::dom::HasPropertyOnPrototype(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) /dom/bindings/BindingUtils.cpp:2195:10 (libxul.so+0x71e5787) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #22 mozilla::dom::HTMLDocument_Binding::DOMProxyHandler::getOwnPropDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>) const /builds/worker/workspace/obj-build/dom/bindings/HTMLDocumentBinding.cpp:574:12 (libxul.so+0x7098cdf) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #23 mozilla::dom::BaseDOMProxyHandler::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>) const /dom/bindings/DOMJSProxyHandler.cpp:201:10 (libxul.so+0x71efdf4) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #24 mozilla::dom::binding_detail::ResolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>) /dom/bindings/BindingUtils.cpp:2097:36 (libxul.so+0x71e5426) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #25 mozilla::dom::XrayResolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>, bool&) /dom/bindings/BindingUtils.cpp:1763:12 (libxul.so+0x71e2acc) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #26 xpc::DOMXrayTraits::resolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>) /js/xpconnect/wrappers/XrayWrapper.cpp:1714:8 (libxul.so+0x51397a9) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #27 xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::DOMXrayTraits>::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>>) const /js/xpconnect/wrappers/XrayWrapper.cpp:1893:28 (libxul.so+0x513919f) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #28 js::BaseProxyHandler::hasOwn(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) const /js/src/proxy/BaseProxyHandler.cpp:72:8 (libxul.so+0xc5d39be) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #29 xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::DOMXrayTraits>::hasOwn(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) const /js/xpconnect/wrappers/XrayWrapper.cpp:2120:32 (libxul.so+0x513c285) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #30 getInternal /js/src/proxy/Proxy.cpp:493:19 (libxul.so+0xc5e1c23) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #31 js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /js/src/proxy/Proxy.cpp:516:10 (libxul.so+0xc5e1c23)
        #32 GetProperty /js/src/vm/ObjectOperations-inl.h:115:12 (libxul.so+0xc163497) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #33 GetProperty /js/src/vm/ObjectOperations-inl.h:125:10 (libxul.so+0xc163497)
        #34 js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:4726:10 (libxul.so+0xc163497)
        #35 js::jit::IonGetPropertyIC::update(JSContext*, JS::Handle<JSScript*>, js::jit::IonGetPropertyIC*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/jit/IonIC.cpp:176:10 (libxul.so+0xce5414b) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #36 <null> <null> (0x7efcabc0d25c)
        #37 js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:421:32 (libxul.so+0xc1480d4) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #38 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:585:13 (libxul.so+0xc15f0c8) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #39 InternalCall /js/src/vm/Interpreter.cpp:620:10 (libxul.so+0xc15fce3) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #40 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:652:8 (libxul.so+0xc15fce3)
        #41 JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:53:10 (libxul.so+0xc1f6926) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #42 nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /js/xpconnect/src/XPCWrappedJSClass.cpp:918:17 (libxul.so+0x51d3f5f) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #43 PrepareAndDispatch /xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:115:37 (libxul.so+0x4325969) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #44 SharedStub xptcstubs_x86_64_linux.cpp (libxul.so+0x4324cc2) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #45 nsContentSink::NotifyDocElementCreated(mozilla::dom::Document*) /dom/base/nsContentSink.cpp:895:20 (libxul.so+0x5f91f73) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #46 nsDocElementCreatedNotificationRunner::Run() /dom/base/nsDocElementCreatedNotificationRunner.h:24:5 (libxul.so+0x54a397f) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #47 nsContentUtils::RemoveScriptBlocker() /dom/base/nsContentUtils.cpp:6017:17 (libxul.so+0x5c89513) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #48 mozilla::dom::Document::EndUpdate() /dom/base/Document.cpp:7834:3 (libxul.so+0x5e333e3) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #49 EndDocUpdate /parser/html/nsHtml5DocumentBuilder.h:77:16 (libxul.so+0x549eeb2) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #50 nsHtml5AutoPauseUpdate /parser/html/nsHtml5AutoPauseUpdate.h:19:15 (libxul.so+0x549eeb2)
