Intermittent PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)] (after: "NS_ENSURE_TRUE(mTextInputHandler) failed" and "ABORT: Aborting on channel error."), inside of SVGDocumentWrapper::DestroyViewer()

RESOLVED DUPLICATE of bug 1010666

Status

()

Core
Layout
--
critical
RESOLVED DUPLICATE of bug 1010666
4 years ago
4 years ago

People

(Reporter: emorley, Unassigned)

Tracking

({crash})

Trunk
x86_64
Mac OS X
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test crashtest on 2014-06-30 04:36:46 PDT for push 58bf8348c8f1

slave: t-snow-r4-0058

https://tbpl.mozilla.org/php/getParsedLog.php?id=42759294&tree=Mozilla-Inbound

{
04:49:30     INFO -  REFTEST TEST-START | Shutdown
04:49:30     INFO -  --DOCSHELL 0x11bf64800 == 7 [pid = 957] [id = 71]
04:49:30     INFO -  --DOCSHELL 0x11dfec000 == 6 [pid = 957] [id = 2]
04:49:30     INFO -  --DOCSHELL 0x128b0a000 == 5 [pid = 957] [id = 262]
04:49:30     INFO -  [957] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file /builds/slave/m-in-osx64-d-00000000000000000/build/dom/events/ContentEventHandler.cpp, line 110
04:49:30     INFO -  --DOCSHELL 0x11eb8e000 == 4 [pid = 957] [id = 3]
04:49:30     INFO -  --DOCSHELL 0x11bff5800 == 3 [pid = 957] [id = 1]
04:49:30     INFO -  1896484032[10032e1a0]: Shutting down SCTP
04:49:30     INFO -  --DOCSHELL 0x126624800 == 2 [pid = 957] [id = 72]
04:49:30     INFO -  --DOCSHELL 0x12a511000 == 1 [pid = 957] [id = 261]
04:49:30     INFO -  --DOMWINDOW == 134 (0x12bea4000) [pid = 957] [serial = 5939] [outer = 0x12be9ac00] [url = about:blank]
04:49:30     INFO -  --DOMWINDOW == 133 (0x11dd30800) [pid = 957] [serial = 5822] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/dom/plugins/test/crashtests/540114-1.html]
04:49:30     INFO -  --DOMWINDOW == 132 (0x1292cb000) [pid = 957] [serial = 5807] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/image/test/crashtests/844403-1.html]
04:49:30     INFO -  --DOMWINDOW == 131 (0x12bdda400) [pid = 957] [serial = 5901] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/299036-1.html]
04:49:30     INFO -  --DOMWINDOW == 130 (0x12ac3c400) [pid = 957] [serial = 5861] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/60110-1.html]
04:49:30     INFO -  --DOMWINDOW == 129 (0x12c320400) [pid = 957] [serial = 5943] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/555462-iframe.html]
04:49:30     INFO -  --DOMWINDOW == 128 (0x12ac44800) [pid = 957] [serial = 5912] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/445171-1-inner.svg]
04:49:30     INFO -  --DOMWINDOW == 127 (0x12a7ae000) [pid = 957] [serial = 5913] [outer = 0x0] [url = data:text/html,<script>parent.done()</script>]
04:49:30     INFO -  --DOMWINDOW == 126 (0x11e137400) [pid = 957] [serial = 5944] [outer = 0x0] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/parser/htmlparser/tests/crashtests/555462-iframe.html]
04:49:30     INFO -  --DOMWINDOW == 125 (0x128765c00) [pid = 957] [serial = 5960] [outer = 0x127ce0000] [url = about:blank]
04:49:30     INFO -  --DOMWINDOW == 124 (0x127654000) [pid = 957] [serial = 6031] [outer = 0x1289af400] [url = about:blank]
04:49:30     INFO -  --DOMWINDOW == 123 (0x128623400) [pid = 957] [serial = 6029] [outer = 0x128563800] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/widget/crashtests/303901-1.html?]
04:49:30     INFO -  --DOMWINDOW == 122 (0x126ada400) [pid = 957] [serial = 6003] [outer = 0x1277a4000] [url = file:///builds/slave/talos-slave/test/build/tests/reftest/tests/widget/cocoa/crashtests/373122-1-inner.html]
04:49:30     INFO -  --DOMWINDOW == 121 (0x1292c6400) [pid = 957] [serial = 5992] [outer = 0x128364000] [url = about:blank]
