Closed Bug 1102898 Opened 5 years ago Closed 5 years ago

Intermittent browser_updateid.js | application crashed [@ mozilla::plugins::PluginModuleParent::GetSettings(mozilla::plugins::PluginSettings*)]

Categories

(Core :: Plug-ins, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla36
Tracking Status
firefox34 --- unaffected
firefox35 --- unaffected
firefox36 --- fixed
firefox-esr31 --- unaffected

People

(Reporter: cbook, Assigned: billm)

References

()

Details

(Keywords: crash, intermittent-failure)

Attachments

(1 file)

Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound opt test mochitest-browser-chrome-3

https://treeherder.mozilla.org/ui/logviewer.html#?job_id=4103513&repo=mozilla-inbound

01:37:07 INFO - 593 ERROR TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/mozapps/extensions/test/browser/test-window/browser_updateid.js | application terminated with exit code 1
01:37:07 INFO - runtests.py | Application ran for: 0:05:13.404770
01:37:07 INFO - zombiecheck | Reading PID log: /var/folders/r0/r0RePn6sGjeTnhNVDOCBa++++-k/-Tmp-/tmpufY9alpidlog
01:37:07 INFO - mozcrash Downloading symbols from: https://ftp-ssl.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64/1416556513/firefox-36.0a1.en-US.mac.crashreporter-symbols.zip
01:37:40 INFO - mozcrash Saved minidump as /builds/slave/talos-slave/test/build/blobber_upload_dir/F996ADE3-8F18-4AE8-95D2-DC847057083D.dmp
01:37:40 INFO - mozcrash Saved app info as /builds/slave/talos-slave/test/build/blobber_upload_dir/F996ADE3-8F18-4AE8-95D2-DC847057083D.extra
01:37:40 WARNING - PROCESS-CRASH | chrome://mochitests/content/browser/toolkit/mozapps/extensions/test/browser/test-window/browser_updateid.js | application crashed [@ mozilla::plugins::PluginModuleParent::GetSettings(mozilla::plugins::PluginSettings*)]
01:37:40 INFO - Crash dump filename: /var/folders/r0/r0RePn6sGjeTnhNVDOCBa++++-k/-Tmp-/tmp3ciVvm.mozrunner/minidumps/F996ADE3-8F18-4AE8-95D2-DC847057083D.dmp
01:37:40 INFO - Operating system: Mac OS X
01:37:40 INFO - 10.6.8 10K549
01:37:40 INFO - CPU: amd64
01:37:40 INFO - family 6 model 23 stepping 10
01:37:40 INFO - 2 CPUs
01:37:40 INFO - Crash reason: EXC_BAD_ACCESS / 0x0000000d
01:37:40 INFO - Crash address: 0x0
01:37:40 INFO - Thread 0 (crashed)
01:37:40 INFO - 0 XUL!mozilla::plugins::PluginModuleParent::GetSettings(mozilla::plugins::PluginSettings*) [PluginModuleParent.cpp:794b5fca57b0 : 1338 + 0x9]
01:37:40 INFO - rbx = 0x000000012ae3ec00 r12 = 0x000000010bc0eb20
01:37:40 INFO - r13 = 0x0000000105848c01 r14 = 0x000000012ae3ec00
01:37:40 INFO - r15 = 0x00007fff5fbfe170 rip = 0x000000010340580c
01:37:40 INFO - rsp = 0x00007fff5fbfe120 rbp = 0x00007fff5fbfe160
01:37:40 INFO - Found by: given as instruction pointer in context
01:37:40 INFO - 1 XUL!OfflineObserver::Observe(nsISupports*, char const*, char16_t const*) [PluginModuleParent.cpp:794b5fca57b0 : 1353 + 0xa]
01:37:40 INFO - rbx = 0x000000012ae3ec00 r12 = 0x000000010bc0eb20
01:37:40 INFO - r13 = 0x0000000105848c01 r14 = 0x00007fff5fbfe170
01:37:40 INFO - r15 = 0x0000000000000000 rip = 0x0000000103405666
01:37:40 INFO - rsp = 0x00007fff5fbfe170 rbp = 0x00007fff5fbfe1a0
01:37:40 INFO - Found by: call frame info
01:37:40 INFO - 2 XUL!nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) [nsObserverList.cpp:794b5fca57b0 : 100 + 0xe]
01:37:40 INFO - rbx = 0x0000000000000000 r12 = 0x000000010bc0eb20
01:37:40 INFO - r13 = 0x0000000105848c01 r14 = 0x0000000105a3ae6a
01:37:40 INFO - r15 = 0x0000000000000000 rip = 0x0000000101c15184
01:37:40 INFO - rsp = 0x00007fff5fbfe1b0 rbp = 0x00007fff5fbfe1e0
01:37:40 INFO - Found by: call frame info
01:37:40 INFO - 3 XUL!nsIOService::SetOffline(bool) [nsIOService.cpp:794b5fca57b0 : 778 + 0x26]
01:37:40 INFO - rbx = 0x0000000100308a90 r12 = 0x0000000100308a90
01:37:40 INFO - r13 = 0x00007fff701365e0 r14 = 0x0000000000000001
01:37:40 INFO - r15 = 0x000000010bc0eb00 rip = 0x0000000101cccfdf
01:37:40 INFO - rsp = 0x00007fff5fbfe1f0 rbp = 0x00007fff5fbfe260
01:37:40 INFO - Found by: call frame info
Either mNPNIface or mNPNIface->uagent is null, and we're in the shutdown sequence. Bill, could this be a PluginModuleParent which never initialized successfully?
Flags: needinfo?(wmccloskey)
> 01:37:40 INFO - Crash reason: EXC_BAD_ACCESS / 0x0000000d

Actually this (probably) isn't a null-dereference.  Much more likely to be a dereference of a memory-poisoned value (like 0x5a5a5a5a5a5a5a5a).
I really wish our mochitest crash dumps showed the "thread state" of the crashing thread -- the values of all the user-level registers.  See bug 1018360 comment #0.
Steven, feel free to file and fix!
> I really wish our mochitest crash dumps showed the "thread state" of the crashing thread

Now I see that *some* of the crash state is displayed.  But we need values for *all* the user level registers.

> Steven, feel free to file and fix!

I'll open a bug ... but I'm not the best one to fix it.  I don't know anything about the code that displays the mochitest crash dumps.
Ted Mielczarek tells me that the mochitest crash dumps are the unaltered output of minidump_stackwalk.  His latest minidump_stackwalk *does* already display the thread state that we need.  We just need to get the mochitest harness to use that minidump_stackwalk.  I'm going to open a bug on that.

In the meantime, Ted also gave me a link to the minidump associated with the crash reported in comment #0.  (I couldn't figure out the horrible treeherder UI.)

http://mozilla-releng-blobs.s3.amazonaws.com/blobs/mozilla-inbound/sha512/51b2491de781a82a500eae28546c375e7aca6a79b73e2aa76c1d8ae4ece1ad73c5a240459112f9aaaf72e9990dff6504f1b87d92a0d62c24ff7281b1db1eb068

Here's the thread state from that minidump.  You can see that rax == 0x5a5a5a5a5a5a5a5a.

 0  XUL + 0x185680c
    rax = 0x5a5a5a5a5a5a5a5a   rdx = 0x0000000000000000
    rcx = 0x0000000106851470   rbx = 0x000000012ae3ec00
    rsi = 0x0000000000000000   rdi = 0x0000000000000000
    rbp = 0x00007fff5fbfe160   rsp = 0x00007fff5fbfe120
     r8 = 0x000000010033d5c8    r9 = 0x000000000000000e
    r10 = 0x0000000000000003   r11 = 0x0000000100011780
    r12 = 0x000000010bc0eb20   r13 = 0x0000000105848c01
    r14 = 0x000000012ae3ec00   r15 = 0x00007fff5fbfe170
    rip = 0x000000010340580c
Oops. Looks like I accidentally left the Unregistration call inside an #ifdef XP_WIN block. Thanks for catching.
Flags: needinfo?(wmccloskey)
Attached patch fix-unregisterSplinter Review
Assignee: nobody → wmccloskey
Status: NEW → ASSIGNED
Attachment #8526862 - Flags: review?(benjamin)
Attachment #8526862 - Flags: review?(benjamin) → review+
https://hg.mozilla.org/mozilla-central/rev/5d23df58a42f
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
You need to log in before you can comment on or make changes to this bug.