        #51 nsHtml5TreeOpExecutor::PauseDocUpdate(bool*) /parser/html/nsHtml5TreeOpExecutor.cpp:899:26 (libxul.so+0x549eeb2)
        #52 operator() /parser/html/nsHtml5TreeOperation.cpp:822:17 (libxul.so+0x549cce3) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #53 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineAndColumnNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:266:16 (libxul.so+0x549cce3)
        #54 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineAndColumnNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x549cce3)
        #55 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineAndColumnNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x549cce3)
        #56 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineAndColumnNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x549cce3)
        #57 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineAndColumnNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x549cce3)
        #58 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineAndColumnNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x549cce3)
        #59 match<TreeOperationMatcher> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:852:12 (libxul.so+0x549cce3)
        #60 nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**, bool*, bool*) /parser/html/nsHtml5TreeOperation.cpp:1211:21 (libxul.so+0x549cce3)
        #61 nsHtml5TreeOpExecutor::RunFlushLoop() /parser/html/nsHtml5TreeOpExecutor.cpp:694:19 (libxul.so+0x549c308) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #62 nsHtml5ExecutorFlusher::Run() /parser/html/nsHtml5StreamParser.cpp:174:18 (libxul.so+0x54a1b73) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #63 mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:553:16 (libxul.so+0x42d8d7f) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #64 mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:867:26 (libxul.so+0x42d1e00) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #65 mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:698:15 (libxul.so+0x42d03a6) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #66 mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:464:36 (libxul.so+0x42d0780) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #67 operator() /xpcom/threads/TaskController.cpp:188:37 (libxul.so+0x42db8c7) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #68 mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5 (libxul.so+0x42db8c7)
        #69 nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1239:16 (libxul.so+0x42f2b65) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #70 NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:477:10 (libxul.so+0x42f9716) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #71 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21 (libxul.so+0x501b97b) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #72 RunInternal /ipc/chromium/src/base/message_loop.cc:381:10 (libxul.so+0x4f34f17) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #73 RunHandler /ipc/chromium/src/base/message_loop.cc:374:3 (libxul.so+0x4f34f17)
        #74 MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3 (libxul.so+0x4f34f17)
        #75 nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27 (libxul.so+0x93e23b6) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #76 nsAppStartup::Run() /toolkit/components/startup/nsAppStartup.cpp:295:30 (libxul.so+0xbd8d643) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #77 XREMain::XRE_mainRun() /toolkit/xre/nsAppRunner.cpp:5643:22 (libxul.so+0xbef1213) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #78 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:5843:8 (libxul.so+0xbef1d7b) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #79 XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:5899:21 (libxul.so+0xbef2431) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #80 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/Bootstrap.cpp:45:12 (libxul.so+0xbeff392) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #81 do_main /browser/app/nsBrowserApp.cpp:226:22 (firefox-bin+0x143051) (BuildId: 653036c927a39cbe4e9075e61570206e84bf1de5)
        #82 main /browser/app/nsBrowserApp.cpp:423:16 (firefox-bin+0x143051)
    
