Enable GC zealing for integration tests

[andreiltd]

This is an experimental build of StarlingMonkey with GC zealing enabled. The integration tests are run with GC activated every 10 allocations and verify pre write barriers between instructions enabled.

[andreiltd]

An example test failure:

Serving HTTP on http://0.0.0.0:36005/
stderr [0] :: Warning: Using a DEBUG build. Expect things to be SLOW.
stderr [0] :: [-1] Assertion failure: end >= start, at 
stderr [0] :: /home/runner/work/spidermonkey-wasi-embedding/spidermonkey-wasi-embedding/gecko-dev/js/src/gc/Statistics.cpp
stderr [0] :: :183
2024-12-20T11:11:06.066608Z ERROR wasmtime_cli::commands::serve: [0] :: Error {
    context: "error while executing at wasm backtrace:\n    0: 0xfe19b6 - <unknown>!js::gcstats::Statistics::beginGC(JS::GCOptions, mozilla::TimeStamp const&)\n    1: 0xfe319d - <unknown>!js::gcstats::Statistics::beginSlice(js::gcstats::ZoneGCStats const&, JS::GCOptions, JS::SliceBudget const&, JS::GCReason, bool)\n    2: 0xf46017 - <unknown>!js::gc::GCRuntime::gcCycle(bool, JS::SliceBudget const&, JS::GCReason)\n    3: 0xefdc73 - <unknown>!js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason)\n    4: 0xefd9fb - <unknown>!js::gc::GCRuntime::gc(JS::GCOptions, JS::GCReason)\n    5: 0xefbf1c - <unknown>!js::gc::GCRuntime::runDebugGC()\n    6: 0xefb04b - <unknown>!bool js::gc::CellAllocator::PreAllocChecks<(js::AllowGC)1>(JSContext*, js::gc::AllocKind)\n    7: 0x737bdc - <unknown>!void* js::gc::CellAllocator::AllocNurseryOrTenuredCell<(JS::TraceKind)0, (js::AllowGC)1>(JSContext*, js::gc::AllocKind, unsigned long, js::gc::Heap, js::gc::AllocSite*)\n    8: 0x704397 - <unknown>!js::NativeObject::create(JSContext*, js::gc::AllocKind, js::gc::Heap, JS::Handle<js::SharedShape*>, js::gc::AllocSite*)\n    9: 0x981bca - <unknown>!NewObject(JSContext*, JSClass const*, JS::Handle<js::TaggedProto>, js::gc::AllocKind, js::NewObjectKind, js::EnumFlags<js::ObjectFlag>)\n   10: 0x9819ee - <unknown>!js::NewObjectWithGivenTaggedProto(JSContext*, JSClass const*, JS::Handle<js::TaggedProto>, js::gc::AllocKind, js::NewObjectKind, js::EnumFlags<js::ObjectFlag>)\n   11: 0xcbc8fc - <unknown>!JS_NewObjectWithGivenProto(JSContext*, JSClass const*, JS::Handle<JSObject*>)\n   12: 0x16a5a8 - <unknown>!builtins::web::fetch::fetch_event::FetchEvent::init_incoming_request(JSContext*, JS::Handle<JSObject*>, host_api::HttpIncomingRequest*)\n   13: 0x16f6be - <unknown>!builtins::web::fetch::fetch_event::handle_incoming_request(host_api::HttpIncomingRequest*)\n   14: 0x4a862 - <unknown>!exports_wasi_http_incoming_handler_handle\n   15: 0x7900a - <unknown>!__wasm_export_exports_wasi_http_incoming_handler_handle\nnote: using the `WASMTIME_BACKTRACE_DETAILS=1` environment variable may show more debugging information",
    source: UnreachableCodeReached,
}    
error: hyper::Error(User(Service), guest never invoked `response-outparam::set` method: error while executing at wasm backtrace:
    0: 0xfe19b6 - <unknown>!js::gcstats::Statistics::beginGC(JS::GCOptions, mozilla::TimeStamp const&)
    1: 0xfe319d - <unknown>!js::gcstats::Statistics::beginSlice(js::gcstats::ZoneGCStats const&, JS::GCOptions, JS::SliceBudget const&, JS::GCReason, bool)
    2: 0xf46017 - <unknown>!js::gc::GCRuntime::gcCycle(bool, JS::SliceBudget const&, JS::GCReason)
    3: 0xefdc73 - <unknown>!js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason)
    4: 0xefd9fb - <unknown>!js::gc::GCRuntime::gc(JS::GCOptions, JS::GCReason)
    5: 0xefbf1c - <unknown>!js::gc::GCRuntime::runDebugGC()
    6: 0xefb04b - <unknown>!bool js::gc::CellAllocator::PreAllocChecks<(js::AllowGC)1>(JSContext*, js::gc::AllocKind)
    7: 0x737bdc - <unknown>!void* js::gc::CellAllocator::AllocNurseryOrTenuredCell<(JS::TraceKind)0, (js::AllowGC)1>(JSContext*, js::gc::AllocKind, unsigned long, js::gc::Heap, js::gc::AllocSite*)
    8: 0x704397 - <unknown>!js::NativeObject::create(JSContext*, js::gc::AllocKind, js::gc::Heap, JS::Handle<js::SharedShape*>, js::gc::AllocSite*)
    9: 0x981bca - <unknown>!NewObject(JSContext*, JSClass const*, JS::Handle<js::TaggedProto>, js::gc::AllocKind, js::NewObjectKind, js::EnumFlags<js::ObjectFlag>)
   10: 0x9819ee - <unknown>!js::NewObjectWithGivenTaggedProto(JSContext*, JSClass const*, JS::Handle<js::TaggedProto>, js::gc::AllocKind, js::NewObjectKind, js::EnumFlags<js::ObjectFlag>)
   11: 0xcbc8fc - <unknown>!JS_NewObjectWithGivenProto(JSContext*, JSClass const*, JS::Handle<JSObject*>)
   12: 0x16a5a8 - <unknown>!builtins::web::fetch::fetch_event::FetchEvent::init_incoming_request(JSContext*, JS::Handle<JSObject*>, host_api::HttpIncomingRequest*)
   13: 0x16f6be - <unknown>!builtins::web::fetch::fetch_event::handle_incoming_request(host_api::HttpIncomingRequest*)
   14: 0x4a862 - <unknown>!exports_wasi_http_incoming_handler_handle
   15: 0x7900a - <unknown>!__wasm_export_exports_wasi_http_incoming_handler_handle
note: using the `WASMTIME_BACKTRACE_DETAILS=1` environment variable may show more debugging information

[guybedford]

This is great, thank you. How many failures like the above are you seeing? Seems like something that would be great to track as an ongoing concern to get this landed.

For the error you saw, debugging seems like it will be hard :) Did you try running with WASMTIME_BACKTRACE_DETAILS=1? What other tools do we have to start looking into these do you think?

[tschneidereit]

With #199 landed, this should not be blocked anymore—at least not on the same assert. I tested #199 with GCs happening at runtime, and it resolved asserts I otherwise encountered in those.