494027 - Crash @NS_NotifyPluginCall on tinderbox shortly after plugin tests run

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Jim Mathies [:jimm]]

TEST-PASS | chrome://mochikit/content/browser/xpinstall/tests/browser_whitelist6.js | Install should have been triggered by the right uri

Browser Chrome Test Summary
	Pass: 2936
	Fail: 0
	Todo: 5

*** End BrowserChrome Test Results ***
NEXT ERROR TEST-UNEXPECTED-FAIL | (automation.py) | Exited with code 1 during test run
INFO | (automation.py) | Application ran for: 0:02:39.939859
TEST-UNEXPECTED-FAIL | (automation.py) | Browser crashed (minidump found)
Operating system: Linux
                  0.0.0 Linux 2.6.18-53.1.19.el5 #1 SMP Wed May 7 08:20:19 EDT 2008 i686 GNU/Linux
CPU: x86
     GenuineIntel family 13 model 23 stepping 8
     1 CPU

Crash reason:  SIGSEGV
Crash address: 0x408cc65a

Thread 0 (crashed)
 0  libxul.so!NS_NotifyPluginCall(unsigned int) [nsNPAPIPlugin.cpp:5134c1c002de : 238 + 0x6]
    eip = 0x408cc65a   esp = 0xbfe1b150   ebp = 0xbfe1b218   ebx = 0x40dc0ca0
    esi = 0x000003e8   edi = 0x00000000   eax = 0x40c98309   ecx = 0xbfe1b18c
    edx = 0x00000000   efl = 0x00210282
 1  libxul.so!nsNPAPIPlugin::Shutdown() [nsNPAPIPlugin.cpp:5134c1c002de : 743 + 0x12]
    eip = 0x408cc719   esp = 0xbfe1b220   ebp = 0xbfe1b248
 2  libxul.so!nsPluginTag::TryUnloadPlugin(int) [nsPluginHostImpl.cpp:5134c1c002de : 1087 + 0x8]
    eip = 0x408d178c   esp = 0xbfe1b250   ebp = 0xbfe1b268
 3  libxul.so!nsPluginTag::~nsPluginTag() [nsPluginHostImpl.cpp:5134c1c002de : 862 + 0x7]
    eip = 0x408d7885   esp = 0xbfe1b270   ebp = 0xbfe1b298
 4  libxul.so!nsPluginTag::Release() [nsPluginHostImpl.cpp:5134c1c002de : 887 + 0xa]
    eip = 0x408d79b2   esp = 0xbfe1b2a0   ebp = 0xbfe1b2c8
 5  libxul.so!XPCJSRuntime::GCCallback(JSContext*, JSGCStatus) [xpcjsruntime.cpp:5134c1c002de : 780 + 0x7]
    eip = 0x401df104   esp = 0xbfe1b2d0   ebp = 0xbfe1b318
 6  libxul.so!DOMGCCallback(JSContext*, JSGCStatus) [nsJSEnvironment.cpp:5134c1c002de : 3631 + 0x11]
    eip = 0x4060ddd8   esp = 0xbfe1b320   ebp = 0xbfe1b348
 7  libxul.so!XPCCycleCollectGCCallback(JSContext*, JSGCStatus) [nsXPConnect.cpp:5134c1c002de : 411 + 0x16]
    eip = 0x401ca86e   esp = 0xbfe1b350   ebp = 0xbfe1b378
 8  libmozjs.so!js_GC [jsgc.cpp:5134c1c002de : 3788 + 0x8]
    eip = 0x40e34fea   esp = 0xbfe1b380   ebp = 0xbfe1b448
 9  libmozjs.so!JS_GC [jsapi.cpp:5134c1c002de : 2462 + 0x9]
    eip = 0x40e0fb6b   esp = 0xbfe1b450   ebp = 0xbfe1b468
10  libxul.so!nsXPConnect::Collect() [nsXPConnect.cpp:5134c1c002de : 477 + 0x4]
    eip = 0x401c7f25   esp = 0xbfe1b470   ebp = 0xbfe1b528
11  libxul.so!nsCycleCollector::Collect(unsigned int) [nsCycleCollector.cpp:5134c1c002de : 2340 + 0x8]
    eip = 0x40a912e0   esp = 0xbfe1b530   ebp = 0xbfe1f3e8
12  libxul.so!nsCycleCollector_shutdown() [nsCycleCollector.cpp:5134c1c002de : 2559 + 0x9]
    eip = 0x40a913ec   esp = 0xbfe1f3f0   ebp = 0xbfe1f408
13  libxul.so!NS_ShutdownXPCOM_P [nsXPComInit.cpp:5134c1c002de : 824 + 0x4]
    eip = 0x40a5661e   esp = 0xbfe1f410   ebp = 0xbfe1f448
14  libxul.so!ScopedXPCOMStartup::~ScopedXPCOMStartup() [nsAppRunner.cpp:5134c1c002de : 951 + 0x7]
    eip = 0x401b1d25   esp = 0xbfe1f450   ebp = 0xbfe1f488
15  libxul.so!XRE_main [nsAppRunner.cpp:5134c1c002de : 3341 + 0xb]
    eip = 0x401b4e30   esp = 0xbfe1f490   ebp = 0xbfe1faa8
16  firefox-bin!main [nsBrowserApp.cpp:5134c1c002de : 156 + 0xe]
    eip = 0x080495b1   esp = 0xbfe1fab0   ebp = 0xbfe1fb08
17  libc-2.5.so + 0x15deb
    eip = 0x00aa6dec   esp = 0xbfe1fb10   ebp = 0xbfe1fb78