      Previous read of size 8 at 0x7efca7ee5be0 by thread T20:
        #0 get /js/src/gc/Cell.h:145:23 (libxul.so+0xcddf70d) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #1 headerFlagsField /js/src/gc/Cell.h:678:63 (libxul.so+0xcddf70d)
        #2 flags /js/src/vm/StringType.h:201:35 (libxul.so+0xcddf70d)
        #3 isAtom /js/src/vm/StringType.h:533:32 (libxul.so+0xcddf70d)
        #4 addSetPropertyCache /js/src/jit/CodeGenerator.cpp:14065:19 (libxul.so+0xcddf70d)
        #5 js::jit::CodeGenerator::visitSetPropertyCache(js::jit::LSetPropertyCache*) /js/src/jit/CodeGenerator.cpp:14410:3 (libxul.so+0xcddf70d)
        #6 js::jit::CodeGenerator::generateBody() /js/src/jit/CodeGenerator.cpp:6724:9 (libxul.so+0xcda58c9) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #7 js::jit::CodeGenerator::generate() /js/src/jit/CodeGenerator.cpp:13390:8 (libxul.so+0xcdfc4f0) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #8 js::jit::GenerateCode(js::jit::MIRGenerator*, js::jit::LIRGraph*) /js/src/jit/Ion.cpp:1513:17 (libxul.so+0xce3497c) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #9 js::jit::CompileBackEnd(js::jit::MIRGenerator*, js::jit::WarpSnapshot*) /js/src/jit/Ion.cpp:1542:10 (libxul.so+0xce34ad5) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #10 runTask /js/src/jit/IonCompileTask.cpp:52:24 (libxul.so+0xce52d0d) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #11 js::jit::IonCompileTask::runHelperThreadTask(js::AutoLockHelperThreadState&) /js/src/jit/IonCompileTask.cpp:30:5 (libxul.so+0xce52d0d)
        #12 runTaskLocked /js/src/vm/HelperThreads.cpp:2767:9 (libxul.so+0xc2711bb) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #13 js::GlobalHelperThreadState::runOneTask(js::AutoLockHelperThreadState&) /js/src/vm/HelperThreads.cpp:2736:5 (libxul.so+0xc2711bb)
        #14 JS::RunHelperThreadTask() /js/src/vm/HelperThreads.cpp:2723:23 (libxul.so+0xc270fd3) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #15 HelperThreadTaskHandler::Run() /js/xpconnect/src/XPCJSContext.cpp:1160:5 (libxul.so+0x51b89c2) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #16 mozilla::TaskController::RunPoolThread() /xpcom/threads/TaskController.cpp:328:33 (libxul.so+0x42ce8ee) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #17 mozilla::ThreadFuncPoolThread(void*) /xpcom/threads/TaskController.cpp:180:26 (libxul.so+0x42ce10e) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #18 _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x523e3) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
    
