Closed Bug 1036500 Opened 10 years ago Closed 10 years ago

Intermittent test_823965.html | application crashed [@ mozilla::dom::DOMFile::Release()]

Categories

(Core :: DOM: Device Interfaces, defect)

Product:
Core
Component:
DOM: Device Interfaces
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla34
Tracking Flags:
Tracking Status
firefox32 --- unaffected
firefox33 --- fixed
firefox34 --- fixed
firefox-esr24 --- unaffected
firefox-esr31 --- unaffected
b2g-v2.0 --- unaffected
b2g-v2.1 --- fixed

People

(Reporter: RyanVM, Assigned: xyuan)

References

Details

(Keywords: crash, intermittent-failure)

Attachments

(1 file, 1 obsolete file)

domfile.patch
9.75 KB, patch
xyuan
: review+
Sylvestre
: approval-mozilla-aurora+
Details | Diff | Splinter Review 
https://tbpl.mozilla.org/php/getParsedLog.php?id=43384295&tree=Mozilla-Central

Rev4 MacOSX Snow Leopard 10.6 mozilla-central debug test mochitest-2 on 2014-07-08 16:54:58 PDT for push d35c1bf0f084
slave: t-snow-r4-0003

16:59:49     INFO -  [Child 969] WARNING: Failed to retarget HTML data delivery to the parser thread.: file /builds/slave/m-cen-osx64-d-0000000000000000/build/parser/html/nsHtml5StreamParser.cpp, line 947
16:59:49     INFO -  Hit MOZ_CRASH(DOMFile not thread-safe) at /builds/slave/m-cen-osx64-d-0000000000000000/build/content/base/src/nsDOMFile.cpp:155
17:00:14     INFO -  mozilla::dom::RemoveTask::~RemoveTask() [obj-firefox/dist/include/mozilla/mozalloc.h:225]
17:00:14     INFO -  nsRunnable::Release() [xpcom/glue/nsThreadUtils.cpp:32]
17:00:14     INFO -  nsThreadPool::Run() [obj-firefox/dist/include/nsCOMPtr.h:513]
17:00:14     INFO -  _ZThn8_N12nsThreadPool3RunEv [obj-firefox/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:234]
17:00:14     INFO -  nsThread::ProcessNextEvent(bool, bool*) [xpcom/threads/nsThread.cpp:766]
17:00:14     INFO -  NS_ProcessNextEvent(nsIThread*, bool) [xpcom/glue/nsThreadUtils.cpp:256]
17:00:14     INFO -  mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) [ipc/glue/MessagePump.cpp:307]
17:00:14     INFO -  MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:504]
17:00:14     INFO -  nsThread::ThreadFunc(void*) [xpcom/threads/nsThread.cpp:355]
17:00:16     INFO -  _pt_root [nsprpub/pr/src/pthreads/ptthread.c:215]
17:00:16     INFO -  libSystem.B.dylib + 0x39fd6
17:00:16     INFO -  ###!!! [Child][MessageChannel] Error: Channel error: cannot send/recv
17:00:16     INFO -  ###!!! [Child][MessageChannel] Error: Channel error: cannot send/recv
17:00:16     INFO -  ###!!! [Child][MessageChannel] Error: Channel error: cannot send/recv
17:00:16     INFO -  TEST-INFO | Main app process: killed by SIGHUP
17:00:16  WARNING -  TEST-UNEXPECTED-FAIL | /tests/dom/devicestorage/test/test_823965.html | application terminated with exit code 1
17:00:16     INFO -  INFO | runtests.py | Application ran for: 0:03:37.186870
17:00:16     INFO -  INFO | zombiecheck | Reading PID log: /var/folders/Za/ZaUOYDYwFX4mDwE+DnAJDk+++-k/-Tmp-/tmpSkwEwVpidlog
17:00:36  WARNING -  PROCESS-CRASH | /tests/dom/devicestorage/test/test_823965.html | application crashed [@ mozilla::dom::DOMFile::Release()]
17:00:36     INFO -  Crash dump filename: /var/folders/Za/ZaUOYDYwFX4mDwE+DnAJDk+++-k/-Tmp-/tmpQ3Aqh1.mozrunner/minidumps/8E1143E6-93A7-4E4B-A9AA-34416235FC41.dmp
17:00:36     INFO -  Operating system: Mac OS X
17:00:36     INFO -                    10.6.8 10K549
17:00:36     INFO -  CPU: amd64
17:00:36     INFO -       family 6 model 23 stepping 10
17:00:36     INFO -       2 CPUs
17:00:36     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
17:00:36     INFO -  Crash address: 0x0
17:00:36     INFO -  Thread 62 (crashed)
17:00:36     INFO -   0  XUL!mozilla::dom::DOMFile::Release() [nsDOMFile.cpp:d35c1bf0f084 : 155 + 0x0]
17:00:36     INFO -      rbx = 0x00007fff70e132f8   r12 = 0x0000000000007500
17:00:36     INFO -      r13 = 0x0000000120360868   r14 = 0x000000011a3c7500
17:00:36     INFO -      r15 = 0x0000000120360840   rip = 0x00000001034e79e9
17:00:36     INFO -      rsp = 0x000000014eb80bf0   rbp = 0x000000014eb80c00
17:00:36     INFO -      Found by: given as instruction pointer in context
17:00:36     INFO -   1  XUL!mozilla::dom::RemoveTask::~RemoveTask() [nsCOMPtr.h:d35c1bf0f084 : 513 + 0x5]
17:00:36     INFO -      rbx = 0x000000011a3ba2e0   r12 = 0x0000000000007500
17:00:36     INFO -      r13 = 0x0000000120360868   r14 = 0x000000011a3ba358
17:00:36     INFO -      r15 = 0x0000000120360840   rip = 0x00000001031aca69
17:00:36     INFO -      rsp = 0x000000014eb80c10   rbp = 0x000000014eb80c20
17:00:36     INFO -      Found by: call frame info
17:00:36     INFO -   2  XUL!mozilla::dom::RemoveTask::~RemoveTask() [RemoveTask.cpp:d35c1bf0f084 : 72 + 0x4]
17:00:36     INFO -      rbx = 0x000000011a3ba2e0   r12 = 0x0000000000007500
17:00:36     INFO -      r13 = 0x0000000120360868   r14 = 0x000000011a3ba2e0
17:00:36     INFO -      r15 = 0x0000000120360840   rip = 0x00000001031ac9ae
17:00:36     INFO -      rsp = 0x000000014eb80c30   rbp = 0x000000014eb80c40
17:00:36     INFO -      Found by: call frame info
17:00:36     INFO -   3  XUL!nsRunnable::Release() [nsThreadUtils.cpp:d35c1bf0f084 : 32 + 0x8]
17:00:36     INFO -      rbx = 0x0000000000000000   r12 = 0x0000000000007500
17:00:36     INFO -      r13 = 0x0000000120360868   r14 = 0x000000011a3ba2e0
17:00:36     INFO -      r15 = 0x0000000120360840   rip = 0x0000000101c3c7be
17:00:36     INFO -      rsp = 0x000000014eb80c50   rbp = 0x000000014eb80c60
17:00:36     INFO -      Found by: call frame info
17:00:36     INFO -   4  XUL!nsThreadPool::Run() [nsCOMPtr.h:d35c1bf0f084 : 513 + 0x5]
17:00:36     INFO -      rbx = 0x0000000000000000   r12 = 0x0000000000007500
17:00:36     INFO -      r13 = 0x0000000120360868   r14 = 0x000000014eb80c90
17:00:36     INFO -      r15 = 0x0000000120360840   rip = 0x0000000101cd5e39
17:00:36     INFO -      rsp = 0x000000014eb80c70   rbp = 0x000000014eb80cd0
17:00:36     INFO -      Found by: call frame info
Assignee: nobody → xyuan
The cause of this bug:

