Closed
Bug 1364570
Opened 7 years ago
Closed 7 years ago
Assertion failure: !sRunningDispatcher || mAccessValid
Categories
(Core :: Networking, defect)
Core
Networking
Tracking
()
RESOLVED
FIXED
mozilla55
Tracking | Status | |
---|---|---|
firefox55 | --- | fixed |
People
(Reporter: aosmond, Assigned: billm)
Details
(Whiteboard: [necko-active])
Attachments
(2 files)
92.19 KB,
text/x-log
|
Details | |
4.11 KB,
patch
|
bzbarsky
:
review+
|
Details | Diff | Splinter Review |
Assertion failure: !sRunningDispatcher || mAccessValid, at /home/aosmond/dev/gecko-dev/obj-x86_64-pc-linux-gnu-notwr/dist/include/mozilla/SchedulerGroup.h:58 From gdb: #0 0x00007f1b3796075d in nanosleep () at ../sysdeps/unix/syscall-template.S:84 #1 0x00007f1b379606aa in __sleep (seconds=0) at ../sysdeps/posix/sleep.c:55 #2 0x00007f1b2b5b6a66 in ah_crap_handler (signum=signum@entry=11) at /home/aosmond/dev/gecko-dev/toolkit/xre/nsSigHandlers.cpp:103 #3 0x00007f1b2b5b6aa6 in child_ah_crap_handler (signum=11) at /home/aosmond/dev/gecko-dev/toolkit/xre/nsSigHandlers.cpp:115 #4 0x00007f1b2bdef008 in js::UnixExceptionHandler (signum=11, info=0x7ffdeedab330, context=0x7ffdeedab200) at /home/aosmond/dev/gecko-dev/js/src/ds/MemoryProtectionExceptionHandler.cpp:267 #5 0x00007f1b2c1ae0b9 in WasmFaultHandler<(Signal)0> (signum=11, info=0x7ffdeedab330, context=0x7ffdeedab200) at /home/aosmond/dev/gecko-dev/js/src/wasm/WasmSignalHandlers.cpp:1298 #6 <signal handler called> #7 mozilla::SchedulerGroup::ValidateAccess (this=<optimized out>) at /home/aosmond/dev/gecko-dev/obj-x86_64-pc-linux-gnu-notwr/dist/include/mozilla/SchedulerGroup.h:58 #8 mozilla::dom::DocGroup::ValidateAccess (this=<optimized out>) at /home/aosmond/dev/gecko-dev/obj-x86_64-pc-linux-gnu-notwr/dist/include/mozilla/dom/DocGroup.h:95 #9 nsDocument::GetEventTargetParent (this=<optimized out>, aVisitor=...) at /home/aosmond/dev/gecko-dev/dom/base/nsDocument.cpp:7994 #10 0x00007f1b29105ef5 in mozilla::EventTargetChainItem::GetEventTargetParent (this=this@entry=0x7f1b0c506080, aVisitor=...) at /home/aosmond/dev/gecko-dev/dom/events/EventDispatcher.cpp:389 #11 0x00007f1b291177a5 in mozilla::EventDispatcher::Dispatch (aTarget=aTarget@entry=0x7f1b027675c0, aPresContext=aPresContext@entry=0x0, aEvent=aEvent@entry= 0x7f1b07758c40, aDOMEvent=aDOMEvent@entry=0x7f1b07758be0, aEventStatus=aEventStatus@entry=0x7ffdeedab9dc, aCallback=aCallback@entry=0x0, aTargets=0x0) at /home/aosmond/dev/gecko-dev/dom/events/EventDispatcher.cpp:790 #12 0x00007f1b29117d07 in mozilla::EventDispatcher::DispatchDOMEvent (aTarget=aTarget@entry=0x7f1b027675c0, aEvent=aEvent@entry=0x0, aDOMEvent=aDOMEvent@entry=0x7f1b07758be0, aPresContext=aPresContext@entry=0x0, aEventStatus=aEventStatus@entry=0x7ffdeedab9dc) at /home/aosmond/dev/gecko-dev/dom/events/EventDispatcher.cpp:892 #13 0x00007f1b28434d2e in nsINode::DispatchEvent (this=0x7f1b027675c0, aEvent=0x7f1b07758be0, aRetVal=0x7ffdeedabaa0) at /home/aosmond/dev/gecko-dev/dom/base/nsINode.cpp:1337 #14 0x00007f1b281f7b53 in nsContentUtils::DispatchEvent (aDoc=<optimized out>, aTarget=<optimized out>, aEventName=..., aCanBubble=aCanBubble@entry=false, aCancelable=aCancelable@entry=false, aTrusted=aTrusted@entry=true, aDefaultAction=0x0, aOnlyChromeDispatch=false) at /home/aosmond/dev/gecko-dev/dom/base/nsContentUtils.cpp:4346 #15 0x00007f1b281f7bc0 in nsContentUtils::DispatchTrustedEvent (aDoc=<optimized out>, aTarget=<optimized out>, aEventName=..., aCanBubble=aCanBubble@entry=false, aCancelable=aCancelable@entry=false, aDefaultAction=aDefaultAction@entry=0x0) at /home/aosmond/dev/gecko-dev/dom/base/nsContentUtils.cpp:4315 #16 0x00007f1b27cc8f3c in nsPrefetchService::DispatchEvent (this=<optimized out>, node=node@entry=0x7f1afe9dd200, aSuccess=true) at /home/aosmond/dev/gecko-dev/uriloader/prefetch/nsPrefetchService.cpp:503 #17 0x00007f1b27cd6d3f in nsPrefetchNode::OnStopRequest (this=0x7f1afe9dd200, aRequest=<optimized out>, aContext=<optimized out>, aStatus=-2142568446) at /home/aosmond/dev/gecko-dev/uriloader/prefetch/nsPrefetchService.cpp:287 #18 0x00007f1b2722deef in mozilla::net::HttpChannelChild::DoOnStopRequest (this=this@entry=0x7f1af4067000, aRequest=aRequest@entry=0x7f1af4067080, aChannelStatus=nsresult::NS_OK, aContext=0x0) at /home/aosmond/dev/gecko-dev/netwerk/protocol/http/HttpChannelChild.cpp:1112 #19 0x00007f1b27245948 in mozilla::net::HttpChannelChild::OnStopRequest (this=0x7f1af4067000, channelStatus=@0x7f1aeac7b750: nsresult::NS_OK, timing=...) at /home/aosmond/dev/gecko-dev/netwerk/protocol/http/HttpChannelChild.cpp:1043 #20 0x00007f1b272696eb in mozilla::net::StopRequestEvent::Run (this=<optimized out>) at /home/aosmond/dev/gecko-dev/netwerk/protocol/http/HttpChannelChild.cpp:892 #21 0x00007f1b271f5808 in mozilla::net::ChannelEventQueue::RunOrEnqueue (this=0x7f1aea4ffb00, aCallback=0x7f1aeac7b740, aAssertionWhenNotQueued=false) at /home/aosmond/dev/gecko-dev/obj-x86_64-pc-linux-gnu-notwr/dist/include/mozilla/net/ChannelEventQueue.h:180 #22 0x00007f1b2723b535 in mozilla::net::HttpChannelChild::RecvOnStopRequest (this=0x7f1af4067000, channelStatus=<optimized out>, timing=...) at /home/aosmond/dev/gecko-dev/netwerk/protocol/http/HttpChannelChild.cpp:915 #23 0x00007f1b27562014 in mozilla::net::PHttpChannelChild::OnMessageReceived (this=0x7f1af4067000, msg__=...) at /home/aosmond/dev/gecko-dev/obj-x86_64-pc-linux-gnu-notwr/ipc/ipdl/PHttpChannelChild.cpp:726 #24 0x00007f1b27a1d42a in mozilla::dom::PContentChild::OnMessageReceived (this=0x7f1b37426020, msg__=...) at /home/aosmond/dev/gecko-dev/obj-x86_64-pc-linux-gnu-notwr/ipc/ipdl/PContentChild.cpp:5601 #25 0x00007f1b27421f57 in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=this@entry=0x7f1b37426140, aMsg=...) at /home/aosmond/dev/gecko-dev/ipc/glue/MessageChannel.cpp:2040 #26 0x00007f1b2742e3c2 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) (this=this@entry=0x7f1b37426140, aMsg=aMsg@entry=<unknown type in /home/aosmond/dev/gecko-dev/obj-x86_64-pc-linux-gnu-notwr/dist/bin/libxul.so, CU 0x31cd69c, DIE 0x32bd127>) at /home/aosmond/dev/gecko-dev/ipc/glue/MessageChannel.cpp:1975 #27 0x00007f1b274304f7 in mozilla::ipc::MessageChannel::RunMessage (this=0x7f1b37426140, aTask=...) at /home/aosmond/dev/gecko-dev/ipc/glue/MessageChannel.cpp:1844 #28 0x00007f1b27430761 in mozilla::ipc::MessageChannel::MessageTask::Run (this=0x7f1ae99fa020) at /home/aosmond/dev/gecko-dev/ipc/glue/MessageChannel.cpp:1877 #29 0x00007f1b26ddce66 in mozilla::SchedulerGroup::Runnable::Run (this=0x7f1aeb1c5500) at /home/aosmond/dev/gecko-dev/xpcom/threads/SchedulerGroup.cpp:370 #30 0x00007f1b26dff02f