      Thread T20 'TaskCon~ller #7' (tid=63148, running) created by main thread at:
        #0 pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1022:3 (firefox-bin+0xc218d) (BuildId: 653036c927a39cbe4e9075e61570206e84bf1de5)
        #1 _PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:458:14 (libnspr4.so+0x4948f) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
        #2 PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:533:12 (libnspr4.so+0x3e2a5) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
        #3 mozilla::TaskController::InitializeThreadPool() /xpcom/threads/TaskController.cpp:227:10 (libxul.so+0x42cee36) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #4 mozilla::TaskController::AddTask(already_AddRefed<mozilla::Task>&&) /xpcom/threads/TaskController.cpp:394:7 (libxul.so+0x42cfd49) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #5 DispatchOffThreadTask(JS::DispatchReason) /js/xpconnect/src/XPCJSContext.cpp:1179:26 (libxul.so+0x519e1db) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #6 dispatch /js/src/vm/HelperThreads.cpp:1719:5 (libxul.so+0xc263140) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #7 submitTask /js/src/vm/HelperThreads.cpp:272:3 (libxul.so+0xc263140)
        #8 js::StartOffThreadIonCompile(js::jit::IonCompileTask*, js::AutoLockHelperThreadState const&) /js/src/vm/HelperThreads.cpp:257:30 (libxul.so+0xc263140)
        #9 IonCompile /js/src/jit/Ion.cpp:1644:10 (libxul.so+0xce35aa9) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #10 js::jit::Compile(JSContext*, JS::Handle<JSScript*>, js::jit::BaselineFrame*, unsigned char*) /js/src/jit/Ion.cpp:1830:24 (libxul.so+0xce35aa9)
        #11 BaselineCanEnterAtEntry /js/src/jit/Ion.cpp:1962:25 (libxul.so+0xce362fa) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #12 IonCompileScriptForBaseline(JSContext*, js::jit::BaselineFrame*, unsigned char*) /js/src/jit/Ion.cpp:2086:12 (libxul.so+0xce362fa)
        #13 js::jit::IonCompileScriptForBaselineAtEntry(JSContext*, js::jit::BaselineFrame*) /js/src/jit/Ion.cpp:2113:10 (libxul.so+0xce35efa) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #14 <null> <null> (0x7efcabc0cffe)
        #15 Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:2225:17 (libxul.so+0xc1491fd) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #16 js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:431:13 (libxul.so+0xc1480ff) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #17 js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:818:13 (libxul.so+0xc160d45) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #18 js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:850:10 (libxul.so+0xc160ef2) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #19 js::ModuleObject::execute(JSContext*, JS::Handle<js::ModuleObject*>) /js/src/builtin/ModuleObject.cpp:1284:10 (libxul.so+0xc18f0ab) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #20 InnerModuleEvaluation(JSContext*, JS::Handle<js::ModuleObject*>, JS::MutableHandle<JS::GCVector<js::ModuleObject*, 0ul, js::SystemAllocPolicy>>, unsigned long, unsigned long*) /js/src/vm/Modules.cpp:1494:10 (libxul.so+0xc2fd645) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #21 js::ModuleEvaluate(JSContext*, JS::Handle<js::ModuleObject*>, JS::MutableHandle<JS::Value>) /js/src/vm/Modules.cpp:1280:13 (libxul.so+0xc2f7d8e) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #22 JS::ModuleEvaluate(JSContext*, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /js/src/vm/Modules.cpp:164:10 (libxul.so+0xc2f7946) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #23 JS::loader::ModuleLoaderBase::EvaluateModuleInContext(JSContext*, JS::loader::ModuleLoadRequest*, JS::ModuleErrorBehaviour) /js/loader/ModuleLoaderBase.cpp:1233:13 (libxul.so+0x512ee34) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #24 mozJSModuleLoader::ImportESModule(JSContext*, nsTSubstring<char> const&, JS::MutableHandle<JSObject*>, mozilla::loader::SkipCheckForBrokenURLOrZeroSized) /js/xpconnect/loader/mozJSModuleLoader.cpp:1846:23 (libxul.so+0x5157bce) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #25 ConstructJSMOrESMComponent<(mozilla::xpcom::ComponentType)1> /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:2042:5 (libxul.so+0x42b00d2) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #26 mozilla::xpcom::ConstructESModuleComponent(nsTSubstring<char> const&, char const*, nsISupports**) /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:2070:10 (libxul.so+0x42b00d2)
        #27 mozilla::xpcom::CreateInstanceImpl(mozilla::xpcom::ModuleID, nsID const&, void**) /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:12201:7 (libxul.so+0x42aa6c4) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #28 mozilla::xpcom::StaticModule::CreateInstance(nsID const&, void**) const /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:12987:10 (libxul.so+0x42b2257) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #29 CreateInstance /xpcom/components/nsComponentManager.cpp:184:46 (libxul.so+0x42bd40a) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #30 nsComponentManagerImpl::GetServiceLocked(mozilla::Maybe<mozilla::detail::BaseMonitorAutoLock<mozilla::Monitor>>&, (anonymous namespace)::EntryWrapper&, nsID const&, void**) /xpcom/components/nsComponentManager.cpp:971:17 (libxul.so+0x42bd40a)
        #31 nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) /xpcom/components/nsComponentManager.cpp:1160:10 (libxul.so+0x42be0e3) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #32 CallGetService /xpcom/components/nsComponentManagerUtils.cpp:61:43 (libxul.so+0x42c115e) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #33 nsGetServiceByContractID::operator()(nsID const&, void**) const /xpcom/components/nsComponentManagerUtils.cpp:240:21 (libxul.so+0x42c115e)
        #34 nsCOMPtr_base::assign_from_gs_contractid(nsGetServiceByContractID, nsID const&) /xpcom/base/nsCOMPtr.cpp:82:7 (libxul.so+0x41e62bb) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #35 nsCOMPtr /xpcom/base/nsCOMPtr.h:1009:5 (libxul.so+0x42b9806) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #36 NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) /xpcom/components/nsCategoryManager.cpp:662:38 (libxul.so+0x42b9806)
        #37 XREMain::XRE_mainRun() /toolkit/xre/nsAppRunner.cpp:5382:5 (libxul.so+0xbef0adc) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #38 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:5843:8 (libxul.so+0xbef1d7b) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #39 XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:5899:21 (libxul.so+0xbef2431) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #40 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/Bootstrap.cpp:45:12 (libxul.so+0xbeff392) (BuildId: 3c39c90f458a512da49566054ddd6420dcb94b3e)
        #41 do_main /browser/app/nsBrowserApp.cpp:226:22 (firefox-bin+0x143051) (BuildId: 653036c927a39cbe4e9075e61570206e84bf1de5)
        #42 main /browser/app/nsBrowserApp.cpp:423:16 (firefox-bin+0x143051)
    
