Closed Bug 1171432 Opened 9 years ago Closed 9 years ago

Intermittent browser_subdialogs.js | application crashed [@ mozilla::OriginAttributes::CreateSuffix(nsACString_internal&) const] (Assertion failure: mAppId != nsIScriptSecurityManager::UNKNOWN_APP_ID, at caps/BasePrincipal.cpp:27)

Categories

(Core :: DOM: Service Workers, defect)

Product:
Core
Component:
DOM: Service Workers
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox41 --- affected

People

(Reporter: RyanVM, Unassigned)

References

Details

(4 keywords)

Crash Data

19:26:36 INFO - Assertion failure: mAppId != nsIScriptSecurityManager::UNKNOWN_APP_ID, at /builds/slave/fx-team-l64-d-0000000000000000/build/src/caps/BasePrincipal.cpp:27
19:26:36 INFO - #01: mozilla::BasePrincipal::GetOriginSuffix(nsACString_internal&) [caps/BasePrincipal.cpp:179]
19:26:36 INFO - #02: mozilla::dom::workers::ServiceWorkerManager::PrincipalToScopeKey(nsIPrincipal*, nsACString_internal&) [xpcom/glue/nsDebug.h:40]
19:26:36 INFO - #03: mozilla::dom::workers::ServiceWorkerManager::GetServiceWorkerRegistrationInfo(nsIPrincipal*, nsIURI*) [xpcom/glue/nsDebug.h:40]
19:26:36 INFO - #04: mozilla::dom::workers::ServiceWorkerManager::GetServiceWorkerRegistrationInfo(nsIDocument*) [dom/workers/ServiceWorkerManager.cpp:2517]
19:26:36 INFO - #05: mozilla::dom::workers::ServiceWorkerManager::MaybeStartControlling(nsIDocument*) [mfbt/AlreadyAddRefed.h:116]
19:26:36 INFO - #06: nsDocument::SetScriptGlobalObject(nsIScriptGlobalObject*) [dom/base/nsDocument.cpp:4783]
19:26:36 INFO - #07: nsDocumentViewer::Close(nsISHEntry*) [layout/base/nsDocumentViewer.cpp:1496]
19:26:36 INFO - #08: mozilla::image::SVGDocumentWrapper::DestroyViewer() [image/SVGDocumentWrapper.cpp:65]
19:26:36 INFO - #09: mozilla::image::SVGDocumentWrapper::Observe(nsISupports*, char const*, char16_t const*) [image/SVGDocumentWrapper.cpp:266]
19:26:36 INFO - #10: nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) [xpcom/glue/nsTArray.h:361]
19:26:36 INFO - #11: nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) [xpcom/glue/nsTHashtable.h:135]
19:26:36 INFO - #12: mozilla::ShutdownXPCOM(nsIServiceManager*) [xpcom/build/XPCOMInit.cpp:834]
19:26:36 INFO - #13: ScopedXPCOMStartup::~ScopedXPCOMStartup() [toolkit/xre/nsAppRunner.cpp:1495]
19:26:36 INFO - #14: mozilla::UniquePtr<ScopedXPCOMStartup, mozilla::DefaultDelete<ScopedXPCOMStartup> >::reset(ScopedXPCOMStartup*) [memory/mozalloc/mozalloc.h:210]
19:26:36 INFO - #15: XREMain::XRE_main(int, char**, nsXREAppData const*) [mfbt/UniquePtr.h:278]
19:26:36 INFO - #16: XRE_main [toolkit/xre/nsAppRunner.cpp:4426]
19:26:36 INFO - #17: do_main [browser/app/nsBrowserApp.cpp:214]
19:26:36 INFO - #18: main [browser/app/nsBrowserApp.cpp:480]
19:26:36 INFO - #19: libc.so.6 + 0x2176d
19:26:36 INFO - #20: _start
19:26:36 INFO - TEST-INFO | Main app process: killed by SIGSEGV
19:26:36 INFO - 1215 INFO checking window state
19:26:36 INFO - 1216 INFO TEST-START | Shutdown
19:26:36 INFO - 1217 INFO Browser Chrome Test Summary
19:26:36 INFO - 1218 INFO Passed: 1072
19:26:36 INFO - 1219 INFO Failed: 0
19:26:36 INFO - 1220 INFO Todo: 3
19:26:36 INFO - 1221 INFO *** End BrowserChrome Test Results ***