04:49:30     INFO -  --DOMWINDOW == 120 (0x126ad5c00) [pid = 957] [serial = 5980] [outer = 0x12631e800] [url = data:text/html,Q]
04:49:30     INFO -  --DOMWINDOW == 119 (0x12be9ac00) [pid = 957] [serial = 5938] [outer = 0x0] [url = about:blank]
04:49:30     INFO -  [957] WARNING: NS_ENSURE_TRUE(mTextInputHandler) failed: file /builds/slave/m-in-osx64-d-00000000000000000/build/widget/cocoa/nsChildView.mm, line 5525
04:49:33     INFO -  [968] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-osx64-d-00000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532
04:49:33     INFO -  [968] ###!!! ASSERTION: Cannot call AnnotateCrashReport in child processes from non-main thread.: 'Error', file /builds/slave/m-in-osx64-d-00000000000000000/build/toolkit/crashreporter/nsExceptionHandler.cpp, line 1709
04:49:33     INFO -  NS_DebugBreak [xpcom/base/nsDebugImpl.cpp:418]
04:49:33     INFO -  mozilla::ipc::MessageChannel::OnChannelErrorFromLink() [ipc/glue/MessageChannel.cpp:1534]
04:49:33     INFO -  mozilla::ipc::ProcessLink::OnChannelError() [obj-firefox/dist/include/mozilla/Monitor.h:37]
04:49:33     INFO -  IPC::Channel::ChannelImpl::OnFileCanReadWithoutBlocking(int) [ipc/chromium/src/chrome/common/ipc_channel_posix.cc:856]
04:49:33     INFO -  event_base_loop [ipc/chromium/src/third_party/libevent/event.c:1355]
04:49:33     INFO -  base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) [ipc/chromium/src/base/message_pump_libevent.cc:332]
04:49:33     INFO -  MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:504]
04:49:33     INFO -  base::Thread::ThreadMain() [ipc/chromium/src/base/thread.cc:171]
04:49:33     INFO -  ThreadFunc [ipc/chromium/src/base/platform_thread_posix.cc:39]
04:49:33     INFO -  libSystem.B.dylib + 0x39fd6
04:49:33     INFO -  [968] ###!!! ASSERTION: Cannot call AnnotateCrashReport in child processes from non-main thread.: 'Error', file /builds/slave/m-in-osx64-d-00000000000000000/build/toolkit/crashreporter/nsExceptionHandler.cpp, line 1659
04:49:33     INFO -  NS_DebugBreak [obj-firefox/dist/include/nsTSubstring.h:95]
04:49:33     INFO -  mozilla::ipc::MessageChannel::OnChannelErrorFromLink() [ipc/glue/MessageChannel.cpp:1534]
04:49:33     INFO -  mozilla::ipc::ProcessLink::OnChannelError() [obj-firefox/dist/include/mozilla/Monitor.h:37]
04:49:33     INFO -  IPC::Channel::ChannelImpl::OnFileCanReadWithoutBlocking(int) [ipc/chromium/src/chrome/common/ipc_channel_posix.cc:856]
04:49:33     INFO -  event_base_loop [ipc/chromium/src/third_party/libevent/event.c:1355]
04:49:33     INFO -  base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) [ipc/chromium/src/base/message_pump_libevent.cc:332]
04:49:33     INFO -  MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:504]
04:49:33     INFO -  base::Thread::ThreadMain() [ipc/chromium/src/base/thread.cc:171]
04:49:33     INFO -  ThreadFunc [ipc/chromium/src/base/platform_thread_posix.cc:39]
04:49:33     INFO -  libSystem.B.dylib + 0x39fd6
04:49:33     INFO -  mozilla::ipc::ProcessLink::OnChannelError() [obj-firefox/dist/include/mozilla/Monitor.h:37]
04:49:33     INFO -  IPC::Channel::ChannelImpl::OnFileCanReadWithoutBlocking(int) [ipc/chromium/src/chrome/common/ipc_channel_posix.cc:856]
04:49:33     INFO -  event_base_loop [ipc/chromium/src/third_party/libevent/event.c:1355]
04:49:33     INFO -  base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) [ipc/chromium/src/base/message_pump_libevent.cc:332]
04:49:33     INFO -  MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:504]
04:49:33     INFO -  base::Thread::ThreadMain() [ipc/chromium/src/base/thread.cc:171]
04:49:33     INFO -  ThreadFunc [ipc/chromium/src/base/platform_thread_posix.cc:39]
04:49:33     INFO -  libSystem.B.dylib + 0x39fd6
