967933 - TSan: data race js/src/jsfun.h:433 setUnlazifiedScript (JSFunction::flags_)

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[Christian Holler (:decoder)]

Attachment: Logfile with TSan trace

The attached logfile shows a thread/data race (mozilla-central revision 44ba69cacd7e) detected by TSan (ThreadSanitizer).

Typically, races reported by TSan are not false positives, but it is possible that the race is benign. Even in this case though, we should try to come up with a fix unless this would cause inacceptable performance issues. Also note that seemingly benign races can possibly be harmful (also depending on the compiler and the architecture) [1].

If the bug cannot be fixed, then this bug should be used to either make a compile-time annotation for blacklisting or add an entry to the runtime blacklist.

[1] http://software.intel.com/en-us/blogs/2013/01/06/benign-data-races-what-could-possibly-go-wrong

Comment 1

[Nathan Froyd [:froydnj]]

Attachment: TSan stack trace

This race is still around, in a slightly different form.  We're racing on JSFunction::flags_ from the bytecode emitter and the jit, which seems a bit sketchy.  It's not really obvious to me where the read is coming from, though; the line in the TSan output says MCall::accept, and I don't see how that calls JSFunction::flags().  I'll try and get a better stack.

Comment 2

[Nathan Froyd [:froydnj]]

Reclassifying as a JIT bug, optimistically.

Comment 3

[Kris Wright :KrisWright]

JSFunction::SetUnlazifiedScript isn't around anymore, so I'm resolving this bug.