1092216 - [meta] crash in mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*)

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect)

Description

[Ed Morley [:emorley]]

Broken out from bug 1090602 comment 1

This bug was filed from the Socorro interface and is 
report bp-2bd3c79d-3523-4534-a1bd-ba4e52141029.
=============================================================

STR:

1) Enable e10s
2) Navigate to http://treestatus.mozilla.org/
3) Sign into Lastpass
4) Click login & follow the persona login flow

ER:
Works

AR:
"Tab has crashed":
bp-409049de-4fb5-4cd3-a5d4-c20692141029	29/10/2014	13:10
bp-21654924-27a0-45f8-8a5f-196dd2141029	29/10/2014	13:10
bp-2bd3c79d-3523-4534-a1bd-ba4e52141029	29/10/2014	13:10

Comment 1

[Ed Morley [:emorley]]

Can't repro using today's nightly, though didn't try again using the comment 0 nightly, so could either be fixed since or just a rare occurrence.

Happy for you to mark WFM.

Comment 2

[Deathamns]

Product 	Firefox
Version 	37.0a1
Build ID 	20141218030202
------------------------------

I'm able to reproduce this crash with the following steps (assuming that e10s is enabled):

1) Install this extension: https://googledrive.com/host/0Bx8fnUCX4W2ISjlGTC1HOE0zNFE/uBlock.xpi
2) Restart the browser.
3) Now try to load a new tab with any HTTP URL.
3.14) "Tab crashed" for every new tab.

Furthermore, if you go to the Add-ons Manager and disable/enable the extension, and then try loading new tabs, they won't crash. If they do, then disable/enable the extension again (usually it worked for me on the second try).


There is an error too in the Browser Console:

[Exception... "[JavaScript Error: "child process crashed or timedout" {file: "chrome://ublock/content/frameModule.js" line: 128}]'[JavaScript Error: "child process crashed or timedout" {file: "chrome://ublock/content/frameModule.js" line: 128}]' when calling method: [nsIContentPolicy::shouldLoad]"  nsresult: "0x80570021 (NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS)"  location: "JS frame :: resource://gre/modules/RemoteAddonsParent.jsm :: ContentPolicyParent.shouldLoad :: line 146"  data: yes]

Comment 3

[Asif Youssuff]

Here is one browser restarted session and a couple of crashes from about:crashes:

https://crash-stats.mozilla.com/report/index/b234faf2-e723-4e7a-9e32-7f4e12141227
https://crash-stats.mozilla.com/report/index/0db5c99a-91ea-4501-9620-b7c352141227
https://crash-stats.mozilla.com/report/index/8e80d694-5763-4790-9fd6-f249a2141227

I have "show my windows and tabs open from last time" enabled, so simply restarting the browser with the addon enabled triggers the issue. 

If I shut down or restart the browser with the addon disabled, then re-enable it after the previously opened tabs reload, everything works fine.

Comment 4

[Asif Youssuff]

FWIW, I am using the same addon that Deathamns references. 

about: Mozilla/5.0 (X11; Linux x86_64; rv:37.0) Gecko/20100101 Firefox/37.0

Comment 5

[sheepdestroyer]

Same problem than Deathamns with same add-on on 37.0a1 (2015-01-01), Fedora 21 64 bits.

When starting FF nightly with e10s enabled and ublock add-on, every tab crash and browser is unresponsive.
If I then disable and re-enable the add-on, I can then reload the crashed tabs normally.

If starting FF with ublock disabled, then enabling it after a while, it works well as expected. 
If e10s is disabled, there is no such problem at all.

I have the following related error in console :
[Exception... "[JavaScript Error: "child process crashed or timedout" {file: "chrome://ublock/content/frameModule.js" line: 109}]'[JavaScript Error: "child process crashed or timedout" {file: "chrome://ublock/content/frameModule.js" line: 109}]' when calling method: [nsIContentPolicy::shouldLoad]"  nsresult: "0x80570021 (NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS)"  location: "JS frame :: resource://gre/modules/RemoteAddonsParent.jsm :: ContentPolicyParent.shouldLoad :: line 146"  data: yes]

Comment 6

[Deathamns]

Update:
So, it crashes when nsIContentFrameMessageManager::sendSyncMessage is called inside nsIContentPolicy::shouldLoad, but it seems that it doesn't crash when nsIContentFrameMessageManager::sendRpcMessage is used.

Comment 7

[Jim Mathies [:jimm]]

Attachment: report

This content top crash is an insanely long tail of initiators.

Comment 8

[Jim Mathies [:jimm]]

Attachment: top level sends

using more data - pretty much everything here. I'm going to look down below this for other ipc activity.

Comment 9

[Jim Mathies [:jimm]]

After fixing a bug on my parsing script this list looks much more manageable. We can file bugs on these and tackle them individually.

