926512 - Assertion failure: js::CurrentThreadCanAccessRuntime(runtime_), at ../vm/Runtime.h:1788 or Assertion failure: !thing->zoneFromAnyThread()->needsBarrier(), at ../jsgcinlines.h:64

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 211337f7fb83 (threadsafe build, run with --fuzzing-safe --thread-count=2 --ion-eager --ion-regalloc=backtracking --ion-compile-try-catch --ion-eager --ion-check-range-analysis --ion-parallel-compile=on):


gczeal(4);
function assertArraySeqParResultsEq(arr, op, func) {
  while(true) {
    (function (m) { return arr[op + "Par"].apply(arr, [func, m]); })();
  }
}
function set(a, n) {
  for (var i = 0; i < n; i++)
    a[i] = i;
}
assertArraySeqParResultsEq(
  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
  "map",
  function (i) {
    var a1 = [];
    set(a1, i+1);
  }
);

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Needinfo from shu, as this is PJS code I think.

I also messed up the options in comment 0, in fact no options are required at all to reproduce :)

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Shu-yu Guo [:shu]]

Attachment: Pause barrier verification during fork join sections. (r=?)

This bug is caused by barrier verifier being on while being inside a fork join
section. PJS has the assumption that needsBarrier is false inside parallel
code, and we ensure this by finishing all incremental GC work prior to entering
a fork join section. But since needsBarrier can also be true during barrier
verifier, we're asserting. This patch pauses verification during PJS.

Christian, this bug can probably be opened because it can only be triggered by
GC zeal's barrier verification setting.

Comment 5

[Shu-yu Guo [:shu]]

Additional note about the patch: I had to move ForkJoinActivation outside of Stack.h so I couldn't #include GCInternals for AutoStopVerifyingBarriers without blowing up the compiler.

Comment 6

[Andrew McCreight [:mccr8]]

Unhiding per comment 4, as this is a bug in the verifier, not actually in the GC itself.

Comment 8

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7664c5abfdbd

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7664c5abfdbd