1032277 - Intermittent PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)] (after: "NS_ENSURE_TRUE(mTextInputHandler) failed" and "ABORT: Aborting on channel error."), inside of SVGDocumentWrapper::DestroyViewer()

Reporter

Description

•

10 years ago

Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test crashtest on 2014-06-30 04:36:46 PDT for push 58bf8348c8f1

slave: t-snow-r4-0058

https://tbpl.mozilla.org/php/getParsedLog.php?id=42759294&tree=Mozilla-Inbound

{
04:49:30     INFO -  REFTEST TEST-START | Shutdown
04:49:30     INFO -  --DOCSHELL 0x11bf64800 == 7 [pid = 957] [id = 71]
04:49:30     INFO -  --DOCSHELL 0x11dfec000 == 6 [pid = 957] [id = 2]
04:49:30     INFO -  --DOCSHELL 0x128b0a000 == 5 [pid = 957] [id = 262]
04:49:30     INFO -  [957] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file /builds/slave/m-in-osx64-d-00000000000000000/build/dom/events/ContentEventHandler.cpp, line 110
04:49:30     INFO -  --DOCSHELL 0x11eb8e000 == 4 [pid = 957] [id = 3]
04:49:30     INFO -  --DOCSHELL 0x11bff5800 == 3 [pid = 957] [id = 1]
04:49:30     INFO -  1896484032[10032e1a0]: Shutting down SCTP
04:49:30     INFO -  --DOCSHELL 0x126624800 == 2 [pid = 957] [id = 72]
04:49:30     INFO -  --DOCSHELL 0x12a511000 == 1 [pid = 957] [id = 261]
04:49:30     INFO -  --DOMWINDOW == 134 (0x12bea4000) [pid = 957] [serial = 5939] [outer = 0x12be9ac00] [url = about:blank]
04:49:30     INFO -  --DOMWINDOW == 133 (0x11dd30800) [pid = 957] [serial = 5822] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/dom/plugins/test/crashtests/540114-1.html]
04:49:30     INFO -  --DOMWINDOW == 132 (0x1292cb000) [pid = 957] [serial = 5807] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/image/test/crashtests/844403-1.html]
04:49:30     INFO -  --DOMWINDOW == 131 (0x12bdda400) [pid = 957] [serial = 5901] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/299036-1.html]
04:49:30     INFO -  --DOMWINDOW == 130 (0x12ac3c400) [pid = 957] [serial = 5861] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/60110-1.html]
04:49:30     INFO -  --DOMWINDOW == 129 (0x12c320400) [pid = 957] [serial = 5943] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/555462-iframe.html]
04:49:30     INFO -  --DOMWINDOW == 128 (0x12ac44800) [pid = 957] [serial = 5912] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/445171-1-inner.svg]
04:49:30     INFO -  --DOMWINDOW == 127 (0x12a7ae000) [pid = 957] [serial = 5913] [outer = 0x0] [url = data:text/html,<script>parent.done()</script>]
04:49:30     INFO -  --DOMWINDOW == 126 (0x11e137400) [pid = 957] [serial = 5944] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/555462-iframe.html]
04:49:30     INFO -  --DOMWINDOW == 125 (0x128765c00) [pid = 957] [serial = 5960] [outer = 0x127ce0000] [url = about:blank]
04:49:30     INFO -  --DOMWINDOW == 124 (0x127654000) [pid = 957] [serial = 6031] [outer = 0x1289af400] [url = about:blank]
04:49:30     INFO -  --DOMWINDOW == 123 (0x128623400) [pid = 957] [serial = 6029] [outer = 0x128563800] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/widget/crashtests/303901-1.html?]
04:49:30     INFO -  --DOMWINDOW == 122 (0x126ada400) [pid = 957] [serial = 6003] [outer = 0x1277a4000] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/widget/cocoa/crashtests/373122-1-inner.html]
04:49:30     INFO -  --DOMWINDOW == 121 (0x1292c6400) [pid = 957] [serial = 5992] [outer = 0x128364000] [url = about:blank]
04:49:30     INFO -  --DOMWINDOW == 120 (0x126ad5c00) [pid = 957] [serial = 5980] [outer = 0x12631e800] [url = data:text/html,Q]
04:49:30     INFO -  --DOMWINDOW == 119 (0x12be9ac00) [pid = 957] [serial = 5938] [outer = 0x0] [url = about:blank]
04:49:30     INFO -  [957] WARNING: NS_ENSURE_TRUE(mTextInputHandler) failed: file /builds/slave/m-in-osx64-d-00000000000000000/build/widget/cocoa/nsChildView.mm, line 5525
04:49:33     INFO -  [968] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-osx64-d-00000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532
04:49:33     INFO -  [968] ###!!! ASSERTION: Cannot call AnnotateCrashReport in child processes from non-main thread.: 'Error', file /builds/slave/m-in-osx64-d-00000000000000000/build/toolkit/crashreporter/nsExceptionHandler.cpp, line 1709
04:49:33     INFO -  NS_DebugBreak [xpcom/base/nsDebugImpl.cpp:418]
04:49:33     INFO -  mozilla::ipc::MessageChannel::OnChannelErrorFromLink() [ipc/glue/MessageChannel.cpp:1534]
04:49:33     INFO -  mozilla::ipc::ProcessLink::OnChannelError() [obj-firefox/dist/include/mozilla/Monitor.h:37]
04:49:33     INFO -  IPC::Channel::ChannelImpl::OnFileCanReadWithoutBlocking(int) [ipc/chromium/src/chrome/common/ipc_channel_posix.cc:856]
04:49:33     INFO -  event_base_loop [ipc/chromium/src/third_party/libevent/event.c:1355]
04:49:33     INFO -  base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) [ipc/chromium/src/base/message_pump_libevent.cc:332]
04:49:33     INFO -  MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:504]
04:49:33     INFO -  base::Thread::ThreadMain() [ipc/chromium/src/base/thread.cc:171]
04:49:33     INFO -  ThreadFunc [ipc/chromium/src/base/platform_thread_posix.cc:39]
04:49:33     INFO -  libSystem.B.dylib + 0x39fd6
04:49:33     INFO -  [968] ###!!! ASSERTION: Cannot call AnnotateCrashReport in child processes from non-main thread.: 'Error', file /builds/slave/m-in-osx64-d-00000000000000000/build/toolkit/crashreporter/nsExceptionHandler.cpp, line 1659
