1245249 - crash in mozalloc_abort | NS_DebugBreak | mozilla::dom::asmjscache::PAsmJSCacheEntryParent::Write

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jukka Jylänki]

This bug was filed from the Socorro interface and is 
report bp-f17431d8-0c85-431c-9a3e-916252160202.
=============================================================

Bisected to this range:

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=aa58a439e77a9ed81b492ff7417346c5ab52c8d5&tochange=958a7057e1ac0379ee4908b644f4a6b00918ad69

Comment 1

[Jukka Jylänki]

Bill, does the callstack give any hints on this?

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

It sounds like you have an STR if you're able to bisect. I'm happy to investigate if I can reproduce.

The code here is definitely wrong:
http://hg.mozilla.org/mozilla-central/annotate/5f9ba76eb3b1/dom/asmjscache/AsmJSCache.cpp#l1006
If SendFoo returns false, we should not send a __delete__ message. It's possible that the connection has closed by then.

However, it's not clear why SendOnOpenMetadataForRead would return false during normal operation. It's possibly my patches caused that.

Comment 3

[Jukka Jylänki]

Sure thing. Sent you the test case via email (unfortunately not public :/). Let me know if that helps!

Comment 4

[Luke Wagner [:luke]]

Jan: does anything about this jump out to you?  I'm guessing this is related to bug 1173756.

Comment 5

[Luke Wagner [:luke]]

In particular, in comment 2, Bill is pointing to a change from bug 1173756:
  http://hg.mozilla.org/mozilla-central/diff/23d5ef182400/dom/asmjscache/AsmJSCache.cpp#l1145

Comment 6

[Jan Varga [:janv]]

(In reply to Luke Wagner [:luke] from comment #4)
> Jan: does anything about this jump out to you?  I'm guessing this is related
> to bug 1173756.

I don't think I introduced this behavior, we used to call OnOpenMetadataForRead() on that line of code and since there was just one caller of that method I replaced the call with inlined code.

Anyway, I think we should check mActorDestroyed before calling Send__delete() like we do in Fail().
Let me try it.

Comment 7

[Jan Varga [:janv]]

Attachment: patch

Actually, calling Fail() makes more sense here I think.

Comment 8

[Luke Wagner [:luke]]

Comment on attachment 8718761 [details] [diff] [review]
patch

Review of attachment 8718761 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4f450052b2f3

Comment 10

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/4f450052b2f3