844768 - TSan: Thread data race in js::MaybeGC(JSContext*) vs. js::gc::Chunk::addArenaToFreeList(JSRuntime*, js::gc::ArenaHeader*)

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: trace

During Firefox start-up with ThreadSanitizer (LLVM version), we get a data race reported as described in the attached log. Trace was created on mozilla-central with changeset 122820:c233837cce08.

According to the TSan devs, most of the reported traces should be real data races, even though they can be "benign". We need to determine if the race can/should be fixed, or put on the ignore list. Even for benign races, TSan devs suggest to fix them (second priority), as they can also cause problems [1].

[1] http://software.intel.com/en-us/blogs/2013/01/06/benign-data-races-what-could-possibly-go-wrong

Comment 1

[Christian Holler (:decoder)]

Ccing bhackett and billm for some help here :)

Comment 2

[Jon Coppeard (:jonco)]

JSRuntime::gcNumArenasFreeCommitted can be updated by the background thread and read by the foreground thread.  It's used to check whether to trigger a shrinking GC or not in MaybeGC.  This is not deterministic anyway so I don't think it's a problem.

Comment 3

[Christian Holler (:decoder)]

Same as for bug 844755 (comment 6), will put these on ignore when bug 847350 is through.

Comment 4

[Jon Coppeard (:jonco)]

Attachment: Bug844768-gcNumArenasFreeCommitted

Comment 5

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/94032114aaf5

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/94032114aaf5

Comment 7

[u279076]

De-prioritizing QA verification of this bug. Please remove the [qa-] whiteboard tag and add the verifyme keyword if you think this needs our attention before Firefox 28 is released.