04:49:33     INFO -  NS_DebugBreak [obj-firefox/dist/include/nsTSubstring.h:95]
04:49:33     INFO -  mozilla::ipc::MessageChannel::OnChannelErrorFromLink() [ipc/glue/MessageChannel.cpp:1534]
04:49:33     INFO -  mozilla::ipc::ProcessLink::OnChannelError() [obj-firefox/dist/include/mozilla/Monitor.h:37]
04:49:33     INFO -  IPC::Channel::ChannelImpl::OnFileCanReadWithoutBlocking(int) [ipc/chromium/src/chrome/common/ipc_channel_posix.cc:856]
04:49:33     INFO -  event_base_loop [ipc/chromium/src/third_party/libevent/event.c:1355]
04:49:33     INFO -  base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) [ipc/chromium/src/base/message_pump_libevent.cc:332]
04:49:33     INFO -  MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:504]
04:49:33     INFO -  base::Thread::ThreadMain() [ipc/chromium/src/base/thread.cc:171]
04:49:33     INFO -  ThreadFunc [ipc/chromium/src/base/platform_thread_posix.cc:39]
04:49:33     INFO -  libSystem.B.dylib + 0x39fd6
04:49:33     INFO -  mozilla::ipc::ProcessLink::OnChannelError() [obj-firefox/dist/include/mozilla/Monitor.h:37]
04:49:33     INFO -  IPC::Channel::ChannelImpl::OnFileCanReadWithoutBlocking(int) [ipc/chromium/src/chrome/common/ipc_channel_posix.cc:856]
04:49:33     INFO -  event_base_loop [ipc/chromium/src/third_party/libevent/event.c:1355]
04:49:33     INFO -  base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) [ipc/chromium/src/base/message_pump_libevent.cc:332]
04:49:33     INFO -  MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:504]
04:49:33     INFO -  base::Thread::ThreadMain() [ipc/chromium/src/base/thread.cc:171]
04:49:33     INFO -  ThreadFunc [ipc/chromium/src/base/platform_thread_posix.cc:39]
04:49:33     INFO -  libSystem.B.dylib + 0x39fd6
04:49:33     INFO -  [968] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-osx64-d-00000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532
04:49:33     INFO -  Hit MOZ_CRASH() at /builds/slave/m-in-osx64-d-00000000000000000/build/memory/mozalloc/mozalloc_abort.cpp:30
04:49:35     INFO -  TEST-INFO | Main app process: killed by SIGHUP
04:49:35  WARNING -  TEST-UNEXPECTED-FAIL | Shutdown | Exited with code 1 during test run
04:49:35     INFO -  INFO | automation.py | Application ran for: 0:10:42.418482
04:49:35     INFO -  INFO | zombiecheck | Reading PID log: /var/folders/gp/gp6E0Yo7GAOF8RNmVxgKMU+++-k/-Tmp-/tmpKVl9nRpidlog
04:49:56  WARNING -  PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)]
04:49:56     INFO -  Crash dump filename: /var/folders/gp/gp6E0Yo7GAOF8RNmVxgKMU+++-k/-Tmp-/tmpCCqYgp.mozrunner/minidumps/2C1787EA-F0F7-4FBD-B3CD-F4AE5061071B.dmp
04:49:56     INFO -  Operating system: Mac OS X
04:49:56     INFO -                    10.6.8 10K549
04:49:56     INFO -  CPU: amd64
04:49:56     INFO -       family 6 model 23 stepping 10
04:49:56     INFO -       2 CPUs
04:49:56     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
04:49:56     INFO -  Crash address: 0x10000000
04:49:56     INFO -  Thread 0 (crashed)
04:49:56     INFO -   0  XUL!nsSplittableFrame::RemoveFromFlow(nsIFrame*) [nsSplittableFrame.cpp:58bf8348c8f1 : 200 + 0x0]
04:49:56     INFO -      rbx = 0x000000015c5f56a0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x0000000010000000
04:49:56     INFO -      r15 = 0x0000000000000000   rip = 0x0000000103c66289
04:49:56     INFO -      rsp = 0x00007fff5fbfe0d0   rbp = 0x00007fff5fbfe0f0
04:49:56     INFO -      Found by: given as instruction pointer in context
04:49:56     INFO -   1  XUL!nsSplittableFrame::DestroyFrom(nsIFrame*) [nsSplittableFrame.cpp:58bf8348c8f1 : 38 + 0x7]
04:49:56     INFO -      rbx = 0x000000015c5f56a0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x000000012b699450
04:49:56     INFO -      r15 = 0x000000012b69a350   rip = 0x0000000103c661f3
04:49:56     INFO -      rsp = 0x00007fff5fbfe100   rbp = 0x00007fff5fbfe110
04:49:56     INFO -      Found by: call frame info
04:49:56     INFO -   2  XUL!nsFrameList::DestroyFramesFrom(nsIFrame*) [nsFrameList.cpp:58bf8348c8f1 : 54 + 0xb]
04:49:56     INFO -      rbx = 0x000000015c5f56a0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x000000012b699450
04:49:56     INFO -      r15 = 0x000000012b69a350   rip = 0x0000000103c19677
04:49:56     INFO -      rsp = 0x00007fff5fbfe120   rbp = 0x00007fff5fbfe140
04:49:56     INFO -      Found by: call frame info
04:49:56     INFO -   3  XUL!nsContainerFrame::DestroyFrom(nsIFrame*) [nsContainerFrame.cpp:58bf8348c8f1 : 201 + 0xb]
04:49:56     INFO -      rbx = 0x000000012b69a2f0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x000000012b699450
04:49:56     INFO -      r15 = 0x000000012b69a2f0   rip = 0x0000000103bc40df
04:49:56     INFO -      rsp = 0x00007fff5fbfe150   rbp = 0x00007fff5fbfe180
04:49:56     INFO -      Found by: call frame info
04:49:56     INFO -   4  XUL!nsFrameList::DestroyFramesFrom(nsIFrame*) [nsFrameList.cpp:58bf8348c8f1 : 54 + 0xb]
04:49:56     INFO -      rbx = 0x000000012b69a2f0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x000000012b699450
04:49:56     INFO -      r15 = 0x000000012b69a1e8   rip = 0x0000000103c19677
04:49:56     INFO -      rsp = 0x00007fff5fbfe190   rbp = 0x00007fff5fbfe1b0
04:49:56     INFO -      Found by: call frame info
}