Child signature breakdown:
-----------------------------------
170     62.3%   mozilla::dom::PStorageChild::SendPreload(nsCString const &,unsigned int const &,nsTArray<nsString> *,nsTArray<nsString> *,nsresult *)
42      15.4%   mozilla::dom::PContentChild::SendGetGraphicsFeatureStatus(int const &,int *,bool *)
32      11.7%   mozilla::dom::PBrowserChild::SendSyncMessage(nsString const &,mozilla::dom::ClonedMessageData const &,nsTArray<mozilla::jsipc::CpowEntry> const &,IPC::Principal const &,nsTArray<nsString> *)
9       3.3%    mozilla::hal_sandbox::PHalChild::SendGetCurrentScreenConfiguration(mozilla::hal::ScreenConfiguration *)
7       2.6%    mozilla::dom::PBrowserChild::SendIsParentWindowMainWidgetVisible(bool *)
7       2.6%    mozilla::dom::PContentChild::SendPRemoteSpellcheckEngineConstructor(mozilla::PRemoteSpellcheckEngineChild *)
5       1.8%    mozilla::dom::PBrowserChild::SendGetWidgetNativeData(unsigned __int64 *)
1       0.4%    mozilla::dom::PContentChild::SendGetClipboardText(int const &,nsString *)

Comment 10

[Jim Mathies [:jimm]]

s/on/in

Comment 11

[Andrew McCreight [:mccr8]]

You could also add some stuff to the prefix and skip lists for signatures so they will be split up like this on crash-stats, too.

Comment 12

[Jim Mathies [:jimm]]

(In reply to Andrew McCreight [:mccr8] from comment #11)
> You could also add some stuff to the prefix and skip lists for signatures so
> they will be split up like this on crash-stats, too.

yes, I really need to file a bug or two on migrating my python parsing over to crash reports.

Comment 13

[Tracy Walker [:tracy]]

Moving to DOM: Content Processes per bsmedberg's request.

Comment 14

[Robert Kaiser]

(In reply to Jim Mathies [:jimm] from comment #9)
> After fixing a bug on my parsing script this list looks much more
> manageable. We can file bugs on these and tackle them individually.

How do you get to those? Should we adapt our signature generation algorithm to get to something including them right away?

Comment 15

[Jim Mathies [:jimm]]

(In reply to Robert Kaiser (:[e-mail]) from comment #14)
> (In reply to Jim Mathies [:jimm] from comment #9)
> > After fixing a bug on my parsing script this list looks much more
> > manageable. We can file bugs on these and tackle them individually.
> 
> How do you get to those? Should we adapt our signature generation algorithm
> to get to something including them right away?

bug 1154036, comment 4 covers the process I used in my scripts.

Comment 16

[Robert Kaiser]

(In reply to Jim Mathies [:jimm] from comment #15)
> bug 1154036, comment 4 covers the process I used in my scripts.

Ah, right, following up in that bug.

Comment 17

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Adding a tracking flag for FF40 as this was mentioned in last week's channel meeting as ~6% of total crashes.

Comment 18

[Robert Kaiser]

So, bug 1162703 shipped to Socorro yesterday, And the dev edition list of signatures with that since the landing gives a more differentiated view into those issues: https://crash-stats.mozilla.com/search/?product=Firefox&signature=~mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ASend&date=%3E2015-06-10+23%3A00%3A00&version=40.0a2&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Comment 19

[Jim Mathies [:jimm]]

(In reply to Robert Kaiser (:[e-mail]) from comment #18)
> So, bug 1162703 shipped to Socorro yesterday, And the dev edition list of
> signatures with that since the landing gives a more differentiated view into
> those issues:
> https://crash-stats.mozilla.com/search/
> ?product=Firefox&signature=~mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ASend&da
> te=%3E2015-06-10+23%3A00%3A00&version=40.
> 0a2&_facets=signature&_columns=date&_columns=signature&_columns=product&_colu
> mns=version&_columns=build_id&_columns=platform#facet-signature

This is great, looks like your list pretty closely matches my script generated list except for the top two. We should get bugs filed on those two pickle crashes, my scripts don't pick those up for some reason, i'll dig into those and figure out why. Because of this these two sigs have not received and triage love.

Comment 20

[Jim Mathies [:jimm]]

(In reply to Jim Mathies [:jimm] from comment #19)
> (In reply to Robert Kaiser (:[e-mail]) from comment #18)
> > So, bug 1162703 shipped to Socorro yesterday, And the dev edition list of
> > signatures with that since the landing gives a more differentiated view into
> > those issues:
> > https://crash-stats.mozilla.com/search/
> > ?product=Firefox&signature=~mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ASend&da
> > te=%3E2015-06-10+23%3A00%3A00&version=40.
> > 0a2&_facets=signature&_columns=date&_columns=signature&_columns=product&_colu
> > mns=version&_columns=build_id&_columns=platform#facet-signature
> 
> This is great, looks like your list pretty closely matches my script
> generated list except for the top two. We should get bugs filed on those two
> pickle crashes, my scripts don't pick those up for some reason, i'll dig
> into those and figure out why. Because of this these two sigs have not
> received and triage love.

OM Gosh! these are aurora only!

https://crash-stats.mozilla.com/search/?product=Firefox&signature=~mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ASend&date=%3E2015-06-10+23%3A00%3A00&version=41.0a1&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Comment 21

[Jim Mathies [:jimm]]

fixed by bug 1177013

Comment 22

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Jim, do you want to request the fix for bug 1177013 to be uplifted to Beta? If yes, now is a good time to do so.

Comment 23

[Jim Mathies [:jimm]]

(In reply to Ritu Kothari (:ritu) from comment #22)
> Jim, do you want to request the fix for bug 1177013 to be uplifted to Beta?
> If yes, now is a good time to do so.

nope, e10s isn't on in 40 and never will be.

Comment 24

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Untracking from FF40 based on comment 23.