1359029 - Intermittent toolkit/components/telemetry/tests/unit/test_ChildHistograms.js | application crashed [@ CrashReporter::AnnotateCrashReport(nsACString const &,nsACString const &)]

Status: RESOLVED INCOMPLETE

(Toolkit :: Crash Reporting, defect)

Description

[Treeherder Bug Filer]

Filed by: cbook [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=93710165&repo=mozilla-inbound

https://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-inbound-win32-debug/1493029039/mozilla-inbound_win7_vm-debug_test-xpcshell-bm129-tests1-windows-build367.txt.gz

Comment 1

[(not currently active) Ted Mielczarek]

This appears to be hitting this assert:
https://dxr.mozilla.org/mozilla-central/rev/e17cbb839dd225a2da7e5d5bec43cf94e11749d8/toolkit/crashreporter/nsExceptionHandler.cpp#2355

Given this frame in thread 0, I'm guessing this is the GPU process:
04:40:14     INFO -  18  xul.dll!mozilla::gfx::GPUProcessImpl::CleanUp() [GPUProcessImpl.cpp:a10d45c7d6de : 35 + 0x7]

I'm kind of surprised that the GPU process would be running in an xpcshell test, but I admit that I don't know how that all works. Interestingly, from the .extra file ( http://mozilla-releng-blobs.s3.amazonaws.com/blobs/mozilla-inbound/sha512/4abb3f8d8fa8b5b74d389abc1b4e1c1b767fdfad2cb687326f2179ca66cb2e2a3612cff7efd34bde58cf86681e36898f9b5b8d815384cfcdf611bd81a1aae076 ) there's:
GPUProcessStatus=Destroyed

The stack for thread 0 clearly shows the process is in the middle of shutting down. Thread 4 (the crashing thread) is calling AnnotateCrashReport here:
https://dxr.mozilla.org/mozilla-central/rev/e17cbb839dd225a2da7e5d5bec43cf94e11749d8/ipc/glue/MessageChannel.cpp#680

Assuming I'm looking at the right code, the GPU process cleans up the CrashReporterClient singleton right before shutting down XPCOM:
https://dxr.mozilla.org/mozilla-central/rev/e17cbb839dd225a2da7e5d5bec43cf94e11749d8/gfx/ipc/GPUParent.cpp#486

...so there's clearly a race here where IPC traffic during shutdown can cause AnnotateCrashReport to be called from a background thread, which will fail that assertion if the CrashReporterClient has already been cleaned up.

I think this code was all added in bug 1278717.