1067709 - Startup crash in nsAutoLayoutPhase::Enter when a restore session screen is displayed

Status: NEW

(Core :: Widget: Cocoa, defect)

Description

[Jean-Yves Avenard [:jya]]

Attachment: crash.txt

This occurs in 10.6.8 (I know, I know... old)

When Firefox has crashed, the next time it is started it will show a "Restore Session" tab, hang for about 10s and suddenly crash.

Sorry no proper backtrace on that machine

Comment 1

[David Teller [:Yoric] - still alive but not very active]

Looks like a crash in layout. Nical, any idea where I should refile this?

Comment 2

[Jean-Yves Avenard [:jya]]

Also crashes during first startup when the user is prompted to import settings from Safari. The import wizard window is displayed and about 10s later Firefox crashes.

It appears to be the same issue.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I presume we're hitting the fatal assertion:

      MOZ_ASSERT(mPresContext->mLayoutPhaseCount[eLayoutPhase_Paint] == 0,
                 "recurring into paint");


The stack is pretty awful; in the middle of painting, we call into native theme drawing, which decides to spin up another even loop (!!) which then calls painting again.


I claim that native theme drawing code shouldn't spin the event loop.

Comment 4

[Steven Michaud [:smichaud] (Retired)]

> I claim that native theme drawing code shouldn't spin the event loop.

We can't avoid this completely.

For a long time (and on all platforms), nsAppShell has been designed to spin up a new native event loop if it's needed to avoid native event starvation, or to spin up a new Gecko event loop if it's needed to avoid Gecko event starvation.

We *can* try to keep this to a minimum.  For example that's what bug 996848 was about.  But we can't prevent it from ever happening.

That said, this particular case happens because we launch an external program (the atos commandline utility) and wait for its results.  So we can avoid it if we stop using any external program.  I've suggested a way to do this at bug 1036407 comment #6.  And as I mention at bug 1036407 comment #8, I've already done most of the work required.

Comment 5

[Steven Michaud [:smichaud] (Retired)]

Another way to work around this is to find out what exception is happening (the one that triggers the call to run atos), and stop it from happening.

The exception would normally get displayed in the system console.   Jean-Yves, do you see it there?

Comment 6

[Steven Michaud [:smichaud] (Retired)]

I tried and failed to reproduce these crashes on OS X 10.6.8, using today's mozilla-central and mozilla-central-debug nightlies.

Comment 7

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: another crash stack, not on startup but while in browser toolbox

FWIW I think I hit this today, but not on startup, rather while trying to debug some addon while in the browser toolbox (not the addon debug toolbox).

Comment 8

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

(but the browser toolbox is still up, so it was the regular nightly that crashed in case it's not obvious from the log. I've unable to reproduce)

Comment 9

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Actually, I can reproduce this (annoyingly).

STR:
- mach run (nightly debug) (I'm on OSX 10.9.5)
- Open browser toolbox, debug tab, and locate "PeerConnection.js"
  (I'm also seeing Bug 1171030 comment 3 here btw. My system is crawling when I do this)
- finally, set a breakpoint in PeerConnection.js on line 395 [1]
- Go to about:addons
- install this add-on attachment 8665096 [details] in nightly
  (unzip, jpm xpi, about:addons, Install Add-on From File...)
- Wait 10 seconds
- Firefox crashes with "Send to Apple" crash in comment 7, and this assert:

> Assertion failure: mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0 (painting in the middle of frame construction), at /Users/Jan/moz/mozilla-central/layout/base/nsAutoLayoutPhase.cpp:39

Full output:

