Child abort on send signature @ mozilla::hal_sandbox::PHalChild::SendGetCurrentScreenConfiguration(mozilla::hal::ScreenConfiguration *)

RESOLVED FIXED in Firefox 41



4 years ago
4 years ago


(Reporter: tracy, Assigned: mrbkap)



Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(e10sm7+, firefox41 fixed, firefox42 fixed)


(crash signature)


(1 attachment)

Broken out per bug 1092216 comment 9

Bug 1092216 Child abort on send signature breakdown:
21	9.8%	mozilla::hal_sandbox::PHalChild::SendGetCurrentScreenConfiguration(mozilla::hal::ScreenConfiguration *)
Component: IPC → DOM: Content Processes
Video DownloadHelper add-on is at least one culprit.
Just having it and flash enabled crashed a page for me. (i.e. just viewing page, not explicitly using add-on)
Restarted, tried on windows, no crash and crash no longer happened when back to linux.
Duplicate of this bug: 1160748
(Continuing discussion from bug 1160748)

I would try to find the regression range, but I haven't been able to reproduce the issue on a clean profile so far. However, I just had another site [1] crash on me (same bug), and Video DownloadHelper wasn't enabled this time.

Bug 1092216 Child abort on send signature breakdown:
275	95.5%	mozilla::hal_sandbox::PHalChild::SendGetCurrentScreenConfiguration(mozilla::hal::ScreenConfiguration *)
8	2.8%	mozilla::dom::TabChild::DoSendBlockingMessage(JSContext *,nsAString_internal const &,mozilla::dom::StructuredCloneData const &,JS::Handle<JSObject *>,nsIPrincipal *,nsTArray<nsString> *,bool)
2	0.7%	mozilla::dom::PStorageChild::SendPreload(nsCString const &,unsigned int const &,nsTArray<nsString> *,nsTArray<nsString> *,nsresult *)
1	0.3%	mozilla::dom::PContentChild::SendKeywordToURI(nsCString const &,nsString *,mozilla::ipc::OptionalInputStreamParams *,mozilla::ipc::OptionalURIParams *)
1	0.3%	mozilla::dom::PBrowserChild::SendGetDPI(float *)
1	0.3%	mozilla::dom::PContentChild::SendFindPlugins(unsigned int const &,nsTArray<mozilla::plugins::PluginTag> *,unsigned int *)
Assignee: nobody → mrbkap
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) | mozilla::hal_sandbox::PHalChild::SendGet…
Posted patch patch v1Splinter Review
Attachment #8625592 - Flags: review?(wmccloskey)
Attachment #8625592 - Flags: review?(wmccloskey) → review+
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla42
Comment on attachment 8625592 [details] [diff] [review]
patch v1

This is a topcrasher on Aurora, we should probably uplift it. The patch applies cleanly.

Approval Request Comment
[Feature/regressing bug #]: n/a
[User impact if declined]: More crashes using extensions.
[Describe test coverage new/current, TreeHerder]: The code has a mochitest (a crashtest, really) checked into trunk.
[Risks and why]: Low risk, uses mechanisms already in use elsewhere to solve a well-understood problem.
[String/UUID change made/needed]: n/a
Attachment #8625592 - Flags: approval-mozilla-aurora?
Comment on attachment 8625592 [details] [diff] [review]
patch v1

This fix seems stable as it has been in m-c for a few days now without any negative impact. Let's uplift to Aurora.
Attachment #8625592 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.