1122008 - crash in mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::~MessageChannel()...

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Mihaela Velimiroviciu (:mihaelav)]

This bug was filed from the Socorro interface and is 
report bp-e30f6313-3d98-4f37-bcae-240f72150115.
=============================================================

We got this crash while running our functional mozmill testrun on Aurora.

Test where the crash appeared: firefox/tests/functional/testTabView/testTabGroupNaming.js |testTabGroupNaming.js
(http://hg.mozilla.org/qa/mozmill-tests/file/bc5c9ef33a316f96cf4e51adf5880d3777465ba7/firefox/tests/functional/testTabView/testTabGroupNaming.js)

Report: http://mozmill-daily.blargon7.com/#/functional/report/1d4125666f4752482c2ebb69d900b2f1

OS: Win 7 x86

Comment 1

[Mihaela Velimiroviciu (:mihaelav)]

Jenkins log:
04:13:00 TEST-START | testTabView\testTabGroupNaming.js | teardownModule
04:13:00 TEST-END | testTabView\testTabGroupNaming.js | finished in 1527ms
04:13:00 ###!!! [MessageChannel][Parent][c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\ipc\glue\MessageChannel.cpp:332] Assertion (mCxxStackFrames.empty()) failed.  mismatched CxxStackFrame ctor/dtors
04:13:00   MessageChannel 'backtrace':
04:13:00   [(0) in sync PCompositor::Msg_WillStop(actor=2147483647) ]
04:13:00   remote Interrupt stack guess: 0
04:13:00   deferred stack size: 0
04:13:00   out-of-turn Interrupt replies stack size: 0
04:13:00   Pending queue size: 17, front to back:
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00     [ async ]
04:13:00 [2476] ###!!! ABORT: mismatched CxxStackFrame ctor/dtors: file c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\ipc\glue\MessageChannel.cpp, line 1812
04:13:01 mozcrash INFO | Saved minidump as C:\Users\mozauto\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\844b6fad-ca2a-42de-81c9-36721162cb73.dmp
04:13:01 mozcrash INFO | Saved app info as C:\Users\mozauto\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\844b6fad-ca2a-42de-81c9-36721162cb73.extra
04:13:01 PROCESS-CRASH | c:\jenkins\workspace\mozilla-aurora_functional\data\mozmill-tests\firefox\tests\functional\testTabView\testTabGroupNaming.js | application crashed [unknown top frame]
04:13:01 Crash dump filename: c:\jenkins\workspace\mozilla-aurora_functional\data\profile\minidumps\844b6fad-ca2a-42de-81c9-36721162cb73.dmp
04:13:01 No symbols path given, can't process dump.
04:13:01 MINIDUMP_STACKWALK not set, can't process dump.

Comment 2

[Ben Turner (not reading bugmail, use the needinfo flag!)]

/me bets this has the same underlying problem as bug 1120331

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+2]]

All known crashes (only 3) seem to be startup crashes.

Comment 4

[Robert Kaiser]

[Tracking Requested - why for this release]:
This is #3 in early data for 37.0b1, but I'm unsure how much it is connected with bug 1120331 / bug 1133426.

Comment 5

[Lawrence Mandel [:lmandel] (use needinfo)]

(In reply to Robert Kaiser (:[e-mail]) from comment #4)
> [Tracking Requested - why for this release]:
> This is #3 in early data for 37.0b1, but I'm unsure how much it is connected
> with bug 1120331 / bug 1133426.

Are you suggesting that this may be fixed when those two bugs are fixed? (Fix has landed for Beta 2.) If so, let's see if this bug remains at #3 in 37 Beta 2 and later.

Comment 6

[Robert Kaiser]

(In reply to Lawrence Mandel [:lmandel] (use needinfo) from comment #5)
> Are you suggesting that this may be fixed when those two bugs are fixed?
> (Fix has landed for Beta 2.) If so, let's see if this bug remains at #3 in
> 37 Beta 2 and later.

Given the signature being in IPC and what bent says in comment #2, it's possible that it's the same thing, yes. I certainly hope so and that b2 doesn't have it.

Comment 7

[Lawrence Mandel [:lmandel] (use needinfo)]

I see 7400 reports for b1 and none for b2 or b3. I think we can assume that this is fixed.

Comment 8

[(Away)]

There is a top startup crash on 37.0.1 that looks almost exactly like this, only difference is Child versus Parent at the end of the signature. Ben could you take a look and let me know whether it's the same issue?

mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::~MessageChannel() | moz_xmalloc | mozilla::layers::PCompositorChild::~PCompos...

mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::~MessageChannel() | moz_xmalloc | mozilla::layers::PCompositorParent::~PCompo...

Comment 9

[(Away)]

bp-1f15da08-ee54-4d6f-99cc-962562150404 is an example of the one I had in mind on 37.0.1.

Comment 10

[Ben Turner (not reading bugmail, use the needinfo flag!)]

I think that's probably something different... The compositor stuff is different on the child side vs the parent side.

Comment 11

[(Away)]

Ok, thanks - I moved that issue to bug 1152980.