967926 - TSan: data race js/src/../../js/src/jit/IonCode.h:424 parallelIonScript

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

Attachment: Logfile with TSan trace

The attached logfile shows a thread/data race (mozilla-central revision 44ba69cacd7e) detected by TSan (ThreadSanitizer).

Typically, races reported by TSan are not false positives, but it is possible that the race is benign. Even in this case though, we should try to come up with a fix unless this would cause inacceptable performance issues. Also note that seemingly benign races can possibly be harmful (also depending on the compiler and the architecture) [1].

If the bug cannot be fixed, then this bug should be used to either make a compile-time annotation for blacklisting or add an entry to the runtime blacklist.

[1] http://software.intel.com/en-us/blogs/2013/01/06/benign-data-races-what-could-possibly-go-wrong

Comment 1

[Jan de Mooij [:jandem]]

This looks like a PJS race.

Comment 2

[Shu-yu Guo [:shu]]

This is a write-write race on |hasUncompiledCallTarget_ = true| on IonScripts. The value is never read in parallel. Looks benign to me. How do I annotate it as such?

Comment 3

[Shu-yu Guo [:shu]]

Can a compiler ever generate bad code for this kind of races? I don't know much about the ARM code that this would generate.

Comment 4

[Christian Holler (:decoder)]

This can likely be fixed with mozilla::Atomic<bool>, added in bug 965837.

Comment 5

[Shu-yu Guo [:shu]]

Attachment: Make hasUncompiledCallTarget_ Atomic to be extra careful.

Comment 6

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f4d4a49ca5bf
https://hg.mozilla.org/integration/mozilla-inbound/rev/8a4682dd96b6

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/f4d4a49ca5bf
https://hg.mozilla.org/mozilla-central/rev/8a4682dd96b6