1361901 - Crash in [@ NtProtectVirtualMemory ] force-quitting Firefox after it freezes on Words with Friends

Status: VERIFIED FIXED

(Core :: IPC, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0

This bug was filed from the Socorro interface and is 
report bp-b2309202-0238-4e56-9384-67a7f0170503.
=============================================================

Using (largely) the same steps from bug 1361897:

1. Logged in to Facebook.com, play Words with Friends for a little while
2. After quite a few dynamic (Flash-based, it seems) ads get swapped out/pulled in, I get "This web page is making Firefox slow..." [stop] [wait]
3. After clicking [wait] repeatedly, it gets to a point where I have to force-quit Firefox, which also can lead to:

http://bsmedberg.github.io/socorro-toolbox/html/multiple-minidumps.html?crashID=417a6859-0389-49ac-b4a5-a83b40170503

The hang/crash report here is sent on Firefox restart, if that matters...

Comment 1

[(No longer employed by Mozilla) Aaron Klotz]

(In reply to Stephen Donner [:stephend] from comment #0)
> This bug was filed from the Socorro interface and is 
> report bp-b2309202-0238-4e56-9384-67a7f0170503.
> =============================================================

This one is showing a deadlock on the loader lock due to the profiler sampler thread.

Comment 2

[(Away)]

LdrUnloadDll -- this is very likely to be the same as bug 1349444 which I pushed to inbound earlier today.

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

In case it helps (and I probably should investigate some of the other hang/crash stacks):

https://crash-stats.mozilla.com/report/index/bp-417a6859-0389-49ac-b4a5-a83b40170503
https://crash-stats.mozilla.com/report/index/bp-ad5805f7-c9a7-4e82-b78f-858bb0170503
https://crash-stats.mozilla.com/report/index/bp-9c50ab5e-c56e-48dd-b68c-63b6c0170503
https://crash-stats.mozilla.com/report/index/bp-c90b28f7-39ce-4bca-bd22-12e500170503
https://crash-stats.mozilla.com/report/index/bp-4025123b-9674-42aa-b91e-244510170503
https://crash-stats.mozilla.com/report/index/bp-64edfa7f-baa2-406f-9bb8-a218f0170503
https://crash-stats.mozilla.com/report/index/bp-5b5b78ee-f414-4626-9391-844150170503
https://crash-stats.mozilla.com/report/index/bp-45267782-e792-41a1-a365-364810170503
https://crash-stats.mozilla.com/report/index/bp-1652e0f7-56ba-4a08-90e1-957e80170503
https://crash-stats.mozilla.com/report/index/bp-8c55cadd-e427-4da2-8a66-a29dd0170503

Those are all from today; similar scenario, but, I should mention:

1) Once or twice, I hit "[stop]", which lead, eventually, to a blank viewport with an AJAX spinner (and then I closed its tab, and eventually still had to force-quit and restart Firefox)
2) I have the Gecko Profiler/Foxfooding add-on running (since I was originally trying to capture and report on the performance problem which lead to all of this...)

Sorry, and thanks!

I'll check back in tomorrow, with a new build, and ensure I have cleaner, isolated steps.

Comment 4

[(Away)]

Wow this looks like a great test case to flush out all the profiler issues. I see delayload stuff (bug 1355559) in there too. For any that still remain, we'll probably need additional hooks/suppressions.

Comment 5

[(Away)]

Oh no, many of your crash reports have the sampler thread doing:

1 	ntdll.dll 	RtlAcquireSRWLockExclusive 	
2 	ntdll.dll 	LdrpFindLoadedDllByName 	
3 	ntdll.dll 	LdrpFindLoadedDllInternal 	
4 	ntdll.dll 	LdrpFindLoadedDll 	
5 	ntdll.dll 	LdrGetDllHandleEx 	
6 	ntdll.dll 	LdrGetDllHandle 	
7 	KERNELBASE.dll 	GetModuleHandleW 	
8 	mozglue.dll 	WalkStackMain64

which was introduced in bug 1180561. It didn't occur to me that GetModuleHandle would take a lock, violating the #1 rule of the profiler. I will back out that change while I rewrite that code in another way.

Between the backout, bug 1349444, and bug 1355559, you should soon be much less hang-y.

Comment 6

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/bbdbbcf5ceda
Backed out changeset 0e572861c2dc for contributing to bug 1361901.

Comment 7

[(Away)]

Backout now merged to central: https://hg.mozilla.org/mozilla-central/rev/bbdbbcf5cedad5769fd2b284403e754b7d43e642

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

Thanks, verified FIXED on trunk/nightly: Build identifier: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0