04:49:33     INFO -  [968] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-osx64-d-00000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532
04:49:33     INFO -  Hit MOZ_CRASH() at /builds/slave/m-in-osx64-d-00000000000000000/build/memory/mozalloc/mozalloc_abort.cpp:30
04:49:35     INFO -  TEST-INFO | Main app process: killed by SIGHUP
04:49:35  WARNING -  TEST-UNEXPECTED-FAIL | Shutdown | Exited with code 1 during test run
04:49:35     INFO -  INFO | automation.py | Application ran for: 0:10:42.418482
04:49:35     INFO -  INFO | zombiecheck | Reading PID log: /var/folders/gp/gp6E0Yo7GAOF8RNmVxgKMU+++-k/-Tmp-/tmpKVl9nRpidlog
04:49:56  WARNING -  PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)]
04:49:56     INFO -  Crash dump filename: /var/folders/gp/gp6E0Yo7GAOF8RNmVxgKMU+++-k/-Tmp-/tmpCCqYgp.mozrunner/minidumps/2C1787EA-F0F7-4FBD-B3CD-F4AE5061071B.dmp
04:49:56     INFO -  Operating system: Mac OS X
04:49:56     INFO -                    10.6.8 10K549
04:49:56     INFO -  CPU: amd64
04:49:56     INFO -       family 6 model 23 stepping 10
04:49:56     INFO -       2 CPUs
04:49:56     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
04:49:56     INFO -  Crash address: 0x10000000
04:49:56     INFO -  Thread 0 (crashed)
04:49:56     INFO -   0  XUL!nsSplittableFrame::RemoveFromFlow(nsIFrame*) [nsSplittableFrame.cpp:58bf8348c8f1 : 200 + 0x0]
04:49:56     INFO -      rbx = 0x000000015c5f56a0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x0000000010000000
04:49:56     INFO -      r15 = 0x0000000000000000   rip = 0x0000000103c66289
04:49:56     INFO -      rsp = 0x00007fff5fbfe0d0   rbp = 0x00007fff5fbfe0f0
04:49:56     INFO -      Found by: given as instruction pointer in context
04:49:56     INFO -   1  XUL!nsSplittableFrame::DestroyFrom(nsIFrame*) [nsSplittableFrame.cpp:58bf8348c8f1 : 38 + 0x7]
04:49:56     INFO -      rbx = 0x000000015c5f56a0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x000000012b699450
04:49:56     INFO -      r15 = 0x000000012b69a350   rip = 0x0000000103c661f3
04:49:56     INFO -      rsp = 0x00007fff5fbfe100   rbp = 0x00007fff5fbfe110
04:49:56     INFO -      Found by: call frame info
04:49:56     INFO -   2  XUL!nsFrameList::DestroyFramesFrom(nsIFrame*) [nsFrameList.cpp:58bf8348c8f1 : 54 + 0xb]
04:49:56     INFO -      rbx = 0x000000015c5f56a0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x000000012b699450
04:49:56     INFO -      r15 = 0x000000012b69a350   rip = 0x0000000103c19677
04:49:56     INFO -      rsp = 0x00007fff5fbfe120   rbp = 0x00007fff5fbfe140
04:49:56     INFO -      Found by: call frame info
04:49:56     INFO -   3  XUL!nsContainerFrame::DestroyFrom(nsIFrame*) [nsContainerFrame.cpp:58bf8348c8f1 : 201 + 0xb]
04:49:56     INFO -      rbx = 0x000000012b69a2f0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x000000012b699450
04:49:56     INFO -      r15 = 0x000000012b69a2f0   rip = 0x0000000103bc40df
04:49:56     INFO -      rsp = 0x00007fff5fbfe150   rbp = 0x00007fff5fbfe180
04:49:56     INFO -      Found by: call frame info
04:49:56     INFO -   4  XUL!nsFrameList::DestroyFramesFrom(nsIFrame*) [nsFrameList.cpp:58bf8348c8f1 : 54 + 0xb]
04:49:56     INFO -      rbx = 0x000000012b69a2f0   r12 = 0x00000001265bc6d8
04:49:56     INFO -      r13 = 0x00000001003a6338   r14 = 0x000000012b699450
04:49:56     INFO -      r15 = 0x000000012b69a1e8   rip = 0x0000000103c19677
04:49:56     INFO -      rsp = 0x00007fff5fbfe190   rbp = 0x00007fff5fbfe1b0
04:49:56     INFO -      Found by: call frame info
}
Created attachment 8448160 [details]
relevant part from Full Log
> 04:49:35     INFO -  TEST-INFO | Main app process: killed by SIGHUP

It's not clear to me if that means the firefox process was killed
because it didn't ignore/handle that signal and that the crash stack
is just where it happened to be at that point and thus irrelevant.

Same thing occurred in bug 1029771.

I'm not very familiar with our signal handling setup,
Benjamin do you know?
Flags: needinfo?(benjamin)
... then again, this stack also has SVGDocumentWrapper::DestroyViewer()
like bug 1029771 which seems unlikely to be a coincidence.  So perhaps
the "Main app process: killed by SIGHUP" is irrelevant.
So this is a bit interesting:
http://hg.mozilla.org/mozilla-central/annotate/606848e8adfc/image/src/SVGDocumentWrapper.cpp#l161

I wonder if need to make SVGDocumentWrapper::DestroyViewer()
use a local strong ref and null out mViewer *before* calling
Destroy etc
http://hg.mozilla.org/mozilla-central/annotate/606848e8adfc/image/src/SVGDocumentWrapper.cpp#l61

Daniel, do you understand these crashes?
Flags: needinfo?(benjamin) → needinfo?(dholbert)
(In reply to Mats Palmgren (:mats) from comment #4)
> I wonder if need to make SVGDocumentWrapper::DestroyViewer()
> use a local strong ref and null out mViewer *before* calling
> Destroy etc

That might be wise, though I don't immediately see how that would help here.  From the backtrace, it looks like we're just tripping over a broken frame while tearing down the internal document.

Are you concerned about DestroyViewer() triggering some code that causes synchronous usage of the image from one of its clients?  I'd hope that the Destroy() code wouldn't trigger any painting or notifications, but I can imagine that being possibly problematic, if it did.

> Daniel, do you understand these crashes?

No. :-/  Based on the log, though, I'm guessing it's from this crashtest:
http://mxr.mozilla.org/mozilla-central/source/image/test/crashtests/844403-1.html?force=1

(That's the only "--DOMWINDOW" in the log for a SVG-as-an-image-related test, I think)
Flags: needinfo?(dholbert)
Summary: Intermittent PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)] (after: "NS_ENSURE_TRUE(mTextInputHandler) failed" and "ABORT: Aborting on channel error.") → Intermittent PROCESS-CRASH | Shutdown | application crashed [@ nsSplittableFrame::RemoveFromFlow(nsIFrame*)] (after: "NS_ENSURE_TRUE(mTextInputHandler) failed" and "ABORT: Aborting on channel error."), inside of SVGDocumentWrapper::DestroyViewer()
It looks to me like what happened here is that:

we hit an ABORT in a child process (during the parent process shutdown, even):

###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-osx64-d-00000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532

and then something in the automation decided to kill the parent process as a result and report the current parent process stack.  So I think the parent process crash dump is probably unrelated, but the stack walks in the log might be useful.

There seem to be other instances of this problem:
https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&list_id=10610029&short_desc=Aborting%20on%20channel%20error&short_desc_type=casesubstring

I'm not sure if I'm reading this at all correctly, though.  But I think the nsSplittableFrame-related stack is not related to what happened.
Flags: needinfo?(ted)
Flags: needinfo?(benjamin)
Comment hidden (Treeherder Robot)

Comment 8

4 years ago
We're definitely seeing the following errors in the child:

* the child has some kind of connection error and aborts.
* In the process of aborting, it calls NS_RUNTIMEABORT on a non-main thread, which attempts to set a crash annotation. But crash annotations in child processes are only supported on the main thread and so there is a secondary NS_ASSERTION.

However, I suspect that all the spew from the child is just because the parent process already crashed, and the crash stack in the parent at nsSplittableFrame::RemoveFromFlow is the real problem here.

The "killed by SIGHUP" is confusing, but all Mac crashes show up like that. Example: https://tbpl.mozilla.org/php/getParsedLog.php?id=43246976&tree=Mozilla-Central&full=1
Flags: needinfo?(benjamin)
Flags: needinfo?(ted)
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Keywords: intermittent-failure
Resolution: --- → DUPLICATE
Duplicate of bug: 1010666
(In reply to Benjamin Smedberg  [:bsmedberg] from comment #8)
> * In the process of aborting, it calls NS_RUNTIMEABORT on a non-main thread,
> which attempts to set a crash annotation. But crash annotations in child
> processes are only supported on the main thread and so there is a secondary
> NS_ASSERTION.

FWIW that's filed as bug 991824.
You need to log in before you can comment on or make changes to this bug.