in nsThread::ProcessNextEvent (this=0x7f1b2447ee80, aMayWait=<optimized out>, aResult=0x7ffdeedac747) at /home/aosmond/dev/gecko-dev/xpcom/threads/nsThread.cpp:1270 #31 0x00007f1b26e033a0 in NS_ProcessNextEvent (aThread=aThread@entry=0x7f1b2447ee80, aMayWait=aMayWait@entry=false) at /home/aosmond/dev/gecko-dev/xpcom/threads/nsThreadUtils.cpp:393 #32 0x00007f1b27428b0a in mozilla::ipc::MessagePump::Run (this=this@entry=0x7f1b374d2290, aDelegate=aDelegate@entry=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/glue/MessagePump.cpp:96 #33 0x00007f1b27428d7a in mozilla::ipc::MessagePumpForChildProcess::Run (this=0x7f1b374d2290, aDelegate=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/glue/MessagePump.cpp:301 #34 0x00007f1b273a621d in MessageLoop::RunInternal (this=this@entry=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/chromium/src/base/message_loop.cc:238 #35 0x00007f1b273a6241 in MessageLoop::RunHandler (this=this@entry=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/chromium/src/base/message_loop.cc:231 #36 0x00007f1b273a644e in MessageLoop::Run (this=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/chromium/src/base/message_loop.cc:211 #37 0x00007f1b29d84873 in nsBaseAppShell::Run (this=0x7f1b1c4506d0) at /home/aosmond/dev/gecko-dev/widget/nsBaseAppShell.cpp:156 #38 0x00007f1b2b5b3ed4 in XRE_RunAppShell () at /home/aosmond/dev/gecko-dev/toolkit/xre/nsEmbedFunctions.cpp:893 #39 0x00007f1b27428c8d in mozilla::ipc::MessagePumpForChildProcess::Run (this=0x7f1b374d2290, aDelegate=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/glue/MessagePump.cpp:269 #40 0x00007f1b273a621d in MessageLoop::RunInternal (this=this@entry=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/chromium/src/base/message_loop.cc:238 #41 0x00007f1b273a6241 in MessageLoop::RunHandler (this=this@entry=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/chromium/src/base/message_loop.cc:231 #42 0x00007f1b273a644e in MessageLoop::Run (this=this@entry=0x7ffdeedacaa0) at /home/aosmond/dev/gecko-dev/ipc/chromium/src/base/message_loop.cc:211 #43 0x00007f1b2b5b4e04 in XRE_InitChildProcess (aArgc=13, aArgv=0x7ffdeedacde8, aChildData=<optimized out>) at /home/aosmond/dev/gecko-dev/toolkit/xre/nsEmbedFunctions.cpp:709 #44 0x00007f1b2b5c2ba5 in mozilla::BootstrapImpl::XRE_InitChildProcess (this=<optimized out>, argc=<optimized out>, argv=<optimized out>, aChildData=<optimized out>) at /home/aosmond/dev/gecko-dev/toolkit/xre/Bootstrap.cpp:65 #45 0x0000000000405e3f in content_process_main (bootstrap=0x7f1b374b70a8, argc=15, argc@entry=16, argv=argv@entry=0x7ffdeedacde8) at /home/aosmond/dev/gecko-dev/browser/app/../../ipc/contentproc/plugin-container.cpp:64 #46 0x000000000040619e in main (argc=16, argv=0x7ffdeedacde8, envp=0x7ffdeedace70) at /home/aosmond/dev/gecko-dev/browser/app/nsBrowserApp.cpp:285
Reporter | ||
Comment 1•7 years ago
|
||
This was reproduced off mozilla-central hg rev 96b36c5f527d, debug build. STR: 1) Set dom.ipc.processCount to 1. 2) Open 4 tabs and browse to cbc.ca, thestar.com, nationalpost.com and images.google.ca. 3) Cycled quickly between the tabs until a crash occurred. Have also observed it on closing tabs. Not a super high reproduce rate, but enough that I have done it a half dozen times today on different builds.
Reporter | ||
Comment 2•7 years ago
|
||
I uploaded a core file and symbols here: https://drive.google.com/drive/folders/0B7TkMiRcCQ1_RXFaaU1wVDM5VlU?usp=sharing
Comment 3•7 years ago
|
||
I had seen this assertion before when I tried to label runnables as SystemGroup in HttpChannelChild. But, we don't use SystemGroup in HttpChannelChild anymore, instead, we only label runnables if we can get a valid event target by |nsContentUtils::GetEventTargetByLoadInfo|. I think this bug should have something to to with labeling in HttpChannelChild. :billm, could you take a look at this assertion? Thanks.
Flags: needinfo?(wmccloskey)
Assignee | ||
Updated•7 years ago
|
Assignee: nobody → wmccloskey
Flags: needinfo?(wmccloskey)
Assignee | ||
Updated•7 years ago
|
Flags: needinfo?(wmccloskey)
Comment 5•7 years ago
|
||
another url to reproduce is Load -> https://online.citi.com/US/login.do?JFP_TOKEN=2017TCBC --Note that is of course not the original reported url but found out even with this fictive token the crash is reproducible
Updated•7 years ago
|
Whiteboard: [necko-active]
Assignee | ||
Comment 6•7 years ago
|
||
I wasn't able to reproduce this, but I think I know what's going on. The commit message and the patch have some explanation.
Flags: needinfo?(wmccloskey)
Attachment #8869629 -
Flags: review?(bzbarsky)
Comment 7•7 years ago
|
||
Comment on attachment 8869629 [details] [diff] [review] patch We should really recheck the IsInComposedDoc() right before the actual dispatch, because the contract for this stuff is that if you remove the node before getting onload/onerror you don't get the events. Past that, people are certainly supposed to be listening for these events; we added them at the explicit request of prefetch consumers like Amazon. But I agree that the extra trip through the event loop shouldn't be a big deal in practice. r=me if we recheck the IsInComposedDoc() bit when the AsyncEventDispatcher runnable runs, before firing the event. I wonder whether we can just add a "check that we're still in the doc" boolean arg to AsyncEventDispatcher..
Attachment #8869629 -
Flags: review?(bzbarsky) → review+
Pushed by wmccloskey@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/eeb73d8c0542 Dispatch link prefetch events asynchronously to avoid DocGroup mismatches (r=bz)
Comment 9•7 years ago
|
||
Backed out for static analysis failures. https://hg.mozilla.org/integration/mozilla-inbound/rev/a30d6b11b0a4271e065343b16a15e66ebdfcecf7 https://treeherder.mozilla.org/logviewer.html#?job_id=101315724&repo=mozilla-inbound
Comment 10•7 years ago
|
||
Pushed by wmccloskey@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/b67b7ae74a45 Dispatch link prefetch events asynchronously to avoid DocGroup mismatches (r=bz)
Comment 11•7 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/b67b7ae74a45
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox55:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
You need to log in
before you can comment on or make changes to this bug.
Description
•