    SUMMARY: ThreadSanitizer: data race /js/src/gc/Cell.h:129:5 in setAtomic
    ==================

Comment 1

[Andrew McCreight [:mccr8]]

This looks like a JS engine issue. The main thread is pinning an atom over an Xray, while Ion is doing something off of the main thread.

Comment 2

[Iain Ireland [:iain]]

I believe this is a benign data race, although we should still fix it.

The main thread is setting a bit atomically in the header word. At the same time, offthread Ion compilation is reading different bits from the same word. We use relaxed atomic accesses on this word while we're doing GC, and non-atomic reads the rest of the time to avoid inhibiting compiler optimizations (comment here), but maybe the offthread Ion compilation code should just use atomic accesses.

Comment 3

[Jan de Mooij [:jandem]]

We'd really like atoms to be immutable and that's mostly the case already, except for the is-pinned flag, unfortunately. We've gone back and forth with a number of different implementations of that 'feature'.

Comment 4

[Jan de Mooij [:jandem]]

Scripts can now also contain non-atomized strings for string literals so it might not be limited to atoms. Ideally we'd snapshot strings/flags better similar to WrappedFunction. I'm not sure how to do that efficiently though.

Comment 5

[Andrew McCreight [:mccr8]]

Bug 1831887 has a possible test case: running toolkit/components/pdfjs/test/browser_pdfjs_minimum_font_size.js in verify mode with TSan.

Comment 6

[Andrew McCreight [:mccr8]]

Could one of you please take a look at fixing this? A recently landed test seems to hit this race frequently (see the 2 bugs it blocks). Thanks.

If not maybe we could disable that test under TSan until this is fixed. Depending on how bad the failure rate is.

Comment 7

[Iain Ireland [:iain]]

One option is to add a WrappedString class exposing the required subset of the JSString API, implement it using getAtomic() instead of get(), and use it throughout Ion. We also probably have to support PropertyKey (the linked bugs seem to be racing with this), which is a little annoying.

Comment 9

[Iain Ireland [:iain]]

I marked bug 1831887 as a duplicate of this. In that bug, the Ion compile was reading the isFatInline flag while hashing:

#0 get /builds/worker/checkouts/gecko/js/src/gc/Cell.h:146:23
#1 headerFlagsField /builds/worker/checkouts/gecko/js/src/gc/Cell.h:679:63
#2 flags /builds/worker/checkouts/gecko/js/src/vm/StringType.h:201:35
#3 isFatInline /builds/worker/checkouts/gecko/js/src/vm/StringType.h:518:13
#4 hash /builds/worker/checkouts/gecko/js/src/vm/StringType.h:1376:7
#5 HashAtomOrSymbolPropertyKey /builds/worker/checkouts/gecko/js/src/vm/PropertyKey.h:38:26
#6 js::jit::MacroAssembler::emitMegamorphicCacheLookup /builds/worker/checkouts/gecko/js/src/jit/MacroAssembler.cpp:2395:16
#7 js::jit::CodeGenerator::visitMegamorphicLoadSlot /builds/worker/checkouts/gecko/js/src/jit/CodeGenerator.cpp:4220:10

Comment 12

[Tyson Smith [:tsmith]]

This does not seem to be triggered by a test case, it seems to trigger shortly after the browser launches.

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

The severity field for this bug is set to S4. However, the following bug duplicate has higher severity:

• Bug 1853944: S3

:willyelm, could you consider increasing the severity of this bug to S3?

For more information, please visit BugBot documentation.

Comment 16

[Will Medina [:willyelm]]

Increasing severity given the duplicate bug has S3

Comment 19

[Iain Ireland [:iain]]

Bug 1904668 has a TSAN report that races main-thread atom pinning with the MCompare code here.

Comment 20

[Tyson Smith [:tsmith]]

This is a long standing issue and is hit frequently when fuzzing with TSan builds. Please prioritize it appropriately.

A Pernosco session is available here: https://pernos.co/debug/MSL7tb_TAOLKn384mEnj7g/index.html

Comment 21

[BugBot [:suhaib / :marco/ :calixte]]

This bug prevents fuzzing from making progress; however, it has low severity. It is important for fuzz blocker bugs to be addressed in a timely manner (see here why?).
:willyelm, could you consider increasing the severity?

For more information, please visit BugBot documentation.

Comment 23

[Tyson Smith [:tsmith]]

This issue has impacted our ability to find and verify other issues.

Iain, could you please prioritize this if possible, this is our most frequently reported TSan issue.

Comment 24

[Iain Ireland [:iain]]

Attachment: Bug 1825621: Add JSOffThreadAtom r=jandem

Comment 25

[Iain Ireland [:iain]]

Attachment: Bug 1825621: Use JSOffThreadAtom in MacroAssembler r=jandem

The macroassembler can be used from offthread, so it should only inspect strings via JSOffThreadAtom.

