1185734 - crash in mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) | mozilla::jsipc::PJavaScriptPare...

Status: RESOLVED WORKSFORME

(Core :: IPC, defect)

Description

[alex_mayorga]

This bug was filed from the Socorro interface and is 
report bp-fdedeaa3-b815-47ba-8c9e-9d1ab2150719.
=============================================================

Top crasher #19 for Nightly for the past 7 days. Startup crash.

https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozalloc_abort%28char+const%2A+const%29+%7C+NS_DebugBreak+%7C+mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ADebugAbort%28char+const%2A%2C+int%2C+char+const%2A%2C+char+const%2A%2C+bool%29+%7C+mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ASend%28IPC%3A%3AMessage%2A%2C+IPC%3A%3AMessage%2A%29+%7C+mozilla%3A%3Ajsipc%3A%3APJavaScriptParent%3A%3ASendG...

Crashing Thread
Frame 	Module 	Signature 	Source
0 	mozglue.dll 	mozalloc_abort(char const* const) 	memory/mozalloc/mozalloc_abort.cpp
1 	xul.dll 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	xul.dll 	mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) 	ipc/glue/MessageChannel.cpp
3 	xul.dll 	mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) 	ipc/glue/MessageChannel.cpp
4 	xul.dll 	mozilla::jsipc::PJavaScriptParent::SendGet(unsigned __int64 const&, mozilla::jsipc::ObjectVariant const&, mozilla::jsipc::JSIDVariant const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*) 	obj-firefox/ipc/ipdl/PJavaScriptParent.cpp
5 	xul.dll 	mozilla::jsipc::JavaScriptBase<mozilla::jsipc::PJavaScriptParent>::SendGet(mozilla::jsipc::ObjectId const&, mozilla::jsipc::ObjectVariant const&, mozilla::jsipc::JSIDVariant const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*) 	js/ipc/JavaScriptBase.h
6 	xul.dll 	mozilla::jsipc::WrapperOwner::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/ipc/WrapperOwner.cpp
7 	xul.dll 	CPOWProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/ipc/WrapperOwner.cpp
8 	xul.dll 	js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/proxy/Proxy.cpp
9 	xul.dll 	js::DirectProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/proxy/DirectProxyHandler.cpp
10 	xul.dll 	js::CrossCompartmentWrapper::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/proxy/CrossCompartmentWrapper.cpp
11 	xul.dll 	xpc::AddonWrapper<js::CrossCompartmentWrapper>::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/xpconnect/wrappers/AddonWrapper.cpp
12 	xul.dll 	js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/proxy/Proxy.cpp
13 	xul.dll 	js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/vm/NativeObject.h
14 	xul.dll 	js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
15 	xul.dll 	js::jit::DoGetPropFallback 	js/src/jit/BaselineIC.cpp
16 		@0x2948d7d7cad

Comment 1

[Loic]

I foun STR with Nighty in e10s mode.

1) Enable e10s
2) Open about:preferences#privacy
3) In "History", select:
- Use custom settings for history
- Accept cookies from sites
- Accept third-party cookies: Never (it's optional, to bypass GG's cookies from safebrowsing)
- Keep until: ask me every time
4) Open a website with a "ton" of cookies like http://www.lemonde.fr/
5) Go back to the OS desktop
6) Hover the taskbar icon of Nightly to see the list of open tabs/pop-ups
7) Close directly from the list the tab about http://www.lemonde.fr/

Result: Nightly crashes.
https://crash-stats.mozilla.com/report/index/d4c45195-9b80-472a-95aa-bbe702150831

Comment 2

[Andrew McCreight [:mccr8]]

The crash in comment 1 is happening on this line:

IPC_ASSERT(DispatchingAsyncMessagePriority() != IPC::Message::PRIORITY_URGENT,
           "not allowed to send messages while dispatching urgent messages");

I don't see anything matching the search from crash in comment 0, but maybe the signature has changed. It is indeed crashing on the same line, though.

Comment 3

[Andrew McCreight [:mccr8]]

(In reply to Andrew McCreight [:mccr8] from comment #2)
> I don't see anything matching the search from crash in comment 0

Ah, yeah, I clicked on "more reports" in the crash report in comment 1 and this is still happening somewhat regularly.

Comment 5

[hannu.nyman]

With Aurora 42 x64 e10s I get slightly different crash signatures (end with "SendH" instead of "SendG"):

mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) | mozilla::jsipc::PJavaScriptParent::SendH... ]

Examples:
https://crash-stats.mozilla.com/report/index/14b26d4b-4bcc-40be-9943-b78ba2150905
https://crash-stats.mozilla.com/report/index/3e8c1cb7-1721-4dad-b859-be7972150905
https://crash-stats.mozilla.com/report/index/8873e123-50e3-459b-b43c-d29e22150815
https://crash-stats.mozilla.com/report/index/fc685acf-8ce7-4f80-94b6-afaea2150816

I mention the crashes here as they happen on the same line  "###!!! ABORT: not allowed to send messages while dispatching urgent messages"

My cookie settings are similar as in the STR in #1, except that I "always accept" third party cookies.

I have practically switched away from e10s due to the crash frequency. Today I decided to test e10s again and noted that Firefox still crashes :-(

Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:42.0) Gecko/20100101 Firefox/42.0 ID:20150904004016 CSet: a9d79eb7e02a

Comment 6

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I suspect what's happening is that our urgent "get cookie" message is causing us to put up a dialog and run a nested event loop. At that time we can send a CPOW down, which violates our rules.

Blake thinks we can maybe keep around the cookies for a site when it loads (maybe finding them through the HTTP channel). Then we wouldn't need a sync message at all. That would also improve performance.

Comment 7

[Tracy Walker [:tracy]]

This is hovering around top #20 on Nightly (currently #24 with just 16 crashes in the past week)

Comment 8

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This should have been fixed by CPOW cancellation.