906961 - Killing the settings app causes b2g to crash

Status: RESOLVED DUPLICATE of bug 904637

(Core :: Storage: IndexedDB, defect)

Description

[Dave Hylands [:dhylands]]

Attachment: adb logcat -v threadtime output

I observed the following on my unagi running on master:

STR:
1 - boot phone
2 - launch settings
3 - long press home button
4 - swipe up on settings card
5 - b2g crashes

I was using a VARIANT=userdebug build, all repositories updated today.

I got this backtrace from the Settings app:

Program received signal SIGSEGV, Segmentation fault.
(gdb) bt
#0  0x413b1a5e in mozilla::ipc::FileDescriptor::CloseCurrentProcessHandle (this=<value optimized out>) at /home/work/B2G-unagi/birch/ipc/glue/FileDescriptor.cpp:68
#1  0x41396dc4 in ~FileDescriptor (this=0x40429bc0, __in_chrg=<value optimized out>) at ../../dist/include/mozilla/ipc/FileDescriptor.h:75
#2  ~CachedFileDescriptorInfo (this=0x40429bc0, __in_chrg=<value optimized out>) at /home/work/B2G-unagi/birch/dom/ipc/TabChild.cpp:130
#3  0x41397044 in ~nsAutoPtr (this=<value optimized out>, start=69, count=3534569321) at /home/work/B2G-unagi/birch/dom/ipc/../../xpcom/base/nsAutoPtr.h:77
#4  nsTArrayElementTraits<nsAutoPtr<mozilla::dom::TabChild::CachedFileDescriptorInfo> >::Destruct (this=<value optimized out>, start=69, count=3534569321) at ../../dist/include/nsTArray.h:534
#5  nsTArray_Impl<nsAutoPtr<mozilla::dom::TabChild::CachedFileDescriptorInfo>, nsTArrayInfallibleAllocator>::DestructRange (this=<value optimized out>, start=69, count=3534569321)
    at ../../dist/include/nsTArray.h:1549
#6  0x41399130 in nsTArray_Impl<nsAutoPtr<mozilla::dom::TabChild::CachedFileDescriptorInfo>, nsTArrayInfallibleAllocator>::RemoveElementsAt (this=0x40492b14, start=0, count=1)
    at ../../dist/include/nsTArray.h:1266
#7  0x4139918a in nsTArray_Impl<nsAutoPtr<mozilla::dom::TabChild::CachedFileDescriptorInfo>, nsTArrayInfallibleAllocator>::Clear (this=0x40492b14, __in_chrg=<value optimized out>)
    at ../../dist/include/nsTArray.h:1277
#8  ~nsTArray_Impl (this=0x40492b14, __in_chrg=<value optimized out>) at ../../dist/include/nsTArray.h:748
#9  ~nsTArray (this=0x40492b14, __in_chrg=<value optimized out>) at ../../dist/include/nsTArray.h:1623
#10 ~nsAutoArrayBase (this=0x40492b14, __in_chrg=<value optimized out>) at ../../dist/include/nsTArray.h:1662
#11 ~nsAutoTArray (this=0x40492b14, __in_chrg=<value optimized out>) at ../../dist/include/nsTArray.h:1733
#12 0x41399284 in ~TabChild (this=0x404929b0, __in_chrg=<value optimized out>) at /home/work/B2G-unagi/birch/dom/ipc/TabChild.cpp:1236
#13 0x41399300 in ~TabChild (this=0x404929b0, __in_chrg=<value optimized out>) at /home/work/B2G-unagi/birch/dom/ipc/TabChild.cpp:1236
#14 0x41395aea in mozilla::dom::TabChild::Release (this=0x404929b0) at /home/work/B2G-unagi/birch/dom/ipc/TabChild.cpp:808
#15 0x40cdab52 in mozilla::dom::CallbackObjectHolder<mozilla::dom::EventListener, nsIDOMEventListener>::UnlinkSelf (this=0x447bcd5c) at ../../../dist/include/mozilla/dom/CallbackObject.h:362
#16 0x40cddcb8 in ~CallbackObjectHolder (this=0x4476b474, start=0, count=7) at ../../../dist/include/mozilla/dom/CallbackObject.h:216
#17 ~nsListenerStruct (this=0x4476b474, start=0, count=7) at /home/work/B2G-unagi/birch/content/events/src/nsEventListenerManager.h:192
#18 nsTArrayElementTraits<nsListenerStruct>::Destruct (this=0x4476b474, start=0, count=7) at ../../../dist/include/nsTArray.h:534
#19 nsTArray_Impl<nsListenerStruct, nsTArrayInfallibleAllocator>::DestructRange (this=0x4476b474, start=0, count=7) at ../../../dist/include/nsTArray.h:1549
#20 nsTArray_Impl<nsListenerStruct, nsTArrayInfallibleAllocator>::RemoveElementsAt (this=0x4476b474, start=0, count=7) at ../../../dist/include/nsTArray.h:1266
#21 0x40cde24a in nsTArray_Impl<nsListenerStruct, nsTArrayInfallibleAllocator>::Clear (this=0x4476b460) at ../../../dist/include/nsTArray.h:1277
#22 nsAutoTObserverArray<nsListenerStruct, 2u>::Clear (this=0x4476b460) at ../../../dist/include/nsTObserverArray.h:241
#23 nsEventListenerManager::RemoveAllListeners (this=0x4476b460) at /home/work/B2G-unagi/birch/content/events/src/nsEventListenerManager.cpp:150
#24 0x40cde266 in nsEventListenerManager::Disconnect (this=0x4476b474) at /home/work/B2G-unagi/birch/content/events/src/nsEventListenerManager.cpp:1074
