857700 - TEST-UNEXPECTED-FAIL | /builds/slave/m-cen-osx64-d-0000000000000000/build/js/src/jit-test/tests/asm.js/testModuleFunctions.js | --no-jm: AsmJSMachExceptionHandlerThread: mach_msg failed with 268451842

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[[e-mail]]

+++ This bug was initially created as a clone of Bug #851421 +++

https://tbpl.mozilla.org/php/getParsedLog.php?id=21391058&tree=Firefox

Comment 1

[Legacy TBPL/Treeherder Robot]

RyanVM
https://tbpl.mozilla.org/php/getParsedLog.php?id=21555139&tree=Mozilla-Inbound
OS X 10.7 64-bit mozilla-inbound leak test build on 2013-04-08 04:36:02
slave: bld-lion-r5-062

TEST-UNEXPECTED-FAIL | /builds/slave/m-in-osx64-d-00000000000000000/build/js/src/jit-test/tests/asm.js/testModuleFunctions.js | --baseline-eager: AsmJSMachExceptionHandlerThread: mach_msg failed with 268451842
make[1]: *** [check-jit-test] Error 2
make: *** [check] Error 2

Comment 2

[Legacy TBPL/Treeherder Robot]

RyanVM
https://tbpl.mozilla.org/php/getParsedLog.php?id=21609068&tree=Mozilla-Aurora
OS X 10.7 64-bit mozilla-aurora leak test build on 2013-04-09 05:19:59
slave: bld-lion-r5-064

TEST-UNEXPECTED-FAIL | /builds/slave/m-aurora-osx64-d-0000000000000/build/js/src/jit-test/tests/asm.js/testModuleFunctions.js | --no-ion --no-jm --no-ti: AsmJSMachExceptionHandlerThread: mach_msg failed with 268451842
make[1]: *** [check-jit-test] Error 2
make: *** [check] Error 2

Comment 3

[Legacy TBPL/Treeherder Robot]

RyanVM
https://tbpl.mozilla.org/php/getParsedLog.php?id=21753442&tree=Mozilla-Aurora
OS X 10.7 64-bit mozilla-aurora leak test build on 2013-04-12 07:01:21
slave: bld-lion-r5-074

TEST-UNEXPECTED-FAIL | /builds/slave/m-aurora-osx64-d-0000000000000/build/js/src/jit-test/tests/asm.js/testModuleFunctions.js | --no-ion --always-mjit: AsmJSMachExceptionHandlerThread: mach_msg failed with 268451842
make[1]: *** [check-jit-test] Error 2
make: *** [check] Error 2

Comment 4

[Legacy TBPL/Treeherder Robot]

RyanVM
https://tbpl.mozilla.org/php/getParsedLog.php?id=21818311&tree=Mozilla-Aurora
OS X 10.7 64-bit mozilla-aurora leak test build on 2013-04-15 09:20:33
slave: bld-lion-r5-045

TEST-UNEXPECTED-FAIL | /builds/slave/m-aurora-osx64-d-0000000000000/build/js/src/jit-test/tests/asm.js/testModuleFunctions.js | --no-ion: AsmJSMachExceptionHandlerThread: mach_msg failed with 268451842
make[1]: *** [check-jit-test] Error 2
make: *** [check] Error 2

Comment 5

[Luke Wagner [:luke]]

Attachment: fix

Thinking about this code a bit more, there is an obvious race condition that I can reproduce locally with a sleep() and I'm pretty sure is happening here with low frequency: the main runtime starts and finishes before the Mach exception handler thread starts.  Thus, the mach_msg listens on an invalid port so we return an error (triggering the intentional MOZ_CRASH).

The fix is to join on the thread before deallocating the port.  It turns out the pthread_cancel was totally bogus and not really canceling the thread (mach_msg doesn't care, it'll keep on blocking, even with PTHREAD_CANCEL_ASYNCHRONOUS).  After considering a bunch of different things, the simplest solution I found was to send a "quit" message to the mach exception handler thread.

While doing this, I discovered some terrible Mach interface hazards that are fixed here also:
 - mach_thread_self() increments a ref-count and needs mach_port_deallocate
 - mach_port_deallocate only decrements the "send right" ref-count, not the "receive right" ref-count, which means an allocated port (and the backing message queue) won't be deallocated!  One must either mach_port_mod_refs or mach_port_destroy.  (Everyone seems to get this wrong.)

https://tbpl.mozilla.org/?tree=Try&rev=7e1b0b568f0d

Comment 6

[Luke Wagner [:luke]]

Comment on attachment 739411 [details] [diff] [review]
fix

I think Vlad knows this code the best.  (Vlad see previous comment for the explanation.)

Comment 7

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d3a6b7822cdb

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d3a6b7822cdb

Comment 9

[Luke Wagner [:luke]]

Comment on attachment 739411 [details] [diff] [review]
fix

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 840282
User impact if declined: crash on OSX
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): low, asm.js-only

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/56ae19708fb3