TSan: Thread data race in js::MaybeGC(JSContext*) vs. js::gc::Chunk::addArenaToFreeList(JSRuntime*, js::gc::ArenaHeader*)

RESOLVED FIXED in Firefox 28

Status

()

defect
--
critical
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: posidron, Assigned: jonco)

Tracking

({sec-want})

Trunk
mozilla28
x86_64
Linux
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox28 fixed)

Details

(Whiteboard: [tsan][tsan-test-blocker][qa-][adv-main28-])

Attachments

(2 attachments)

Reporter

Description

6 years ago
Posted file trace
During Firefox start-up with ThreadSanitizer (LLVM version), we get a data race reported as described in the attached log. Trace was created on mozilla-central with changeset 122820:c233837cce08.

According to the TSan devs, most of the reported traces should be real data races, even though they can be "benign". We need to determine if the race can/should be fixed, or put on the ignore list. Even for benign races, TSan devs suggest to fix them (second priority), as they can also cause problems [1].

[1] http://software.intel.com/en-us/blogs/2013/01/06/benign-data-races-what-could-possibly-go-wrong
Ccing bhackett and billm for some help here :)
Assignee

Comment 2

6 years ago
JSRuntime::gcNumArenasFreeCommitted can be updated by the background thread and read by the foreground thread.  It's used to check whether to trigger a shrinking GC or not in MaybeGC.  This is not deterministic anyway so I don't think it's a problem.
Same as for bug 844755 (comment 6), will put these on ignore when bug 847350 is through.
Assignee: nobody → choller
Depends on: 847350
Assignee

Updated

6 years ago
Attachment #823257 - Flags: review?(wmccloskey)
Attachment #823257 - Flags: review?(wmccloskey) → review+
https://hg.mozilla.org/mozilla-central/rev/94032114aaf5
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
De-prioritizing QA verification of this bug. Please remove the [qa-] whiteboard tag and add the verifyme keyword if you think this needs our attention before Firefox 28 is released.
Whiteboard: [tsan][tsan-test-blocker] → [tsan][tsan-test-blocker][qa-]
Whiteboard: [tsan][tsan-test-blocker][qa-] → [tsan][tsan-test-blocker][qa-][adv-main28-]
You need to log in before you can comment on or make changes to this bug.