2031035 - Assertion failure: !zone->isGCMarking(), at gc/Marking.cpp:2965

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

The testcase is attached.

Debug ASan stack:

#01: ???[/home/msf2/shell-cache/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961 +0x4b3afdc]
#02: ???[/home/msf2/shell-cache/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961 +0x4af5526]
#03: ???[/home/msf2/shell-cache/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961 +0x4a6f8d5]
#04: ???[/home/msf2/shell-cache/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961 +0x41d4d2c]
#05: JS::Zone::sweepWeakMaps(JSTracer*)[/home/msf2/shell-cache/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961 +0x4bd7328]
/snip
AddressSanitizer:DEADLYSIGNAL
=================================================================
==747597==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x593ed8cb100b bp 0x79cb09a002b0 sp 0x79cb09a00120 T5)
==747597==The signal is caused by a WRITE memory access.
==747597==Hint: address points to the zero page.
    #0 0x593ed8cb100b in MOZ_CrashSequence(void*, long) /home/msf2/shell-cache/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961/objdir-js/dist/include/mozilla/Assertions.h:235:3
    #1 0x593ed8cb100b in void js::gc::SweepingTracer::onEdge<JS::Symbol>(JS::Symbol**, char const*) /home/msf2/trees/firefox/js/src/gc/Marking.cpp:2963:3
    #2 0x593ed8c6b525 in js::gc::TraceEdgeInternal(JSTracer*, JS::Symbol**, char const*) /home/msf2/trees/firefox/js/src/gc/Tracer.h:112:1
    #3 0x593ed8c6b525 in auto bool TraceTaggedPtrEdge<JS::Value>(JSTracer*, JS::Value*, char const*)::'lambda'(JS::Value)::operator()<JS::Symbol*>(JS::Value) const /home/msf2/trees/firefox/js/src/gc/Marking.cpp:697:10
    #4 0x593ed8c6b525 in auto js::MapGCThingTyped<bool TraceTaggedPtrEdge<JS::Value>(JSTracer*, JS::Value*, char const*)::'lambda'(JS::Value)>(JS::Value const&, JS::Value&&) /home/msf2/shell-cache/js-dbg-64-asan-linux-x86_64-e896afd4b8ae-618961/objdir-js/dist/include/js/Value.h:1401:28
/snip

294052ecb8cc-617433
294052ecb8ccc203ee1130114a316c7ff646b13b is the first interesting commit
commit 294052ecb8ccc203ee1130114a316c7ff646b13b
Author: Jon Coppeard
Date:   Fri Apr 3 07:12:33 2026 +0000

    Bug 2027023 - Part 2: Don't sweep edges to atoms if the atom zone is not being collected r=sfink

    The wrinkle here is that we sometimes allow sweeping edges into the atoms zone
    if we haven't finished marking the atoms zone. This is the case for JIT data
    where the JITs can cache values from the source zone. It doesn't matter if some
    other zone keeps the target alive, we can discard the edge if it has not been
    marked by the time we finish marking the source zone.

Run with --fuzzing-safe --ion-offthread-compile=off --ion-eager --no-jit-backend --gc-zeal=10, for the debug ASan build, compile with AR=ar sh ~/trees/firefox/js/src/configure --enable-debug --enable-fuzzing --without-sysroot --enable-address-sanitizer --disable-jemalloc --disable-stdcxx-compat --enable-undefined-sanitizer --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on gh rev e896afd4b8ae483921e339581044f2e1d5260493.

Jon, is bug 2027023 a likely regressor? (Note that bug 2027023 is s-s)

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Debug ASan stack

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This testcase can be slightly intermittent, but I'd say 95% reproducible.

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2027023

Comment 4

[Jon Coppeard (:jonco)]

I couldn't immediately reproduce this.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Debug ASan stack on rev 416469d8e8ef697a037ad6af14dd2dc4df99598b

I managed to reproduce this on another computer again on a debug ASan build, on latest gh rev 416469d8e8ef697a037ad6af14dd2dc4df99598b:

$ ~/shell-cache/js-dbg-64-asan-linux-x86_64-416469d8e8ef-619187/js-dbg-64-asan-linux-x86_64-416469d8e8ef-619187 --fuzzing-safe --ion-offthread-compile=off --ion-eager --no-jit-backend --gc-zeal=10 testcase.js
[603313] Assertion failure: !zone->isGCMarking(), at /home/msf3/trees/firefox/js/src/gc/Marking.cpp:2965
#01: ???[/home/msf3/shell-cache/js-dbg-64-asan-linux-x86_64-416469d8e8ef-619187/js-dbg-64-asan-linux-x86_64-416469d8e8ef-619187 +0x4af642c]
/snip

Compile identically as above using AR=ar sh ~/trees/firefox/js/src/configure --enable-debug --enable-fuzzing --without-sysroot --enable-address-sanitizer --disable-jemalloc --disable-stdcxx-compat --enable-undefined-sanitizer --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests.

$ clang --version
Ubuntu clang version 18.1.8 (++20240731025043+3b5b5c1ec4a3-1~exp1~20240731145144.92)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 24.04.4 LTS
Release:        24.04
Codename:       noble

Note that both a regular debug build and a regular opt ASan build do not show this issue.

Comment 7

[Jon Coppeard (:jonco)]

Thanks. I still can't get this testcase to fail but Claude came up with one that triggers that assertion. Based on that I think this is an over eager assertion.

Comment 8

[Jon Coppeard (:jonco)]

Attachment: (secure)

The testcase triggers this assertion by adding an edge from a sweeping zone to
the atoms zone in an incremental GC after we've calculated the sweep groups.

This atom must be marked and thus won't be swept. There are three cases:

1. New atoms will be marked black on allocation

2. Atoms read from this zone or a previously marked zone must be black by the
   snapshot at the beginning invariant

3. Atoms read from zones which haven't finsihed marking yet will be marked by
   by the read barrier in AtomMarkingRuntime::markAtom

The patch updates the assertion to also check whether the symbol is marked
black. If it is then there is no problem as we won't incrrectly sweep an edge
that should be retained.

Comment 9

[BugBot [:suhaib / :marco]]

The bug is marked as tracked for firefox151 (nightly). However, the bug still has low severity.

:sdetar, could you please increase the severity for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 10

[Andrew McCreight [:mccr8]]

Changing to sec-other based on comment 7.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5bf6736e2874
https://hg.mozilla.org/integration/autoland/rev/c48a3652985b
Relax assertion about sweep group edges when sweeping symbols r=sfink

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/c48a3652985b

Comment 13

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

What's left here?

Comment 14

[Jon Coppeard (:jonco)]

(In reply to Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now) from comment #13)
Can you confirm this fixes the assertion failure? I was not able to reproduce it with your testcase.

Comment 16

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Yes, I retested that your patch does fix the bug.

5bf6736e2874-620047
5bf6736e287497e49355ea0aa76219a6d5331151 is the first interesting commit
commit 5bf6736e287497e49355ea0aa76219a6d5331151
Author: Jon Coppeard
Date:   Thu Apr 16 15:04:15 2026 +0000

    Bug 2031035 - Relax assertion about sweep group edges when sweeping symbols r=sfink

    The testcase triggers this assertion by adding an edge from a sweeping zone to
    the atoms zone in an incremental GC after we've calculated the sweep groups.

Comment 17

[Jon Coppeard (:jonco)]

Great, thanks for checking! I'll mark this as fixed.