Mats Palmgren (inactive)

Comment 1

•

10 years ago

Attached file relevant part from Full Log — Details

Mats Palmgren (inactive)

Comment 2

•

10 years ago

> 04:49:35     INFO -  TEST-INFO | Main app process: killed by SIGHUP

It's not clear to me if that means the firefox process was killed
because it didn't ignore/handle that signal and that the crash stack
is just where it happened to be at that point and thus irrelevant.

Same thing occurred in bug 1029771.

I'm not very familiar with our signal handling setup,
Benjamin do you know?

Flags: needinfo?(benjamin)

Mats Palmgren (inactive)

Comment 3

•

10 years ago

... then again, this stack also has SVGDocumentWrapper::DestroyViewer()
like bug 1029771 which seems unlikely to be a coincidence.  So perhaps
the "Main app process: killed by SIGHUP" is irrelevant.

Mats Palmgren (inactive)

Comment 4

•

10 years ago

So this is a bit interesting:
http://hg.mozilla.org/mozilla-central/annotate/606848e8adfc/image/src/SVGDocumentWrapper.cpp#l161

I wonder if need to make SVGDocumentWrapper::DestroyViewer()
use a local strong ref and null out mViewer *before* calling
Destroy etc
http://hg.mozilla.org/mozilla-central/annotate/606848e8adfc/image/src/SVGDocumentWrapper.cpp#l61

Daniel, do you understand these crashes?

