If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

crash in mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) | mozilla::jsipc::PJavaScriptPare...

RESOLVED WORKSFORME

Status

()

Core
IPC
--
critical
RESOLVED WORKSFORME
2 years ago
2 years ago

People

(Reporter: alex_mayorga, Unassigned)

Tracking

({crash, reproducible})

42 Branch
Unspecified
Windows 8.1
crash, reproducible
Points:
---

Firefox Tracking Flags

(e10s?, firefox42 affected, firefox43 affected)

Details

(crash signature)

(Reporter)

Description

2 years ago
This bug was filed from the Socorro interface and is 
report bp-fdedeaa3-b815-47ba-8c9e-9d1ab2150719.
=============================================================

Top crasher #19 for Nightly for the past 7 days. Startup crash.

https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozalloc_abort%28char+const%2A+const%29+%7C+NS_DebugBreak+%7C+mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ADebugAbort%28char+const%2A%2C+int%2C+char+const%2A%2C+char+const%2A%2C+bool%29+%7C+mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ASend%28IPC%3A%3AMessage%2A%2C+IPC%3A%3AMessage%2A%29+%7C+mozilla%3A%3Ajsipc%3A%3APJavaScriptParent%3A%3ASendG...

Crashing Thread
Frame 	Module 	Signature 	Source
0 	mozglue.dll 	mozalloc_abort(char const* const) 	memory/mozalloc/mozalloc_abort.cpp
1 	xul.dll 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	xul.dll 	mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) 	ipc/glue/MessageChannel.cpp
3 	xul.dll 	mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) 	ipc/glue/MessageChannel.cpp
4 	xul.dll 	mozilla::jsipc::PJavaScriptParent::SendGet(unsigned __int64 const&, mozilla::jsipc::ObjectVariant const&, mozilla::jsipc::JSIDVariant const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*) 	obj-firefox/ipc/ipdl/PJavaScriptParent.cpp
5 	xul.dll 	mozilla::jsipc::JavaScriptBase<mozilla::jsipc::PJavaScriptParent>::SendGet(mozilla::jsipc::ObjectId const&, mozilla::jsipc::ObjectVariant const&, mozilla::jsipc::JSIDVariant const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*) 	js/ipc/JavaScriptBase.h
6 	xul.dll 	mozilla::jsipc::WrapperOwner::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/ipc/WrapperOwner.cpp
7 	xul.dll 	CPOWProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/ipc/WrapperOwner.cpp
8 	xul.dll 	js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/proxy/Proxy.cpp
9 	xul.dll 	js::DirectProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/proxy/DirectProxyHandler.cpp
10 	xul.dll 	js::CrossCompartmentWrapper::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/proxy/CrossCompartmentWrapper.cpp
11 	xul.dll 	xpc::AddonWrapper<js::CrossCompartmentWrapper>::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/xpconnect/wrappers/AddonWrapper.cpp
12 	xul.dll 	js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/proxy/Proxy.cpp
13 	xul.dll 	js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/vm/NativeObject.h
14 	xul.dll 	js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
15 	xul.dll 	js::jit::DoGetPropFallback 	js/src/jit/BaselineIC.cpp
16 		@0x2948d7d7cad

Comment 1

2 years ago
I foun STR with Nighty in e10s mode.

1) Enable e10s
2) Open about:preferences#privacy
3) In "History", select:
- Use custom settings for history
- Accept cookies from sites
- Accept third-party cookies: Never (it's optional, to bypass GG's cookies from safebrowsing)
- Keep until: ask me every time
4) Open a website with a "ton" of cookies like http://www.lemonde.fr/
5) Go back to the OS desktop
6) Hover the taskbar icon of Nightly to see the list of open tabs/pop-ups
7) Close directly from the list the tab about http://www.lemonde.fr/

Result: Nightly crashes.
https://crash-stats.mozilla.com/report/index/d4c45195-9b80-472a-95aa-bbe702150831
Blocks: 516752
status-firefox43: --- → affected
Keywords: reproducible
The crash in comment 1 is happening on this line:

IPC_ASSERT(DispatchingAsyncMessagePriority() != IPC::Message::PRIORITY_URGENT,
           "not allowed to send messages while dispatching urgent messages");

I don't see anything matching the search from crash in comment 0, but maybe the signature has changed. It is indeed crashing on the same line, though.
Flags: needinfo?(wmccloskey)
tracking-e10s: --- → ?
(In reply to Andrew McCreight [:mccr8] from comment #2)
> I don't see anything matching the search from crash in comment 0

Ah, yeah, I clicked on "more reports" in the crash report in comment 1 and this is still happening somewhat regularly.

Updated

2 years ago
Duplicate of this bug: 1199299

Comment 5

2 years ago
With Aurora 42 x64 e10s I get slightly different crash signatures (end with "SendH" instead of "SendG"):

mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) | mozilla::jsipc::PJavaScriptParent::SendH... ]

Examples:
https://crash-stats.mozilla.com/report/index/14b26d4b-4bcc-40be-9943-b78ba2150905
https://crash-stats.mozilla.com/report/index/3e8c1cb7-1721-4dad-b859-be7972150905
https://crash-stats.mozilla.com/report/index/8873e123-50e3-459b-b43c-d29e22150815
https://crash-stats.mozilla.com/report/index/fc685acf-8ce7-4f80-94b6-afaea2150816

I mention the crashes here as they happen on the same line  "###!!! ABORT: not allowed to send messages while dispatching urgent messages"

My cookie settings are similar as in the STR in #1, except that I "always accept" third party cookies.

I have practically switched away from e10s due to the crash frequency. Today I decided to test e10s again and noted that Firefox still crashes :-(

Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:42.0) Gecko/20100101 Firefox/42.0 ID:20150904004016 CSet: a9d79eb7e02a
I suspect what's happening is that our urgent "get cookie" message is causing us to put up a dialog and run a nested event loop. At that time we can send a CPOW down, which violates our rules.

Blake thinks we can maybe keep around the cookies for a site when it loads (maybe finding them through the HTTP channel). Then we wouldn't need a sync message at all. That would also improve performance.
Flags: needinfo?(wmccloskey) → needinfo?(mrbkap)
This is hovering around top #20 on Nightly (currently #24 with just 16 crashes in the past week)
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) | mozilla::jsipc::PJavaScriptParent&hellip; → [@ mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) | mozilla::jsipc::PJavaScriptParent&hellip;
This should have been fixed by CPOW cancellation.
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → WORKSFORME

Updated

2 years ago
Flags: needinfo?(mrbkap)
You need to log in before you can comment on or make changes to this bug.