We assume DOMFile is thread-safe and mozilla::dom::RemoveTask accesses DOMFile in a background thread. Bug 827823 changed DOMFile to non-thread-safe and leads to this bug.
Blocks: 827823
Attached patch thread safe(v1) (obsolete) — — Splinter Review 
@baku, could you do me a favor to review this?

Use thread-safe DOMFileImpl instead of DOMFile to avoid crashes.

Try result:
https://tbpl.mozilla.org/?tree=Try&rev=c9bf58ce5f12
Attachment #8455221 - Flags: review?(amarchesini)
Comment on attachment 8455221 [details] [diff] [review]
thread safe(v1)

Review of attachment 8455221 [details] [diff] [review]:
-----------------------------------------------------------------

smaug, could you help to review this simple, but critical patch? Thanks.
Attachment #8455221 - Flags: review?(amarchesini) → review?(bugs)
Comment on attachment 8455221 [details] [diff] [review]
thread safe(v1)

Ehsan reviewed the patch which caused the issue.
Attachment #8455221 - Flags: review?(bugs) → review?(ehsan)
Attachment #8455221 - Flags: review?(ehsan) → review+
Attached patch domfile.patch — — Splinter Review 
Olli and Ehsan, thanks for your help.

Rebase and update commit message to add review info.
Attachment #8461334 - Flags: review+
Attachment #8455221 - Attachment is obsolete: true
https://hg.mozilla.org/mozilla-central/rev/d13295f54df1
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla34
Please request Aurora approval on this when you get a chance :)
status-b2g-v2.1: affected → fixed
status-firefox34: affected → fixed
Flags: needinfo?(xyuan)
Comment on attachment 8461334 [details] [diff] [review]
domfile.patch

Approval Request Comment
[Feature/regressing bug #]: Bug 827823
[User impact if declined]: Process is likely to crash when removing files with DeviceStorage Filesystem API.
[Describe test coverage new/current, TBPL]: https://tbpl.mozilla.org/?tree=Try&rev=c9bf58ce5f12
[Risks and why]: Low. The changes are confined to the remove method that causing this bug, and any other parts won't be affected. In addition we have changed the createFile method with the same way and haven't cause any crashes or regressions so far.
[String/UUID change made/needed]: None.
Attachment #8461334 - Flags: approval-mozilla-b2g32?
Attachment #8461334 - Flags: approval-mozilla-aurora?
Flags: needinfo?(xyuan)
Attachment #8461334 - Flags: approval-mozilla-b2g32?
Attachment #8461334 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
QA Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: