900681 - Assertion failure: backgroundFinalizeState[i] == BFS_DONE, at jsgc.h

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function f(x) {
    x("", Math)
}
for each(let b in this) {
    try {
        f(b)
    } catch (e) {}
}

asserts js debug (32-bit threadsafe deterministic) shell on m-c changeset 129ce98f4cb2 without any CLI arguments intermittently at Assertion failure: backgroundFinalizeState[i] == BFS_DONE, at jsgc.h

s-s because gc is on the stack.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/868ce514bba7
user:        Brian Hackett
date:        Fri Jul 19 08:06:02 2013 -0600
summary:     Bug 875125 - Allow scripts to be parsed/emitted off the main thread, r=billm.

Brian, is bug 875125 a likely regressor?

Comment 2

[Alex Keybl [:akeybl]]

Nicolas, can you help finding an owner for investigation while Naveed is out?

Comment 3

[Nicolas B. Pierron [:nbp]]

I guess this might mean that the Parser thread is not destroyed at the end, do you have any idea what might go wrong, as you did the review of Brian's patch?

Do you mind taking this bug?
Otherwise I guess we can just back it out if nobody is able to work on it.

Comment 4

[Brian Hackett [Laid off!]]

I'll look at this this weekend.  No off thread parsing is actually happening so this is probably just some dumb thing, I don't see why backing the patch out is warranted at all.

Comment 5

[Nicolas B. Pierron [:nbp]]

(In reply to Brian Hackett (:bhackett) from comment #4)
> I'll look at this this weekend.  No off thread parsing is actually happening
> so this is probably just some dumb thing, I don't see why backing the patch
> out is warranted at all.

Thanks, I am assigning you to this bug as it is required.

Comment 6

[Brian Hackett [Laid off!]]

Attachment: patch

Actually, this test case is calling offThreadCompileScript, via that funky for loop.  I can't reproduce this assert anymore, but offThreadCompileScript is kind of borked after bug 897655, with various asserts hitting during runtime shutdown because the off thread compilations are never finished.  This patch fixes this so that any leaked compilations are finished before the final GC.  This should only happen in the shell --- XUL documents will finish any off thread compilations which they trigger.

offThreadCompileScript still asserts on !cx->typeInferenceEnabled(), which is fixed by bug 906060, but after commenting out that assert I'm not able to get any failures on this testcase after 100 or so runs in a threadsafe build.

Comment 7

[Brian Hackett [Laid off!]]

This involves offThreadCompileScript which is a shell only function, and while it tests functionality now used for parsing scripts in XUL documents the bug is in how the shell function behaves (leaking compilations).

Comment 8

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/dcf50fbf6087

Comment 9

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/dcf50fbf6087

Comment 10

[Alex Keybl [:akeybl]]

No longer a security bug, no need to track.