#25 0x40ea8af6 in ~nsWindowRoot (this=0x44763520, __in_chrg=<value optimized out>) at /home/work/B2G-unagi/birch/dom/base/nsWindowRoot.cpp:42
#26 0x40ea8b2c in ~nsWindowRoot (this=0x4476b474, __in_chrg=<value optimized out>) at /home/work/B2G-unagi/birch/dom/base/nsWindowRoot.cpp:44
#27 0x40c3bcfe in nsFrameLoader::DeleteCycleCollectable (this=0x4476b474) at /home/work/B2G-unagi/birch/content/base/src/nsFrameLoader.cpp:261
#28 0x40ea7fc2 in nsWindowRoot::cycleCollection::DeleteCycleCollectable (this=<value optimized out>, p=<value optimized out>) at /home/work/B2G-unagi/birch/dom/base/nsWindowRoot.h:56
#29 0x417bc248 in ~SnowWhiteKiller (this=0xbeac3cc4, __in_chrg=<value optimized out>) at /home/work/B2G-unagi/birch/xpcom/base/nsCycleCollector.cpp:2002
#30 0x417bcea8 in nsCycleCollector::FreeSnowWhite (this=0x40458000, aUntilNoSWInPurpleBuffer=<value optimized out>) at /home/work/B2G-unagi/birch/xpcom/base/nsCycleCollector.cpp:2109
#31 0x417bdae0 in nsCycleCollector::Collect (this=0x40458000, aCCType=ManualCC, aResults=0xbeac7c18, aListener=0x0) at /home/work/B2G-unagi/birch/xpcom/base/nsCycleCollector.cpp:2716
#32 0x417bdbe4 in nsCycleCollector_collect (aManuallyTriggered=true, aResults=0xbeac7c18, aListener=0x0) at /home/work/B2G-unagi/birch/xpcom/base/nsCycleCollector.cpp:3162
#33 0x40e8b5f6 in nsJSContext::CycleCollectNow (aListener=<value optimized out>, aExtraForgetSkippableCalls=0, aManuallyTriggered=<value optimized out>)
    at /home/work/B2G-unagi/birch/dom/base/nsJSEnvironment.cpp:2070
#34 0x40e8bbb0 in nsJSEnvironmentObserver::Observe (this=<value optimized out>, aSubject=<value optimized out>, aTopic=<value optimized out>, aData=<value optimized out>)
    at /home/work/B2G-unagi/birch/dom/base/nsJSEnvironment.cpp:247
#35 0x4178ab42 in nsObserverList::NotifyObservers (this=<value optimized out>, aSubject=0x0, aTopic=0x421e9b11 "memory-pressure", someData=0x4248a0b2)
    at /home/work/B2G-unagi/birch/xpcom/ds/nsObserverList.cpp:96
#36 0x4178ad54 in nsObserverService::NotifyObservers (this=<value optimized out>, aSubject=0x0, aTopic=0x421e9b11 "memory-pressure", someData=0x4248a0b2)
    at /home/work/B2G-unagi/birch/xpcom/ds/nsObserverService.cpp:161
#37 0x417c428a in Run (this=0x44ba8f40) at /home/work/B2G-unagi/birch/xpcom/base/nsMemoryReporterManager.cpp:1161
#38 0x417b1e40 in nsThread::ProcessNextEvent (this=0x40402390, mayWait=<value optimized out>, result=0xbeac7dcf) at /home/work/B2G-unagi/birch/xpcom/threads/nsThread.cpp:622
#39 0x4177ae22 in NS_ProcessNextEvent (thread=0x40402390, mayWait=false) at /home/work/B2G-unagi/objdir-gecko-debug-userdebug-birch/xpcom/build/nsThreadUtils.cpp:238
#40 0x413b511c in mozilla::ipc::MessagePump::Run (this=0x40401bb0, aDelegate=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/glue/MessagePump.cpp:81
#41 0x413b529c in mozilla::ipc::MessagePumpForChildProcess::Run (this=0x40401bb0, aDelegate=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/glue/MessagePump.cpp:234
#42 0x417ddfc2 in MessageLoop::RunInternal (this=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:220
#43 0x417ddfda in MessageLoop::RunHandler (this=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:213
#44 MessageLoop::Run (this=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:187
#45 0x4133c792 in nsBaseAppShell::Run (this=0x442a0f40) at /home/work/B2G-unagi/birch/widget/xpwidgets/nsBaseAppShell.cpp:161
#46 0x407d15d6 in XRE_RunAppShell () at /home/work/B2G-unagi/birch/toolkit/xre/nsEmbedFunctions.cpp:679
#47 0x413b5206 in mozilla::ipc::MessagePumpForChildProcess::Run (this=0x40401bb0, aDelegate=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/glue/MessagePump.cpp:201
#48 0x417ddfc2 in MessageLoop::RunInternal (this=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:220
#49 0x417ddfda in MessageLoop::RunHandler (this=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:213
#50 MessageLoop::Run (this=0xbeac888c) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:187
#51 0x407d1eb0 in XRE_InitChildProcess (aArgc=2, aArgv=0xbeac89a0, aProcess=1078200320) at /home/work/B2G-unagi/birch/toolkit/xre/nsEmbedFunctions.cpp:516
#52 0x00008786 in main (argc=7, argv=0xbeac8a24) at /home/work/B2G-unagi/birch/ipc/app/MozillaRuntimeMain.cpp:85