19:26:36 WARNING - TEST-UNEXPECTED-FAIL | browser/components/preferences/in-content/tests/browser_subdialogs.js | application terminated with exit code 11
19:26:36 INFO - runtests.py | Application ran for: 0:02:40.735257
19:26:36 INFO - zombiecheck | Reading PID log: /tmp/tmpsjVVR0pidlog
19:26:46 INFO - mozcrash Saved minidump as /builds/slave/test/build/blobber_upload_dir/08263138-d57a-d4d9-4003393a-388d6022.dmp
19:26:46 INFO - mozcrash Saved app info as /builds/slave/test/build/blobber_upload_dir/08263138-d57a-d4d9-4003393a-388d6022.extra
19:26:46 WARNING - PROCESS-CRASH | browser/components/preferences/in-content/tests/browser_subdialogs.js | application crashed [@ mozilla::OriginAttributes::CreateSuffix(nsACString_internal&) const]
19:26:46 INFO - Crash dump filename: /tmp/tmpZlcfOM.mozrunner/minidumps/08263138-d57a-d4d9-4003393a-388d6022.dmp
19:26:46 INFO - Operating system: Linux
19:26:46 INFO - 0.0.0 Linux 3.2.0-76-generic #111-Ubuntu SMP Tue Jan 13 22:16:09 UTC 2015 x86_64
19:26:46 INFO - CPU: amd64
19:26:46 INFO - family 6 model 62 stepping 4
19:26:46 INFO - 1 CPU
19:26:46 INFO - Crash reason: SIGSEGV
19:26:46 INFO - Crash address: 0x0
19:26:46 INFO - Thread 0 (crashed)
19:26:46 INFO - 0 libxul.so!mozilla::OriginAttributes::CreateSuffix(nsACString_internal&) const [BasePrincipal.cpp:813e37cf69e3 : 27 + 0x21]
19:26:46 INFO - rbx = 0x00007fff03d43e10 r12 = 0x00007f3289bb32a8
19:26:46 INFO - r13 = 0x00007f32a1edb120 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32be121646
19:26:46 INFO - rsp = 0x00007fff03d43da0 rbp = 0x00007fff03d43db0
19:26:46 INFO - Found by: given as instruction pointer in context
19:26:46 INFO - 1 libxul.so!mozilla::BasePrincipal::GetOriginSuffix(nsACString_internal&) [BasePrincipal.cpp:813e37cf69e3 : 177 + 0x4]
19:26:46 INFO - rbx = 0x00007f3289bb3290 r12 = 0x00007f3289bb3290
19:26:46 INFO - r13 = 0x00007f32a1edb120 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32be1216c5
19:26:46 INFO - rsp = 0x00007fff03d43dc0 rbp = 0x00007fff03d43dc0
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 2 libxul.so!mozilla::dom::workers::ServiceWorkerManager::PrincipalToScopeKey(nsIPrincipal*, nsACString_internal&) [ServiceWorkerManager.cpp:813e37cf69e3 : 2595 + 0xb]
19:26:46 INFO - rbx = 0x00007f3289bb3290 r12 = 0x00007f3289bb3290
19:26:46 INFO - r13 = 0x00007f32a1edb120 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32bef4c803
19:26:46 INFO - rsp = 0x00007fff03d43dd0 rbp = 0x00007fff03d43df0
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 3 libxul.so!mozilla::dom::workers::ServiceWorkerManager::GetServiceWorkerRegistrationInfo(nsIPrincipal*, nsIURI*) [ServiceWorkerManager.cpp:813e37cf69e3 : 2528 + 0xb]
19:26:46 INFO - rbx = 0x00007fff03d43ee8 r12 = 0x00007f3289bb3290
19:26:46 INFO - r13 = 0x00007f32a1edb120 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32bef6032d
19:26:46 INFO - rsp = 0x00007fff03d43e00 rbp = 0x00007fff03d43e90
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 4 libxul.so!mozilla::dom::workers::ServiceWorkerManager::GetServiceWorkerRegistrationInfo(nsIDocument*) [ServiceWorkerManager.cpp:813e37cf69e3 : 2517 + 0x12]
