2052331 - Hazard tests fail with new symbols brought in by bug 1908744

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P2)

Description

[Erich Gubler [:ErichDonGubler] (he/him)]

Attempting to land bug 1908744 has revealed that our current hazard analysis test has its mangling/destructor detection heuristic broken. 😬 To wit, there are two known breakages:

1. std::future, being built into libstdc++, was built using a different mangling scheme than typical user code.
2. angle::Closure is an abstract class with a default destructor. std::shared_ptr<angle::Closure> is the only storage specified, but the various subclasses of angle::Closure are only ever specified for construction, i.e., with std::make_shared<CompileTask>. This causes the analysis to fail when it can't match the storage type's destructor with the class used to make_shared.

Comment 1

[Erich Gubler [:ErichDonGubler] (he/him)]

The failure motivating the filing of this bug can be found at comment 25 of bug 1908744. For convenience, here's the link to the TreeHerder job: autoland:4c67671fda1b

Comment 2

[Erich Gubler [:ErichDonGubler] (he/him)]

After spending some time with Claude and :jnicol on this, some WIP fixes to the analysis' heuristics were tried out on Try:

• :jnicol:
  • try:99ffdeb5cfb4
  • try:e6df197d8e06
• My end
  • try:910054d10b6b
  • try:f87f8e85de3a

I haven't smithed any of these into patches for review from :sfink yet, but I'm presuming that he will likely have a better solution in mind anyway, as the author of this analysis in the first place. 😅 :sfink, WDYT? Are any of these viable for a fix?

Comment 3

[Erich Gubler [:ErichDonGubler] (he/him)]

Okay, so, just to avoid issues with logs not being retained, the error we run into with no changes on top of patches for bug 1908744 (log link) is:

[task 2026-07-01T21:01:34.043+00:00] /builds/worker/checkouts/gecko/js/src/devtools/rootAnalysis/utility.js:102:15 Error: assertion failed: synthetic function '_ZN3std13__future_base13_State_baseV2D2Ev$void std::__future_base::_State_baseV2::~_State_baseV2()' not found!

After that's resolved with a workaround from Claude (try:910054d10b6b), the next error that shows up (log link) is:

[task 2026-07-02T21:15:23.647+00:00] /builds/worker/checkouts/gecko/js/src/devtools/rootAnalysis/utility.js:102:15 Error: assertion failed: synthetic function '_ZN5angle7ClosureD2Ev$void angle::Closure::~Closure()' not found!

I'm going to file try:ae2260bd3c1e0aa59314453eddf0429513d8efa1 as a patch for review, to remove more steps to getting this fixed.

Comment 4

[Erich Gubler [:ErichDonGubler] (he/him)]

Attachment: Bug 2052331 - chore(hazards): only rewrite `shared_ptr<T>` dtors when `T::~T()` exists r=sfink

With the current state of the root analysis in hazards testing, two cases in patches for bug 1908744 fail:

• std::__future_base::_State_baseV2, whose destructor is defined out-of-line in libstdc++.
• angle::Closure, a polymorphic abstract base. std::make_shared is only used for its subclasses; the deleter runs the derived destructor, and the base destructor is never used directly.

Instead of asserting, only perform the rewrite when the synthesized destructor actually exists in the body database. When it does not, return nothing so the ~shared_ptr() call is analyzed normally.

Comment 5

[Erich Gubler [:ErichDonGubler] (he/him)]

CC/NI for :bhood, who manages the Graphics team and its interest in this.

Comment 6

[Jamie Nicol [:jnicol]]

Hi Gustavo, could we please prioritise this slightly higher than S4/P3? It's directly blocking the ANGLE update (bug 1908744), which is currently a huge source of security bugs. And itself blocks bug 2027951, which we need in order to receive google maps' new renderer which is important for web compat.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ba8363ca52a5
https://hg.mozilla.org/integration/autoland/rev/15e6a0f8a9a3
chore(hazards): only rewrite `shared_ptr<T>` dtors when `T::~T()` exists r=sfink

Comment 8

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/15e6a0f8a9a3

Comment 9

[Takanori MATSUURA]

(In reply to pstanciu from comment #8)

https://hg.mozilla.org/mozilla-central/rev/15e6a0f8a9a3

Backed out by https://hg-edge.mozilla.org/mozilla-central/rev/0b736d13634f.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/042e4fa3c13a
https://hg.mozilla.org/integration/autoland/rev/ec76e6fbe2ee
chore(hazards): only rewrite `shared_ptr<T>` dtors when `T::~T()` exists r=sfink

Comment 11

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/ec76e6fbe2ee