970427 - Assertion failure: !"Background finalization in progress, but it should not be.", at jsgc.cpp:5454

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision ecf20a2484b6 (threadsafe build, run with --fuzzing-safe):


function f(a, b) {
    var o = a;
    gczeal(2);
}
f(3, 4);
var len = 5000;
var iters = 100;
for (var i = 0; i < iters; i++) {
    var par = Array.buildPar(len, fill);
}
function fill(i) { return 10/i; }

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ad7777f1c0f5
user:        Shu-yu Guo
date:        Fri Feb 07 14:40:29 2014 -0800
summary:     Bug 958370 - Unify chunks and slices; self-host the scheduler's slice processing loop. (r=nmatsakis)

Shu-yu, is bug 958370 a likely regressor?

Comment 3

[Shu-yu Guo [:shu]]

Attachment: Push ForkJoinActivation after calling the bounds function.

I called the bounds function in the wrong place; it should be called before
ForkJoinActivation, since we need to ensure no more sequential JS is called
after the activation, which takes care of joining background finalization.

Comment 4

[Niko Matsakis [:nmatsakis]]

Comment on attachment 8375302 [details] [diff] [review]
Push ForkJoinActivation after calling the bounds function.

Review of attachment 8375302 [details] [diff] [review]:
-----------------------------------------------------------------

Makes sense.

::: js/src/jit-test/tests/parallel/bug970427.patch
@@ +1,1 @@
> +// XXXshu: I tried wrapping the entire test in an |if (pjs)|, but the timing

Did you mean to name this file `.js`?

Also, remove the XXXshu...?

Comment 5

[Shu-yu Guo [:shu]]

(In reply to Niko Matsakis [:nmatsakis] from comment #4)
> Comment on attachment 8375302 [details] [diff] [review]
> Push ForkJoinActivation after calling the bounds function.
> 
> Review of attachment 8375302 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> Makes sense.
> 
> ::: js/src/jit-test/tests/parallel/bug970427.patch
> @@ +1,1 @@
> > +// XXXshu: I tried wrapping the entire test in an |if (pjs)|, but the timing
> 
> Did you mean to name this file `.js`?
> 

Oops, yes.

> Also, remove the XXXshu...?

I intentionally left it to warn against refactoring the test in the future, since it's very timing sensitive.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/817d71fa6cc2

Comment 7

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.