19:26:46 INFO - rbx = 0x00007f328cd60800 r12 = 0x00007fff03d43ee8
19:26:46 INFO - r13 = 0x00007f32a1edb120 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32bef6056a
19:26:46 INFO - rsp = 0x00007fff03d43ea0 rbp = 0x00007fff03d43ed0
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 5 libxul.so!mozilla::dom::workers::ServiceWorkerManager::MaybeStartControlling(nsIDocument*) [ServiceWorkerManager.cpp:813e37cf69e3 : 2744 + 0xe]
19:26:46 INFO - rbx = 0x00007f328cd60800 r12 = 0x00007f32a1edb120
19:26:46 INFO - r13 = 0x00007f32a1edb1b8 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32bef605f9
19:26:46 INFO - rsp = 0x00007fff03d43ee0 rbp = 0x00007fff03d43f10
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 6 libxul.so!nsDocument::SetScriptGlobalObject(nsIScriptGlobalObject*) [nsDocument.cpp:813e37cf69e3 : 4782 + 0x8]
19:26:46 INFO - rbx = 0x00007f328cd60800 r12 = 0x0000000000000000
19:26:46 INFO - r13 = 0x0000000000000000 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32be42e2f0
19:26:46 INFO - rsp = 0x00007fff03d43f20 rbp = 0x00007fff03d43f80
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 7 libxul.so!nsDocumentViewer::Close(nsISHEntry*) [nsDocumentViewer.cpp:813e37cf69e3 : 1494 + 0x19]
19:26:46 INFO - rbx = 0x00007f328ac29080 r12 = 0x00007f328ac290d0
19:26:46 INFO - r13 = 0x00007f32c3d8b4e8 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32bf2c1794
19:26:46 INFO - rsp = 0x00007fff03d43f90 rbp = 0x00007fff03d43fd0
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 8 libxul.so!mozilla::image::SVGDocumentWrapper::DestroyViewer() [SVGDocumentWrapper.cpp:813e37cf69e3 : 64 + 0x12]
19:26:46 INFO - rbx = 0x00007f3289bb3270 r12 = 0x00007fff03d44028
19:26:46 INFO - r13 = 0x00007f32c3d8b4e8 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32be2ed078
19:26:46 INFO - rsp = 0x00007fff03d43fe0 rbp = 0x00007fff03d43ff0
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 9 libxul.so!mozilla::image::SVGDocumentWrapper::Observe(nsISupports*, char const*, char16_t const*) [SVGDocumentWrapper.cpp:813e37cf69e3 : 265 + 0x7]
19:26:46 INFO - rbx = 0x00007f3289bb3240 r12 = 0x00007fff03d44028
19:26:46 INFO - r13 = 0x00007f32c3d8b4e8 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32be2ed0da
19:26:46 INFO - rsp = 0x00007fff03d44000 rbp = 0x00007fff03d44010
19:26:46 INFO - Found by: call frame info
19:26:46 INFO - 10 libxul.so!nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) [nsObserverList.cpp:813e37cf69e3 : 113 + 0xe]
19:26:46 INFO - rbx = 0x000000000000000a r12 = 0x00007fff03d44028
19:26:46 INFO - r13 = 0x00007f32c3d8b4e8 r14 = 0x00007f32c04406d1
19:26:46 INFO - r15 = 0x0000000000000000 rip = 0x00007f32bda86c66
19:26:46 INFO - rsp = 0x00007fff03d44020 rbp = 0x00007fff03d44060
19:26:46 INFO - Found by: call frame info
Flags: needinfo?(amarchesini)
bholley, wondering if we can return an error instead having MOZ_ASSERT in OriginAttributes::CreateSuffix.
Flags: needinfo?(amarchesini) → needinfo?(bobbyholley)
(In reply to Andrea Marchesini (:baku) from comment #4)
> bholley, wondering if we can return an error instead having MOZ_ASSERT in
> OriginAttributes::CreateSuffix.

