1364934 - Crash in JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is 
report bp-382399f2-e291-4157-b43a-a1abf0170515.
=============================================================

There are 8 crashes on nightly 55 with buildid 20170515030205. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1361900.

[1] https://hg.mozilla.org/mozilla-central/rev?node=906aee9cc744ab3fed98ede38756596263bc9319

Comment 1

[Calixte Denizet (:calixte)]

There are 5 crashes for signature "JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::PrepareCacheWrite".

Comment 2

[Calixte Denizet (:calixte)]

The signature "JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode" has rank #7 in topcrash.

Comment 3

[Alexandru Simonca [:asimonca], Release Desktop QA]

Hi. 
I've ran into this signature while testing for bug 1364878. 
I have some steps for reproducing this issue:

1. Install Nightly 55.0a1 (20170515030205) on macOS 10.12
2. Make sure you use a profile that does not let Nightly update itself.
3. Install "No Script" add-on from addons.mozilla.org and click the "restart" button from the doorhanger to restart the browser. (make sure the browser does not update itself)

[Expected Result]
The browser restarts and the add-on is installed and usable.

[Actual Result]
The browser restarts and after a few seconds it crashes completely.

Please note that the issue is also reproducible on Nightly 55.0a1 (id: 20170516030206).

UUID: b8fbd13e-f6f2-42e2-905a-39dd20170517

Comment 4

[Marcia Knous [:marcia]]

This has now moved into the top spot for browser crashes on 55 with 394 crashes and affects both Windows and Mac.

Comment 5

[Kris Maglione [:kmag]]

I've finally managed to reproduce this locally on OS-X. I should be able to come up with a fix tomorrow.

Comment 6

[Kris Maglione [:kmag]]

Attachment: Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

Review commit: https://reviewboard.mozilla.org/r/140498/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/140498/

Comment 7

[Julien Cristau [:jcristau]]

marking as blocker based on the crash volume in nightly.

Comment 8

[Eric Rahm [:erahm]]

Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144204

::: js/xpconnect/loader/ScriptPreloader.cpp:730
(Diff revision 1)
>              auto& data = script->Array();
>              script->mXDRRange.emplace(data.Elements(), data.Length());
>          }
>      }
>  
> +    if (!script->mSize && !script->mScript) {

Sorry I think I'm missing something, why are we noting a script at all after we flushed?

Comment 9

[Kris Maglione [:kmag]]

Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144204

> Sorry I think I'm missing something, why are we noting a script at all after we flushed?

We flushed in the parent process, but that doesn't guarantee that we also flushed in the child process, or that the child process received its flush message before it sent this script to the parent.

Comment 10

[Kris Maglione [:kmag]]

Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/140498/diff/1-2/

Comment 11

[Eric Rahm [:erahm]]

Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144408

Thanks for the comments and name changes Kris, it's much clearing now.

Comment 12

[Kris Maglione [:kmag]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1f2d2409ec8b374e4b9444a517cc73b2107a9789
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush. r=erahm

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/1f2d2409ec8b

Comment 14

[Nicholas Nethercote [inactive]]

Confirmed: this was a topcrash in Nightly 20170519030205, but has disappeared in Nightly 20170520030204. Thank you for the fix.