> ★ ~/moz/mozilla-central $ mach run
>  0:00.16 /Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/firefox -no-remote -foreground -profile /Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/tmp/scratch_user
> [21224] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file /Users/Jan/moz/mozilla-central/dom/base/nsFrameLoader.cpp, line 269
> [21224] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file /Users/Jan/moz/mozilla-central/dom/base/nsFrameLoader.cpp, line 269
> [21224] WARNING: NS_ENSURE_TRUE(globalObject && globalObject->GetGlobalJSObject()) failed: file /Users/Jan/moz/mozilla-central/dom/base/nsDocument.cpp, line 8315
> [21224] WARNING: NS_ENSURE_TRUE(globalObject && globalObject->GetGlobalJSObject()) failed: file /Users/Jan/moz/mozilla-central/dom/base/nsDocument.cpp, line 8315
> [21224] WARNING: NS_ENSURE_TRUE(mTextInputHandler) failed: file /Users/Jan/moz/mozilla-central/widget/cocoa/nsChildView.mm, line 5373
> [21224] WARNING: NS_ENSURE_TRUE(mTextInputHandler) failed: file /Users/Jan/moz/mozilla-central/widget/cocoa/nsChildView.mm, line 5373
> [Child 21225] WARNING: '!compMgr', file /Users/Jan/moz/mozilla-central/xpcom/glue/nsComponentManagerUtils.cpp, line 63
> [Child 21225] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005: file /Users/Jan/moz/mozilla-central/toolkit/xre/nsXREDirProvider.cpp, line 1396
> [Parent 21224] WARNING: attempt to modify an immutable nsStandardURL: file /Users/Jan/moz/mozilla-central/netwerk/base/nsStandardURL.cpp, line 1299
> [Parent 21224] WARNING: Could not get disk information from DiskSpaceWatcher: file /Users/Jan/moz/mozilla-central/dom/storage/DOMStorageIPC.cpp, line 320
> [Child 21225] WARNING: nsAppShell::Exit() called redundantly: file /Users/Jan/moz/mozilla-central/widget/cocoa/nsAppShell.mm, line 679
> [Child 21225] WARNING: NS_ENSURE_TRUE(context) failed: file /Users/Jan/moz/mozilla-central/xpcom/threads/nsThread.cpp, line 777
> nsStringStats
>  => mAllocCount:          13960
>  => mReallocCount:          840
>  => mFreeCount:           13960
>  => mShareCount:          10005
>  => mAdoptCount:            906
>  => mAdoptFreeCount:        906
>  => Process ID: 21225, Thread ID: 140735274267408
> [Parent 21224] WARNING: Could not get disk status from nsIDiskSpaceWatcher: file /Users/Jan/moz/mozilla-central/uriloader/prefetch/nsOfflineCacheUpdateService.cpp, line 317
> [Parent 21224] WARNING: attempt to modify an immutable nsStandardURL: file /Users/Jan/moz/mozilla-central/netwerk/base/nsStandardURL.cpp, line 1299
> [Parent 21224] WARNING: Image width or height is non-positive: file /Users/Jan/moz/mozilla-central/layout/base/nsLayoutUtils.cpp, line 6294
> [Parent 21224] WARNING: Image width or height is non-positive: file /Users/Jan/moz/mozilla-central/layout/base/nsLayoutUtils.cpp, line 6294
> [Parent 21224] WARNING: Image width or height is non-positive: file /Users/Jan/moz/mozilla-central/layout/base/nsLayoutUtils.cpp, line 6294
> [Parent 21224] WARNING: Image width or height is non-positive: file /Users/Jan/moz/mozilla-central/layout/base/nsLayoutUtils.cpp, line 6294
JavaScript error: resource://gre/modules/XPCOMUtils.jsm, line 189: TypeError: can't redefine non-configurable property "Services"
> [Parent 21224] WARNING: dependent window created without a parent: file /Users/Jan/moz/mozilla-central/toolkit/components/startup/nsAppStartup.cpp, line 662
> [21226] WARNING: NS_ENSURE_TRUE(mTextInputHandler) failed: file /Users/Jan/moz/mozilla-central/widget/cocoa/nsChildView.mm, line 5373
> [Parent 21224] WARNING: NS_ENSURE_TRUE(mTextInputHandler) failed: file /Users/Jan/moz/mozilla-central/widget/cocoa/nsChildView.mm, line 5373
> [21226] WARNING: NS_ENSURE_TRUE(mTextInputHandler) failed: file /Users/Jan/moz/mozilla-central/widget/cocoa/nsChildView.mm, line 5373
> Chrome file doesn't exist: /Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/Resources/browser/chrome/devtools/content/debugger/views/event-listeners-view.js
> Failed to load file:///Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/Resources/browser/chrome/devtools/content/debugger/views/event-listeners-view.js
