2015084 - ThreadSanitizer: data race [@ updateOwningGCThing] vs. [@ updateOwningGCThing]

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: tsan-log.txt

Found with m-c 20260205-279b57ef4bf0 (--enable-thread-sanitizer)

This was found by visiting a live website with a TSan build.

STR:

• Launch browser and visit site

This issue was triggered by visiting the URL from a crash report: https://crash-stats.mozilla.org/report/index/aec7ab2a-5883-4b50-84ab-59d6f0260205.

WARNING: ThreadSanitizer: data race (pid=474586)
  Write of size 1 at 0x7fff4113aae8 by main thread:
    #0 updateOwningGCThing /builds/worker/checkouts/gecko/js/src/gc/ZoneAllocator.h:381:20 (libxul.so+0xad7159c) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #1 TraceOwnedAllocs<JS::GCVector<JS::Value, 0UL, js::BufferAllocPolicy> > /builds/worker/workspace/obj-build/dist/include/js/AllocPolicy.h:79:15 (libxul.so+0xad7159c)
    #2 js::WeakMap<JS::Value, JS::Value, js::BufferAllocPolicy>::trace(JSTracer*) /builds/worker/checkouts/gecko/js/src/gc/WeakMap-inl.h:286:3 (libxul.so+0xad7159c)
    #3 js::WeakCollectionObject::trace(JSTracer*, JSObject*) /builds/worker/checkouts/gecko/js/src/builtin/WeakMapObject.cpp:281:10 (libxul.so+0xad2425c) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #4 doTrace /builds/worker/workspace/obj-build/dist/include/js/Class.h:667:5 (libxul.so+0xb036624) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #5 CallTraceHook /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1247:12 (libxul.so+0xb036624)
    #6 bool js::GCMarker::processMarkStackTop<2u>(JS::SliceBudget&) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1639:3 (libxul.so+0xb036624)
    #7 js::GCMarker::markCurrentColorInParallel(js::gc::ParallelMarkTask*, JS::SliceBudget&) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1362:10 (libxul.so+0xb0360ba) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #8 js::gc::ParallelMarkTask::tryMarking(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/ParallelMarking.cpp:188:24 (libxul.so+0xb058d3a) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #9 js::gc::ParallelMarkTask::run(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/ParallelMarking.cpp:165:12 (libxul.so+0xb058c0a) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #10 js::GCParallelTask::runTask(JS::GCContext*, js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/GCParallelTask.cpp:221:3 (libxul.so+0xb02e2a7) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    ...

  Previous write of size 1 at 0x7fff4113aae8 by thread T19:
    #0 updateOwningGCThing /builds/worker/checkouts/gecko/js/src/gc/ZoneAllocator.h:381:20 (libxul.so+0xad7159c) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #1 TraceOwnedAllocs<JS::GCVector<JS::Value, 0UL, js::BufferAllocPolicy> > /builds/worker/workspace/obj-build/dist/include/js/AllocPolicy.h:79:15 (libxul.so+0xad7159c)
    #2 js::WeakMap<JS::Value, JS::Value, js::BufferAllocPolicy>::trace(JSTracer*) /builds/worker/checkouts/gecko/js/src/gc/WeakMap-inl.h:286:3 (libxul.so+0xad7159c)
    #3 js::WeakCollectionObject::trace(JSTracer*, JSObject*) /builds/worker/checkouts/gecko/js/src/builtin/WeakMapObject.cpp:281:10 (libxul.so+0xad2425c) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #4 doTrace /builds/worker/workspace/obj-build/dist/include/js/Class.h:667:5 (libxul.so+0xb036624) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #5 CallTraceHook /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1247:12 (libxul.so+0xb036624)
    #6 bool js::GCMarker::processMarkStackTop<2u>(JS::SliceBudget&) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1639:3 (libxul.so+0xb036624)
    #7 js::GCMarker::markCurrentColorInParallel(js::gc::ParallelMarkTask*, JS::SliceBudget&) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1362:10 (libxul.so+0xb0360ba) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #8 js::gc::ParallelMarkTask::tryMarking(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/ParallelMarking.cpp:188:24 (libxul.so+0xb058d3a) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #9 js::gc::ParallelMarkTask::run(js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/ParallelMarking.cpp:165:12 (libxul.so+0xb058c0a) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #10 js::GCParallelTask::runTask(JS::GCContext*, js::AutoLockHelperThreadState&) /builds/worker/checkouts/gecko/js/src/gc/GCParallelTask.cpp:221:3 (libxul.so+0xb02e2a7) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    ...

  Location is global '??' at 0x7fff41100000 ([anon:js-gc-heap]+0x3aae8)

  Thread T19 'TaskCon~ller #0' (tid=474609, running) created by main thread at:
    #0 pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1041:3 (firefox-bin+0xc57ca) (BuildId: 9f1c621d87a80ee01e18681b2fb0cde5df467652)
    #1 _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:429:10 (libnspr4.so+0x425fe) (BuildId: 656ae1d51ce5752d3e8161c496dc0b1bd3c24150)
    #2 PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:496:10 (libnspr4.so+0x37974) (BuildId: 656ae1d51ce5752d3e8161c496dc0b1bd3c24150)
    #3 mozilla::TaskController::InitializeThreadPool() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:348:9 (libxul.so+0x3f0b3c4) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #4 mozilla::TaskController::AddTask(already_AddRefed<mozilla::Task>&&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:489:7 (libxul.so+0x3f0bbce) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #5 DispatchOffThreadTask(JS::HelperThreadTask*) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1179:26 (libxul.so+0x4c0414c) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #6 js::AutoHelperTaskQueue::dispatchQueuedTasks() /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.cpp:694:5 (libxul.so+0xba7c31f) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #7 ~AutoHelperTaskQueue /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.h:77:28 (libxul.so+0xb042d6a) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    #8 ~AutoLockHelperThreadState /builds/worker/checkouts/gecko/js/src/vm/HelperThreads.h:91:16 (libxul.so+0xb042d6a)
    #9 js::Nursery::sweepBuffers() /builds/worker/checkouts/gecko/js/src/gc/Nursery.cpp:1894:1 (libxul.so+0xb042d6a)
    #10 js::Nursery::sweep() /builds/worker/checkouts/gecko/js/src/gc/Nursery.cpp:2037:3 (libxul.so+0xb0418cf) (BuildId: efa4dbec0371cd011f18cad9801087da74aaf0af)
    ...

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1993212

Comment 2

[Jon Coppeard (:jonco)]

This is a 'benign' race that can happen during parallel marking. The nurseryOwned field is always set to the same thing by both threads.

We can fix this by only writing to the field when its value changes. This doesn't happen in parallel marking anyway (only during minor GC).

Comment 3

[Jon Coppeard (:jonco)]

Attachment: (secure)

Comment 4

[Jon Coppeard (:jonco)]

Attachment: Bug 2015084 - Add testcase r?sfink

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/7075a90fcdba
https://hg.mozilla.org/integration/autoland/rev/03ce7c054b45
Don't update nurseryOwned unless we have to r=sfink

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/03ce7c054b45

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/317198c07560
https://hg.mozilla.org/integration/autoland/rev/1b16038a4654
Add testcase r=sfink

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5e3ae3b10ca3
https://hg.mozilla.org/integration/autoland/rev/7c06165ae50f
Revert "Bug 2015084 - Add testcase r=sfink" for causing jit-proc failures in bug-2015084.js.

Comment 10

[Serban Stanca [:SerbanS]]

Reverted this because it was causing jit-proc failures in bug-2015084.js.

• Revert link
• Push with failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | tests/jit-test/jit-test/tests/gc/bug-2015084.js | [13983] Assertion failure: isInList(), at /builds/worker/checkouts/gecko/js/src/gc/WeakMap-inl.h:294 (code -11, args "") [0.5 s]

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0dee8102c828
https://hg.mozilla.org/integration/autoland/rev/53a53d9a021a
Add testcase r=sfink

Comment 12

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/53a53d9a021a