http://tinderbox.mozilla.org/showlog.cgi?tree=Firefox3.5&errorparser=unittest&logfile=1242846711.1242852233.28942.gz&buildtime=1242846711&buildname=Linux%20mozilla-1.9.1%20unit%20test&fulltext=1

Comment 1

[Jim Mathies [:jimm]]

we had three of these in a row and then they cleared up.

Comment 2

[cajbir (:cajbir)]

This happened just now:
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242886634.1242891408.31250.gz#err0

Comment 3

[Jim Mathies [:jimm]]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242893421.1242900588.13939.gz

Comment 4

[Karl Tomlinson (:karlt)]

http://tinderbox.mozilla.org/showlog.cgi?tree=Firefox3.5&errorparser=unittest&logfile=1242957588.1242963046.9174.gz&buildtime=1242957588&buildname=Linux%20mozilla-1.9.1%20unit%20test&fulltext=1#err0

Comment 5

[Karl Tomlinson (:karlt)]

Source for stack:

http://hg.mozilla.org/releases/mozilla-1.9.1/file/5134c1c002de/modules/plugin/base/src/nsNPAPIPlugin.cpp#l237
http://hg.mozilla.org/releases/mozilla-1.9.1/file/5134c1c002de/modules/plugin/base/src/nsNPAPIPlugin.cpp#l743
http://hg.mozilla.org/releases/mozilla-1.9.1/file/5134c1c002de/modules/plugin/base/src/nsPluginHostImpl.cpp#l1087
http://hg.mozilla.org/releases/mozilla-1.9.1/file/5134c1c002de/modules/plugin/base/src/nsPluginHostImpl.cpp#l862

Comment 6

[Karl Tomlinson (:karlt)]

I wonder:

Why is the plugin not unloaded (or cycles collected) before NS_ShutdownXPCOM_P is called?

For how long (after NS_ShutdownXPCOM_P is called) will do_GetService("@mozilla.org/observer-service;1") return non-NULL?

Comment 7

[Karl Tomlinson (:karlt)]

Could doing less GC on shutdown have triggered a latent bug here?

I don't know why this would be only happening on 1.9.1 though.

Comment 8

[Karl Tomlinson (:karlt)]

Similar crash reports with Firefox 3.6a1pre on Windows.
Timing seems close to trunk landing of bug 490592.

bp-792571ce-33e7-4167-bc30-f29532090519
bp-f4c67901-dc36-4f37-96f3-181ca2090516
bp-edb6a467-32a1-4189-8ad2-d91e42090515

Comment 9

[Karl Tomlinson (:karlt)]

Attachment: null check do_GetService("@mozilla.org/observer-service;1")

This is the simple fix, provided there aren't other assumptions elsewhere about do_GetService() succeeding during NS_ShutdownXPCOM_P().

Comment 10

[Peter Van der Beken [:peterv]]

(In reply to comment #7)
> Could doing less GC on shutdown have triggered a latent bug here?

Could be (but there's probably other ways to trigger this bug).

> I don't know why this would be only happening on 1.9.1 though.

Cycles might be different, we might be collecting sooner due to patches that haven't been ported, ...

Comment 11

[Peter Van der Beken [:peterv]]

There are a bunch of these on 3.0.x too.

Comment 12

[Daniel Holbert [:dholbert]]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1243015194.1243022422.25301.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 10:59:54
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1243019550.1243024546.30447.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 12:12:30

These two logs from earlier this morning also look related, though the crash is at a slightly different place:
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242982693.1242987423.15260.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 01:58:13
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242983451.1242988175.16386.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 02:10:51

Comment 13

[Johnny Stenback (:jst)]

Comment on attachment 379084 [details] [diff] [review]
null check do_GetService("@mozilla.org/observer-service;1")

I'd be fine with taking this for 1.9.1, simple null check.

Comment 14

[Johnny Stenback (:jst)]

Fixed on trunk and branch.

http://hg.mozilla.org/mozilla-central/rev/87f97a1a89eb
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d657c16d21e5

Comment 15

[Daniel Holbert [:dholbert]]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1243030385.1243034979.18583.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 15:13:05

(note this was in a build that started before the fix landed in comment 14)