> [21226] WARNING: Image width or height is non-positive: file /Users/Jan/moz/mozilla-central/layout/base/nsLayoutUtils.cpp, line 6294
> [21226] WARNING: Image width or height is non-positive: file /Users/Jan/moz/mozilla-central/layout/base/nsLayoutUtils.cpp, line 6294
> [Parent 21224] ###!!! ASSERTION: Double-freezing?: '!IsFrozen()', file /Users/Jan/moz/mozilla-central/dom/base/nsGlobalWindow.h, line 1511
> [Parent 21224] ###!!! ASSERTION: Double-freezing?: '!IsFrozen()', file /Users/Jan/moz/mozilla-central/dom/base/nsGlobalWindow.h, line 1511
> [Parent 21224] ###!!! ASSERTION: Double-freezing?: '!IsFrozen()', file /Users/Jan/moz/mozilla-central/dom/base/nsGlobalWindow.h, line 1511
> [Parent 21224] ###!!! ASSERTION: Double-freezing?: '!IsFrozen()', file /Users/Jan/moz/mozilla-central/dom/base/nsGlobalWindow.h, line 1511
> 1444919486581	addons.xpi	WARN	Invalid XPI: signature is required but missing
> Assertion failure: mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0 (painting in the middle of frame construction), at /Users/Jan/moz/mozilla-central/layout/base/nsAutoLayoutPhase.cpp:39
> #01: nsAutoLayoutPhase::Enter()[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x45f9dfa]
> #02: nsAutoLayoutPhase::nsAutoLayoutPhase(nsPresContext*, nsLayoutPhase)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x45f9c73]
> #03: nsAutoLayoutPhase::nsAutoLayoutPhase(nsPresContext*, nsLayoutPhase)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x45fa1c3]
> #04: PresShell::Paint(nsView*, nsRegion const&, unsigned int)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x46d2411]
> #05: nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4100ea3]
> #06: nsViewManager::ProcessPendingUpdatesForView(nsView*, bool)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4100a8c]
> #07: nsViewManager::ProcessPendingUpdates()[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4101b34]
> #08: nsRefreshDriver::Tick(long long, mozilla::TimeStamp)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x457ed89]
> #09: mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, long long, mozilla::TimeStamp)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x45879e6]
> #10: mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x45878d5]
> #11: mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x458778d]
> #12: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4587704]
> #13: void nsRunnableMethodArguments<mozilla::TimeStamp>::apply<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp)>(mozilla::VsyncRefreshDriverTimer::RefreshDr[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4588174]
> #14: nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run()[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4587f2c]
> #15: nsThread::ProcessNextEvent(bool, bool*)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1a973f]
> #16: NS_ProcessNextEvent(nsIThread*, bool)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x234107]
> #17: mozilla::jsinspector::nsJSInspector::EnterNestedEventLoop(JS::Handle<JS::Value>, unsigned int*)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x546c6f4]
> #18: NS_InvokeByIndex[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1de262]
> #19: CallMethodHelper::Invoke()[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x12fd1d8]
> #20: CallMethodHelper::Call()[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x12ea697]
> #21: XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x12c7a30]
> #22: XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)[/Users/Jan/moz/mozilla-central/obj-x86_64-apple-darwin12.2.1-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x12c9bc0]
> ★ ~/moz/mozilla-central $ 


[1] http://mxr.mozilla.org/mozilla-central/source/dom/media/PeerConnection.js?rev=3adc12ed39e2#395

Comment 10

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

(I forgot to inline one line in the output. should be one contiguous output)

Comment 11

[Jim Mathies [:jimm]]

I don't see this on crash stats, not tracking.

https://crash-stats.mozilla.com/search/?product=Firefox&signature=~nsAutoLayoutPhase%3A%3AEnter&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform