1187196 - shutdown crash in mozalloc_abort(char const* const) | NS_DebugBreak | nsDebugImpl::Abort(char const*, int)

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[marvinhk]

bug filed for the report
<https://crash-stats.mozilla.com/report/index/bcce2a35-3f97-43d4-a4ad-9a26a2150724>

firefox crashed during shutdown

Comment 1

[marvinhk]

another new instance <https://crash-stats.mozilla.com/report/index/437e6b0f-6461-402d-b7e3-2bfec2150729>

Comment 2

[alex_mayorga]

https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozalloc_abort%28char+const%2A+const%29+%7C+NS_DebugBreak+%7C+nsDebugImpl%3A%3AAbort%28char+const%2A%2C+int%29 shows well over 4000 crashes with this signature so confirming.

Here's the stack trace for the one I found:

bp-2be5ce06-77c6-4d1b-8ad1-d6b402150721

Crashing Thread
Frame 	Module 	Signature 	Source
0 	mozglue.dll 	mozalloc_abort(char const* const) 	memory/mozalloc/mozalloc_abort.cpp
1 	xul.dll 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	xul.dll 	nsDebugImpl::Abort(char const*, int) 	xpcom/base/nsDebugImpl.cpp
3 	xul.dll 	NS_InvokeByIndex 	xpcom/reflect/xptcall/md/win32/xptcinvoke.cpp
4 	xul.dll 	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
5 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
6 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp
7 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
8 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
9 	xul.dll 	js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
10 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
11 	xul.dll 	js::fun_call(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
12 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
13 	xul.dll 	js::DirectProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/DirectProxyHandler.cpp
14 	xul.dll 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/CrossCompartmentWrapper.cpp
15 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
16 	xul.dll 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
17 		@0x159340de 	
18 		@0x1448899f 	
19 		@0x7dd9cf3 	
20 		@0x14346457 	
21 		@0x159308f0 	
22 	xul.dll 	EnterBaseline 	js/src/jit/BaselineJIT.cpp
23 	xul.dll 	js::jit::EnterBaselineMethod(JSContext*, js::RunState&) 	js/src/jit/BaselineJIT.cpp
24 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
25 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
26 	xul.dll 	js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
27 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
28 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp
29 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
30 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
31 	xul.dll 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
32 	xul.dll 	mozilla::dom::AnyCallback::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) 	obj-firefox/dom/bindings/PromiseBinding.cpp
33 	xul.dll 	mozilla::dom::AnyCallback::Call(JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JSCompartment*) 	obj-firefox/dist/include/mozilla/dom/PromiseBinding.h
34 	msctf.dll 	EnsurePrivateMessages() 	
35 	xul.dll 	JS::IncrementalReferenceBarrier(JS::GCCellPtr) 	js/src/jsgc.cpp
36 	xul.dll 	mozilla::dom::PromiseCallbackTask::Run() 	dom/promise/Promise.cpp
37 	xul.dll 	TimerThread::AddTimerInternal(nsTimerImpl*) 	xpcom/threads/TimerThread.cpp
38 	nss3.dll 	PR_Assert 	nsprpub/pr/src/io/prlog.c
39 	kernel32.dll 	_SEH_prolog4_GS

Comment 3

[marvinhk]

there is no sign that this crash is being attended to or going away ...

crash report from latest 41.0b6 is here <https://crash-stats.mozilla.com/report/index/ed0858aa-f6ea-4202-9e22-9752b2150902>

Comment 4

[jt98989]

Crash signature:  mozalloc_abort(char const* const) | NS_DebugBreak | nsDebugImpl::Abort(char const*, int) 

On 9/25/15, using version 40-0-3, I began to get crashes with this signature when attempting to exit. I upgraded to version 41, to no avail. 
I removed multiple extensions to see if that would stop the problem, but it did not. 

Here is a list of IDs for crash reports I've submitted within the last 26 hours.  I confirmed that the oldest, and three of the six most recent have this crash signature, so I assume the others do as well. 

bp-a8400c32-c797-4ffd-8ae7-d7c582150926
	9/26/15	3:58 AM
bp-3a760aa6-3f8e-47cd-9def-858a62150926
	9/26/15	3:34 AM
bp-bbfedad9-84da-46a9-ba95-cba922150926
	9/26/15	3:14 AM
bp-7bddd8e7-4558-4b37-aa06-e3f3f2150926
	9/26/15	2:54 AM
bp-a91d6fa8-f8c1-42f8-b8ad-a63232150926
	9/26/15	2:25 AM
bp-79fae01f-fce7-481d-97de-993a12150926
	9/26/15	1:54 AM
bp-918c3697-b804-45b9-aa18-f79cf2150926
	9/26/15	1:04 AM
bp-f347a0de-0831-4d92-a987-9a3cf2150926
	9/26/15	12:23 AM
bp-5aadbb6a-b5e4-4899-baee-ea0702150926
	9/25/15	11:38 PM
bp-28c3b5c9-c7cc-4af5-902d-4a98b2150926
	9/25/15	10:46 PM
bp-0831496b-2d4f-49e4-8d1d-03f6d2150926
	9/25/15	8:09 PM
bp-cf35d7e2-a63d-4e88-bc60-620ac2150926
	9/25/15	6:26 PM
bp-1970a966-a4ce-4c37-860d-9fa6d2150926
	9/25/15	6:05 PM
bp-98ceb362-0326-431e-94e9-997f72150925
	9/25/15	11:55 AM
bp-d075c9a0-31d9-4a37-9746-48b7a2150925
	9/25/15	11:01 AM
bp-ec5e7419-1525-483c-9c18-914632150925
	9/25/15	9:39 AM
bp-0c3d3ead-1ea0-4a08-abd5-2c76e2150925
	9/25/15	9:10 AM
bp-87810a7e-91ed-4cfd-8b50-7884f2150925
	9/25/15	8:05 AM
bp-60bad4ec-ec5e-4a94-9ca1-ccdcf2150925
	9/25/15	7:36 AM
bp-bc76a264-5090-4d50-87a7-7a6692150925
	9/25/15	6:53 AM

Comment 5

[jt98989]

Crash signature:  mozalloc_abort(char const* const) | NS_DebugBreak | nsDebugImpl::Abort(char const*, int) 

Today (9/29), I tried downgrading to version 40-0-2. Unfortunately, I continued to get crashes with this signature when attempting to exit.

Here are the IDs for the two crash reports I've submitted within the last 4 hours.  

bp-64454cb3-6fd1-447f-ae5e-a98f72150929
bp-2405d917-d16b-4789-b1cf-ae77d2150929

Comment 6

[jt98989]

Today (9/30), I downgraded to version 38.3 ESR. I've had no more crashes.

Comment 7

[marvinhk]

new instance in Firefox 42.0b9
https://crash-stats.mozilla.com/report/index/3567eeac-5903-4ba8-8a4c-f931c2151027
https://crash-stats.mozilla.com/report/index/18e897ec-97c7-4c47-87c8-9a0982151027

Comment 8

[Tony Mechelynck [:tonymec]]

UA:"Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 SeaMonkey/2.42a1" ID:20151111003002 c-c:1d7535f9bc102939d4c43523e9bb6f870fcfe1d5 m-c:cc473fe5dc512c450634506f68cbacfb40a06a23 en-US

shutdown crash bp-df448036-8a69-4bc7-8ebe-231c92151113

This signature is at the moment listed as follows among topcrashers:
#25 (and rising) for Firefox 45.0a1
#25 (and rising) for Firefox 44.0a2
#30 for Firefox 43.0b
#27 for Firefox 42.0
#18 for SeaMonkey 2.38

For other SeaMonkey branches ther might be too few users for significant statistics but (at shown at top of this comment) I just had it on 2.42a1 trunk.

