Created attachment 8370016 [details] Logfile with TSan trace The attached logfile shows a thread/data race (mozilla-central revision 44ba69cacd7e) detected by TSan (ThreadSanitizer). Typically, races reported by TSan are not false positives, but it is possible that the race is benign. Even in this case though, we should try to come up with a fix unless this would cause inacceptable performance issues. Also note that seemingly benign races can possibly be harmful (also depending on the compiler and the architecture) . If the bug cannot be fixed, then this bug should be used to either make a compile-time annotation for blacklisting or add an entry to the runtime blacklist.  http://software.intel.com/en-us/blogs/2013/01/06/benign-data-races-what-could-possibly-go-wrong
Created attachment 8370065 [details] [diff] [review] Patch The problem here is that JSScript::makeTypes is allocating/initializing a TypeScript, and in the meantime that TypeScript is accessible to the background thread (script->types) in IonBuilder::testNeedsArgumentCheck. This patch initializes TypeScript first, then assigns it.
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Attachment #8370065 - Flags: review?(bhackett1024)
Attachment #8370065 - Flags: review?(bhackett1024) → review+
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.