905380 - Data race in js::crash::SnapshotGCStack() with gGCStack

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Here's the stack. We do this on every worker as well as during normal GC on the main thread.

mozjs.dll!js_memcpy - jsutil.h:34
mozjs.dll!GetStack - jscrashreport.cpp:76
mozjs.dll!SnapshotGCStack - jscrashreport.cpp:225
mozjs.dll!endGC - statistics.cpp:536
mozjs.dll!endSlice - statistics.cpp:608
mozjs.dll!Collect - jsgc.cpp:4615
mozjs.dll!GC - jsgc.cpp:4620
mozjs.dll!GCForReason - jsfriendapi.cpp:186
xul.dll!Collect - cyclecollectedjsruntime.cpp:1011
xul.dll!FixGrayBits - nscyclecollector.cpp:2602
xul.dll!ShutdownCollect - nscyclecollector.cpp:2683
xul.dll!ShutdownCollect - nscyclecollector.cpp:2673
xul.dll!Shutdown - nscyclecollector.cpp:2864
xul.dll!nsCycleCollector_shutdown - nscyclecollector.cpp:3174
xul.dll!~WorkerJSRuntime - runtimeservice.cpp:848
xul.dll!Run - runtimeservice.cpp:944

I bet this makes our crash report data basically useless.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I added this code a long time ago, but we've never really used it. We might want to take it out, or at least disable it.