Comment 9

[Tony Mechelynck [:tonymec]]

The original report was on W32; I had it on L64, hence All/All

Comment 10

[marvinhk]

still happening with the latest beta
https://crash-stats.mozilla.com/report/index/205e9ae1-62ee-499c-81dd-5752b2151124

Comment 11

[David Teller [:Yoric] - still alive but not very active]

Unfortunately, this crash signature is not meaningful, as it just means that Firefox shutdown times out and that we crash Firefox during shutdown instead of letting it freeze forever. Looking at the individual crash reports, they all seem to be related to a number of different issues. We're tracking them here on this dashboard: http://yoric.github.io/are-we-shutting-down-yet-/

I don't think that we have a metabug for shutdown timeouts, so I'm leaving this bug open for the moment, but it's not actionable as such.

Comment 12

[Bogdan Maris, Desktop QA]

I ran into a similar signature crash with reliable steps to reproduce.

Steps:
1. Start Firefox
2. Click Hello icon
3. Start a conversation
4. Click Camera icon (yellow icon) from Conversation window that opens.
5. Detach Conversation window (button next to red button)
6. Click Camera icon (yellow icon)
7. Quit Firefox using CMD+Q
8. Check System Monitor

Actual results: Firefox process remains active and after ~1 minute FF will crash. (just wait for it to crash)

Here are a few crashes I ran into:
bp-f52af033-55fa-4978-a7b6-ba7062160122
bp-304cf75e-3154-454f-ae1b-d57912160122
bp-53708925-2ea5-40e7-aa66-ba22b2160122
bp-dc8b1212-0818-4a61-86e9-131682160122
bp-e7d81fbf-b017-4181-a985-9a7222160122
bp-af9890bb-b1f1-49e2-b685-252b92160122
bp-13b6556f-7933-4ea0-8419-82cff2160122
bp-fb1e6a2d-3354-4bfa-b8d8-eb45d2160122
bp-26563543-86af-4ecf-ab2e-34a7b2160122

Regression range on beta/RC

Firefox 43 beta 9 - Good
Firefox 43.0.4 - Good
Firefox 44 beta 1 - Bad
...all betas till RC
Firefox 44.0 RC -bad

I reproduced using an iMac with Mac OS X 10.10.5, could not reproduce on Windows or Ubuntu.

Should I log a new bug on this? I saw about ~700 crashes in the last week in Socorro (all on Mac):
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozalloc_abort+%7C+Abort+%7C+NS_DebugBreak+%7C+nsDebugImpl%3A%3AAbort

Comment 13

[David Teller [:Yoric] - still alive but not very active]

Yes, please file a bug in Core:Audio/Video. The title should be along the lines of "AsyncShutdown crash in Media shutdown: blocking on media thread". Please Cc rjesup.

Comment 14

[Randell Jesup [:jesup] (needinfo me)]

Bogdan - I don't see a bug filed on this; perhaps it was dupped/closed/moved?  And all the crashes I see in your comment link to 
Bug 1244711 -- AsyncShutdown timeout: "SessionFile: Finish writing Session Restore data"

Comment 15

[Bogdan Maris, Desktop QA]

(In reply to Randell Jesup [:jesup] from comment #14)
> Bogdan - I don't see a bug filed on this; perhaps it was
> dupped/closed/moved?  And all the crashes I see in your comment link to 
> Bug 1244711 -- AsyncShutdown timeout: "SessionFile: Finish writing Session
> Restore data"

I logged bug 1242891 on this but it's closed as WFM since it does not reproduce in Firefox 45.

Comment 16

[javascriptjedi]

I'm hitting this crash in FF 45.1.1 ESR, and it's a showstopper as it's affecting our automated processes.

Comment 17

[David Teller [:Yoric] - still alive but not very active]

(In reply to javascriptjedi from comment #16)
> I'm hitting this crash in FF 45.1.1 ESR, and it's a showstopper as it's
> affecting our automated processes.

What's in field AsyncShutdownTimeout of the metadata?

Comment 18

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 19

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.