Flags: needinfo?(benjamin) → needinfo?(dholbert)

Daniel Holbert [:dholbert]

Comment 5

•

10 years ago

(In reply to Mats Palmgren (:mats) from comment #4)
> I wonder if need to make SVGDocumentWrapper::DestroyViewer()
> use a local strong ref and null out mViewer *before* calling
> Destroy etc

That might be wise, though I don't immediately see how that would help here.  From the backtrace, it looks like we're just tripping over a broken frame while tearing down the internal document.

Are you concerned about DestroyViewer() triggering some code that causes synchronous usage of the image from one of its clients?  I'd hope that the Destroy() code wouldn't trigger any painting or notifications, but I can imagine that being possibly problematic, if it did.

> Daniel, do you understand these crashes?

No. :-/  Based on the log, though, I'm guessing it's from this crashtest:
http://mxr.mozilla.org/mozilla-central/source/image/test/crashtests/844403-1.html?force=1

(That's the only "--DOMWINDOW" in the log for a SVG-as-an-image-related test, I think)

Flags: needinfo?(dholbert)

Summary: Intermittent PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)] (after: "NS_ENSURE_TRUE(mTextInputHandler) failed" and "ABORT: Aborting on channel error.") → Intermittent PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)] (after: "NS_ENSURE_TRUE(mTextInputHandler) failed" and "ABORT: Aborting on channel error."), inside of SVGDocumentWrapper::DestroyViewer()

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Comment 6

•

10 years ago

It looks to me like what happened here is that:

we hit an ABORT in a child process (during the parent process shutdown, even):

###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-osx64-d-00000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532

and then something in the automation decided to kill the parent process as a result and report the current parent process stack.  So I think the parent process crash dump is probably unrelated, but the stack walks in the log might be useful.

There seem to be other instances of this problem:
https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&list_id=10610029&short_desc=Aborting%20on%20channel%20error&short_desc_type=casesubstring

I'm not sure if I'm reading this at all correctly, though.  But I think the nsSplittableFrame-related stack is not related to what happened.

Flags: needinfo?(ted)

Flags: needinfo?(benjamin)

Comment hidden (Legacy TBPL/Treeherder Robot)

KWierso
https://tbpl.mozilla.org/php/getParsedLog.php?id=42870566&tree=Mozilla-Inbound
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test crashtest on 2014-07-01 11:01:41
revision: 6598283d4cc8
slave: t-snow-r4-0058

[950] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-osx64-d-00000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532
[950] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-osx64-d-00000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532
TEST-UNEXPECTED-FAIL | Shutdown | Exited with code 1 during test run
PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)]
Return code: 1

Benjamin Smedberg

Comment 8

•

10 years ago

We're definitely seeing the following errors in the child:

* the child has some kind of connection error and aborts.
* In the process of aborting, it calls NS_RUNTIMEABORT on a non-main thread, which attempts to set a crash annotation. But crash annotations in child processes are only supported on the main thread and so there is a secondary NS_ASSERTION.

However, I suspect that all the spew from the child is just because the parent process already crashed, and the crash stack in the parent at nsSplittableFrame::RemoveFromFlow is the real problem here.

The "killed by SIGHUP" is confusing, but all Mac crashes show up like that. Example: https://tbpl.mozilla.org/php/getParsedLog.php?id=43246976&tree=Mozilla-Central&full=1

Flags: needinfo?(benjamin)

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Updated

•

10 years ago

Flags: needinfo?(ted)

Ryan VanderMeulen [:RyanVM]

Updated

•

10 years ago

Status: NEW → RESOLVED

Closed: 10 years ago

Keywords: intermittent-failure

Resolution: --- → DUPLICATE

(not currently active) Ted Mielczarek

Comment 10

•

10 years ago

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #8)
> * In the process of aborting, it calls NS_RUNTIMEABORT on a non-main thread,
> which attempts to set a crash annotation. But crash annotations in child
> processes are only supported on the main thread and so there is a secondary
> NS_ASSERTION.

FWIW that's filed as bug 991824.

Bugzilla

Quick Search

Intermittent PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)] (after: "NS_ENSURE_TRUE(mTextInputHandler) failed" and "ABORT: Aborting on channel error."), inside of SVGDocumentWrapper::DestroyViewer()

Categories

(Core :: Layout, defect)

Tracking

()

People

(Reporter: emorley, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Comment 1

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Comment 8

Updated

Updated

Comment 10

Attachment

General

Description

File Name

Content Type