Closed Bug 1265680 Opened 9 years ago Closed 8 years ago

crash in mozalloc_abort | NS_DebugBreak | mozilla::ipc::FatalError | mozilla::dom::PBrowserChild::FatalError | mozilla::dom::PBrowserChild::OnMessageReceived

Categories

(Core :: DOM: Content Processes, defect, P1)

Product:
Core
Component:
DOM: Content Processes
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
e10s + ---

People

(Reporter: kanru, Assigned: mccr8)

References

Details

(Keywords: crash, Whiteboard: btpp-active,e10st?)

Crash Data

+++ This bug was initially created as a clone of Bug #1258312 +++ I saw some new signatures on Nightly which are deserialization on nsTArray. One of the messages is PBrowser::Msg_HandleAccessKey. I haven't check the others. https://crash-stats.mozilla.com/search/?product=Firefox&build_id=%3E%3D20160414000000&signature=~mozilla%3A%3Adom%3A%3APBrowserChild%3A%3AOnMessageReceived&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports
Note bug 1258312 altered Pickle::Resize so that it would oom crash with a more appropriate signature. Prior to that change those failures tended to show up under PBrowserChild::OnMessageReceived. This bug tracks remaining issues with PBrowserChild::OnMessageReceived.
Some more data: 10 out of 10 crashes are SendHandleAccessKey error on deserialization of nsTArray. The Pickle header_size_ is 28 and capacity_ is 32 so basically an empty message. Let's see if this turns out to be a top crasher.
Assignee: nobody → continuation
The first argument to this message has type nsTArray<uint32_t>. We send lots of nsTArrays over IPC, but not as many where |sUseWriteBytes| is true. ByteLengthIsValid() doesn't look correct to me, and if that returns |false|, we'll silently send a truncated message, which would result in the behavior Kan-Ru describes in comment 2. I'll fix up ByteLengthIsValid(), and makes its failure during Write() fatal in release builds, so we'll at least get information where it is going wrong (and confirm my hypothesis, hopefully).
Depends on: 1268130
Oddly, I don't see any crashes with this signature after 4-24, which is before bug 1268130 landed. I don't know what could have fixed or changed the signature.
Depends on: 1268900
Whiteboard: btpp-active → btpp-active,e10st?
[Tracking Requested - why for this release]:
blocking-b2g: --- → 2.6?
tracking-b2g: --- → backlog
blocking-b2g: 2.6? → ---
tracking-b2g: backlog → ---
Completely disappeared on Nightly.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.