We have to duplicate a variety of JSString/JSAtom methods in JSOffThreadAtom so they'll read flags/length atomically.

The &str->asOffThreadAtom() casts in CodeGenerator/Lowering will largely disappear in the next patch.

Comment 26

[Iain Ireland [:iain]]

Attachment: Bug 1825621: Use JSOffThreadAtom in lowering/codegen r=jandem

Comment 27

[Iain Ireland [:iain]]

Attachment: Bug 1825621: Use JSOffThreadAtom in MConstant r=jandem

The core of this patch is changing from JSString->JSOffThreadAtom in the MConstant enum to a JSOffThreadAtom. Everything else is here to make that work.

Note that it's possible to get a StringValue via asJSValue. This is fine as long as we don't unbox it as a string to look at the flags. There are a few cases that do so via ConstantOrRegister; they're fixed in a subsequent patch. Rewriting ConstantOrRegister to use some sort of opaque value didn't seem worthwhile.

Comment 28

[Iain Ireland [:iain]]

Attachment: Bug 1825621: Use JSOffThreadAtom in other MIR ops r=jandem

CompilerGCPointer doesn't like storing JSOffThreadAtom because it inherits from JSAtom privately. I settled on storing it as a JSAtom and teaching GenerateMIRFiles to insert the conversions automagically.

Comment 29

[Iain Ireland [:iain]]

Attachment: Bug 1825621: Add IsConstantNonIndexString r=jandem

Comment 30

[Iain Ireland [:iain]]

Attachment: Bug 1825621: Add HashPropertyKeyThreadSafe r=jandem

TSAN ran into this in bug 1831887.

Comment 31

[Iain Ireland [:iain]]

This stack of patches should fix all the crashes duped to this bug, along with all the other places I could find where we were non-atomically reading string flags off-thread. It's possible I've missed something, but if so, it should be relatively easy to fix it with the new OffThreadAtom infrastructure.

Comment 32

[Tyson Smith [:tsmith]]

This is great, thanks Iain!

Comment 33

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/42c192b6cba4
https://hg.mozilla.org/integration/autoland/rev/f45af42063c6
Add JSOffThreadAtom r=jandem
https://github.com/mozilla-firefox/firefox/commit/5657b04153cc
https://hg.mozilla.org/integration/autoland/rev/4b1cf7284843
Use JSOffThreadAtom in MacroAssembler r=jandem
https://github.com/mozilla-firefox/firefox/commit/2aab0e0cad63
https://hg.mozilla.org/integration/autoland/rev/847183a29b3a
Use JSOffThreadAtom in lowering/codegen r=jandem
https://github.com/mozilla-firefox/firefox/commit/1090a06d5c33
https://hg.mozilla.org/integration/autoland/rev/cb0ad3862999
Use JSOffThreadAtom in MConstant r=jandem
https://github.com/mozilla-firefox/firefox/commit/0521b0786375
https://hg.mozilla.org/integration/autoland/rev/b2413a456081
Use JSOffThreadAtom in other MIR ops r=jandem
https://github.com/mozilla-firefox/firefox/commit/79731c1c7af3
https://hg.mozilla.org/integration/autoland/rev/510413f10bbc
Add IsConstantNonIndexString r=jandem
https://github.com/mozilla-firefox/firefox/commit/0748eaed3925
https://hg.mozilla.org/integration/autoland/rev/cd9395ddba13
Add HashPropertyKeyThreadSafe r=jandem

Comment 34

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/f45af42063c6
https://hg.mozilla.org/mozilla-central/rev/4b1cf7284843
https://hg.mozilla.org/mozilla-central/rev/847183a29b3a
https://hg.mozilla.org/mozilla-central/rev/cb0ad3862999
https://hg.mozilla.org/mozilla-central/rev/b2413a456081
https://hg.mozilla.org/mozilla-central/rev/510413f10bbc
https://hg.mozilla.org/mozilla-central/rev/cd9395ddba13

Comment 35

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:iain, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox141 to wontfix.

For more information, please visit BugBot documentation.

Comment 37

[Intermittent Failures Robot]

1 failures were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-esr115: 1

Table

	swr
linux1804-x86_64/tsan	1

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1825621&startday=2026-04-27&endday=2026-05-03&tree=all