And this backtrace from the b2g process:

Program received signal SIGSEGV, Segmentation fault.
0x415451c8 in mozilla::dom::indexedDB::IndexedDBParent::Disconnect (this=<value optimized out>) at /home/work/B2G-unagi/birch/dom/indexedDB/ipc/IndexedDBParent.cpp:85
85	  MOZ_ASSERT(!mDisconnected);
(gdb) bt
#0  0x415451c8 in mozilla::dom::indexedDB::IndexedDBParent::Disconnect (this=<value optimized out>) at /home/work/B2G-unagi/birch/dom/indexedDB/ipc/IndexedDBParent.cpp:85
#1  0x41954262 in mozilla::dom::ContentParent::ShutDownProcess (this=0x46816400, aCloseWithError=true) at /home/work/B2G-unagi/birch/dom/ipc/ContentParent.cpp:841
#2  0x41954b02 in mozilla::dom::ContentParent::ActorDestroy (this=0x46816400, why=mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::NormalShutdown)
    at /home/work/B2G-unagi/birch/dom/ipc/ContentParent.cpp:1076
#3  0x419ee77a in mozilla::dom::PContentParent::DestroySubtree (this=0x46816400, why=mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::NormalShutdown)
    at /home/work/B2G-unagi/objdir-gecko-debug-userdebug-birch/ipc/ipdl/PContentParent.cpp:3915
#4  0x419ee8d6 in mozilla::dom::PContentParent::OnChannelClose (this=0x42886022) at /home/work/B2G-unagi/objdir-gecko-debug-userdebug-birch/ipc/ipdl/PContentParent.cpp:3667
#5  0x4197d002 in mozilla::ipc::AsyncChannel::NotifyChannelClosed (this=0x46816410) at /home/work/B2G-unagi/birch/ipc/glue/AsyncChannel.cpp:560
#6  0x4197e10e in mozilla::ipc::AsyncChannel::Close (this=0x46816410) at /home/work/B2G-unagi/birch/ipc/glue/AsyncChannel.cpp:432
#7  0x419e6414 in mozilla::dom::PContentParent::Close (this=<value optimized out>) at /home/work/B2G-unagi/objdir-gecko-debug-userdebug-birch/ipc/ipdl/PContentParent.cpp:289
#8  0x4195427e in mozilla::dom::ContentParent::ShutDownProcess (this=0x46816400, aCloseWithError=false) at /home/work/B2G-unagi/birch/dom/ipc/ContentParent.cpp:852
#9  0x4194e83c in DispatchToMethod<mozilla::dom::ContentParent, void (mozilla::dom::ContentParent::*)(bool), bool> (this=0x1) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/tuple.h:393
#10 RunnableMethod<mozilla::dom::ContentParent, void (mozilla::dom::ContentParent::*)(bool), Tuple1<bool> >::Run (this=0x1) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/task.h:307
#11 0x41daaab8 in MessageLoop::RunTask (this=0x4043e0c0, task=0x454b67a0) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:338
#12 0x41dab1ae in MessageLoop::DeferOrRunPendingTask (this=0x0, pending_task=<value optimized out>) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:346
#13 0x41dabdf4 in MessageLoop::DoWork (this=0x4043e0c0) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:446