I think we should figure out why a principal with an UNKNOWN_APP_ID is doing anything related to service workers. I believe these are only generated by calls to getSimpleCodebasePrincipal, of which there are very few in the tree.
Flags: needinfo?(bobbyholley)
I think the fact that we are shutting down XPCOM is important.
I just had this happen to me while reading my gmail (unless it was a background tab) on nightly. can't reproduce

https://crash-stats.mozilla.com/report/index/a33cf072-d09a-4ea6-908e-ead4e2150604
and this morning I found my idle desktop nightly was crashed on this

https://crash-stats.mozilla.com/report/index/545b0e50-b68a-457b-9107-341e72150605
For the first time in a long while, I've had to abandon the normal nightly channel for my primary browser due to instability around this crash.. this time it crashed entering a comment into a very long and busy google doc.

bobby, can we swap the assert to just be MOZ_ASSERT now that there are data points?

two more:
bp-a12e6a1f-bb24-446f-babb-813eb2150605
bp-cfeaf065-2317-44ff-8ab6-75e162150605
Flags: needinfo?(bobbyholley)
See Also: → 1171742
This is a regression from bug 1162088. nsm is going to see if he can fix it, otherwise back it out.
Flags: needinfo?(bobbyholley) → needinfo?(nsm.nikhil)
Today's nightly is very crashy for me as well because of this.
Given the tree closure, I don't think we can get the fix landed before tonight's nightlies, if there even are any. :-(
This is making Nightly really crashy and it doesn't look like we're getting anywhere. Can we back out bug 1162088 please?
Flags: needinfo?(bobbyholley)
Keywords: dogfood
(In reply to Dave Townsend [:mossop] from comment #22)
> This is making Nightly really crashy and it doesn't look like we're getting
> anywhere. Can we back out bug 1162088 please?

Yes please. This is on nsm's plate, not mine.
Flags: needinfo?(bobbyholley)
Severity: normal → critical
Crash Signature: [@ mozilla::OriginAttributes::CreateSuffix(nsACString_internal&) const ] [@ mozilla::OriginAttributes::CreateSuffix(nsACString_internal&)]
OS: Linux → All
Hardware: x86_64 → All
Bug 1172717 temporarily fixes this.
Flags: needinfo?(nsm.nikhil)
One way to create an SVG document with a principal with UNKNOWN_APP_ID is to get into this code path: <https://dxr.allizom.org/mozilla-central/source/dom/base/DOMParser.cpp#344>.  For that, mPrincipal needs to be null (for example, dom/base/test/chrome/test_domparsing.xul exercises that code path, but not with an SVG image).  Note that mPrincipal can only be null if the DOMParser object is constructed from chrome, for example like |new DOMParser(null)|.

Parsing an SVG document with such a DOMParser object should probably help reproduce this.
We fixed some crashes with this signature in bug 1182610 and bug 1205456. I'm not sure if they're ultimately the same cause as the oranges, but in any case this bug has been idle for several months. Any objection to resolving?
sgtm.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WORKSFORME
Sorry to bring bad news.
report bp-1cf5e04e-6193-4b97-a3cc-860412150929
more here: http://is.gd/ZVPDel

Let me know if you'd like a new bug filed.
Status: RESOLVED → REOPENED
Flags: needinfo?(bobbyholley)
Resolution: WORKSFORME → ---
I disabled adblock-plus and restarted and can no longer recreate...
I hit this crash three times with today's Nightly 44. Once I disabled e10s, the crashes went away.

bp-72f0e67c-cfe4-47f0-8399-f052a2150929
bp-e462068e-0872-49e2-aab7-355c32150929
bp-1fd56630-dd8f-41b8-aff7-caae52150929
According to super search there is a spike on the latest nightly:

Rank 	Build id 	Count 	%
1 	20150929030225 	654 	98.20 %
4 	20150629030210 	3 	0.45 %
5 	20150627030211 	2 	0.30 %
2 	20150620030209 	4 	0.60 %
3 	20150608030201 	3 	0.45 %

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6256ec9113c115141aab089c45ee69438884b680&tochange=acdb22976ff86539dc10413c5f366e1fb429a680
My STR:

1. Enable e10s.
2. Open two links into background tabs, e.g. open https://news.ycombinator.com/ and then middle-click on two story links.

RESULT:

Crash when the second tab starts to load in the background.
My STR need another step:

1.5. Enable Adblock Plus, uBlock, or Lightbeam. ABP is not required. Enabling any of these individual is adequate!
I'm also affected with this bug with e10s enbled on Nightly 44.0 x64
NI? Nikhil for ideas.
Flags: needinfo?(nsm.nikhil)
If I understand bug 1209843 correctly, I think it will remove this assertion.
Yep, we also backed out the patch that made these spike.

If you hit any new crashes here, please file a new bug, and probably make it depend on bug 1209843.
Status: REOPENED → RESOLVED
Closed: 9 years ago → 9 years ago
Flags: needinfo?(nsm.nikhil)
Flags: needinfo?(bobbyholley)
Resolution: --- → FIXED
Resolution: FIXED → WORKSFORME
You need to log in before you can comment on or make changes to this bug.