Assertion failure: mStatus != eInUse, at dom/base/Console.cpp:292 (in ~ConsoleCallData), on various Google properties

RESOLVED FIXED in Firefox 48

Status

()

Core
DOM
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: dbaron, Assigned: baku)

Tracking

Trunk
mozilla49
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox48 fixed, firefox49 fixed)

Details

(Whiteboard: btpp-active)

Attachments

(2 attachments, 1 obsolete attachment)

After I updated my tree (I use a debug build for regular browsing) to https://hg.mozilla.org/mozilla-central/rev/c40c0b2f3b4c last weekend, I hit the assertion:

Assertion failure: mStatus != eInUse, at /home/dbaron/builds/ssd/mozilla-central/mozilla/dom/base/Console.cpp:292

twice, reasonably close together -- a high enough frequency that I just commented it out locally.

This assertion is in ConsoleCallData::~ConsoleCallData.

It looks like the first time I hit it I was loading:
http://productforums.google.com/d/msg/gmail/a2wUB5iMfr4/OIKlvJYsxqwJ
and the second time I was loading:
https://keep.google.com/

Updated

2 years ago
Flags: needinfo?(amarchesini)
(Assignee)

Comment 1

2 years ago
Created attachment 8739738 [details] [diff] [review]
console2.patch

This seems to me a valid reason of this error:

1. Console is unlinked and Console::Shutdown() is executed.
2. But in the meantime we have runnables doing something with ConsoleCallData objects.
3. Currently we clear the array of ConsoleCallData objects without checking if they are in eInUse state.
4. If the runnable are not dispatched (maybe canceled by the worker?) we don't change the state of the ConsoleCallData object.
Assignee: nobody → amarchesini
Flags: needinfo?(amarchesini)
Attachment #8739738 - Flags: review?(bugs)
(Assignee)

Comment 2

2 years ago
Created attachment 8739739 [details] [diff] [review]
console2.patch

I think I was wrong. The reason seems more likely that the runnable is canceled.
Attachment #8739738 - Attachment is obsolete: true
Attachment #8739738 - Flags: review?(bugs)
Attachment #8739739 - Flags: review?(bugs)
Whiteboard: btpp-active

Comment 3

2 years ago
Comment on attachment 8739739 [details] [diff] [review]
console2.patch

Perhaps add a comment to Cancel why we aren't calling parent class' Cancel.

It is rather surprising that WorkerControlRunnable::Cancel() ends up calling
Run().

rs+
Attachment #8739739 - Flags: review?(bugs) → review+

Comment 4

2 years ago
Did you actually manage to reproduce this (without the patch)?
(Assignee)

Comment 5

2 years ago
No, I tried, but no luck. It seems very racy to me.

Comment 7

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/7b1d75803c58
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox48: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
I just saw this assertion in a build with the above patch, in a room on https://appear.in/ .

It doesn't seem as frequent as it was, though, and I haven't seen it on any Google properties again.
OK, I just crashed twice trying to load Google Translate, with this patch, so I think it's pretty clear this didn't fix the problem.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
... and just crashed loading gmail.
(Assignee)

Comment 11

2 years ago
Do you have a crash report to share?
Flags: needinfo?(dbaron)
(Assignee)

Comment 12

2 years ago
Or the log of one of these crashes. What I would like to see is some warning messages from WorkerRunnable or WorkerPrivate code.
I have stdout from a session that had 4 of these child process crashes, but I don't see any messages in common between them.  What should I be looking for?

(Alternatively, if you want me to un-comment the assertion and debug it the next time I hit it, what should I be looking for when I debug?)
Flags: needinfo?(dbaron)
(Assignee)

Comment 14

2 years ago
Created attachment 8744779 [details] [diff] [review]
console.patch
Attachment #8744779 - Flags: review?(bugs)

Updated

2 years ago
Attachment #8744779 - Flags: review?(bugs) → review+

Comment 16

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/e80811ba725d
Status: REOPENED → RESOLVED
Last Resolved: 2 years ago2 years ago
status-firefox49: --- → fixed
Resolution: --- → FIXED
Target Milestone: mozilla48 → mozilla49
Depends on: 1268303
You need to log in before you can comment on or make changes to this bug.