#14 0x41981f58 in mozilla::ipc::DoWorkRunnable::Run (this=<value optimized out>) at /home/work/B2G-unagi/birch/ipc/glue/MessagePump.cpp:41
#15 0x41d7ee40 in nsThread::ProcessNextEvent (this=0x40402550, mayWait=<value optimized out>, result=0xbebea727) at /home/work/B2G-unagi/birch/xpcom/threads/nsThread.cpp:622
#16 0x41d47e22 in NS_ProcessNextEvent (thread=0x40402550, mayWait=false) at /home/work/B2G-unagi/objdir-gecko-debug-userdebug-birch/xpcom/build/nsThreadUtils.cpp:238
#17 0x4198211c in mozilla::ipc::MessagePump::Run (this=0x40401d90, aDelegate=0x4043e0c0) at /home/work/B2G-unagi/birch/ipc/glue/MessagePump.cpp:81
#18 0x41daafc2 in MessageLoop::RunInternal (this=0x4043e0c0) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:220
#19 0x41daafda in MessageLoop::RunHandler (this=0x4043e0c0) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:213
#20 MessageLoop::Run (this=0x4043e0c0) at /home/work/B2G-unagi/birch/ipc/chromium/src/base/message_loop.cc:187
#21 0x41909792 in nsBaseAppShell::Run (this=0x442403a0) at /home/work/B2G-unagi/birch/widget/xpwidgets/nsBaseAppShell.cpp:161
#22 0x4181d96e in nsAppStartup::Run (this=0x443f8520) at /home/work/B2G-unagi/birch/toolkit/components/startup/nsAppStartup.cpp:269
#23 0x40d9aefc in XREMain::XRE_mainRun (this=0xbebea994) at /home/work/B2G-unagi/birch/toolkit/xre/nsAppRunner.cpp:3863
#24 0x40d9db4a in XREMain::XRE_main (this=0xbebea994, argc=<value optimized out>, argv=<value optimized out>, aAppData=0x21810) at /home/work/B2G-unagi/birch/toolkit/xre/nsAppRunner.cpp:3931
#25 0x40d9dce0 in XRE_main (argc=1, argv=0xbebecb84, aAppData=0x21810, aFlags=<value optimized out>) at /home/work/B2G-unagi/birch/toolkit/xre/nsAppRunner.cpp:4133
#26 0x00009b94 in do_main (argc=1, argv=0xbebecb84) at /home/work/B2G-unagi/birch/b2g/app/nsBrowserApp.cpp:168
#27 main (argc=1, argv=0xbebecb84) at /home/work/B2G-unagi/birch/b2g/app/nsBrowserApp.cpp:261

Comment 1

[Dave Hylands [:dhylands]]

So the short version of errors from logcat:

Main Process:

[JavaScript Error: "currentCard.addEventListener is not a function" {file: "app://system.gaiamobile.org/js/cards_view.js" line: 542}]

Assertion failure: !mDisconnected, at /home/work/B2G-unagi/birch/dom/indexedDB/ipc/IndexedDBParent.cpp:85

And settings app:

[JavaScript Error: "NS_ERROR_INVALID_POINTER: Component returned failure code: 0x80004003 (NS_ERROR_INVALID_POINTER) [nsIMessageSender.sendAsyncMessage]" {file: "chrome://global/content/BrowserElementChildPreload.js" line: 41}]
[Child 428] WARNING: NS_ENSURE_TRUE(inBrowser) failed: file /home/work/B2G-unagi/birch/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp, line 83
Assertion failure: mHandleCreatedByOtherProcessWasUsed, at /home/work/B2G-unagi/birch/ipc/glue/FileDescriptor.cpp:69