Closed Bug 1364934 Opened 3 years ago Closed 3 years ago

Crash in JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode

Categories

(Core :: XPConnect, defect, critical)

55 Branch
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla55
Tracking Status
firefox-esr52 --- unaffected
firefox53 --- unaffected
firefox54 --- unaffected
firefox55 blocking fixed

People

(Reporter: calixte, Assigned: kmag)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, topcrash, Whiteboard: [clouseau])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-382399f2-e291-4157-b43a-a1abf0170515.
=============================================================

There are 8 crashes on nightly 55 with buildid 20170515030205. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1361900.

[1] https://hg.mozilla.org/mozilla-central/rev?node=906aee9cc744ab3fed98ede38756596263bc9319
Flags: needinfo?(kmaglione+bmo)
There are 5 crashes for signature "JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::PrepareCacheWrite".
Crash Signature: [@ JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode] → [@ JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode] [@ JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::PrepareCacheWrite]
The signature "JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode" has rank #7 in topcrash.
Keywords: topcrash
Assignee: nobody → kmaglione+bmo
Flags: needinfo?(kmaglione+bmo)
Hi. 
I've ran into this signature while testing for bug 1364878. 
I have some steps for reproducing this issue:

1. Install Nightly 55.0a1 (20170515030205) on macOS 10.12
2. Make sure you use a profile that does not let Nightly update itself.
3. Install "No Script" add-on from addons.mozilla.org and click the "restart" button from the doorhanger to restart the browser. (make sure the browser does not update itself)

[Expected Result]
The browser restarts and the add-on is installed and usable.

[Actual Result]
The browser restarts and after a few seconds it crashes completely.

Please note that the issue is also reproducible on Nightly 55.0a1 (id: 20170516030206).

UUID: b8fbd13e-f6f2-42e2-905a-39dd20170517
This has now moved into the top spot for browser crashes on 55 with 394 crashes and affects both Windows and Mac.
OS: Mac OS X → All
Hardware: Unspecified → All
I've finally managed to reproduce this locally on OS-X. I should be able to come up with a fix tomorrow.
marking as blocker based on the crash volume in nightly.
Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144204

::: js/xpconnect/loader/ScriptPreloader.cpp:730
(Diff revision 1)
>              auto& data = script->Array();
>              script->mXDRRange.emplace(data.Elements(), data.Length());
>          }
>      }
>  
> +    if (!script->mSize && !script->mScript) {

Sorry I think I'm missing something, why are we noting a script at all after we flushed?
Attachment #8868884 - Flags: review?(erahm)
Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144204

> Sorry I think I'm missing something, why are we noting a script at all after we flushed?

We flushed in the parent process, but that doesn't guarantee that we also flushed in the child process, or that the child process received its flush message before it sent this script to the parent.
Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144408

Thanks for the comments and name changes Kris, it's much clearing now.
Attachment #8868884 - Flags: review?(erahm) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/1f2d2409ec8b374e4b9444a517cc73b2107a9789
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush. r=erahm
https://hg.mozilla.org/mozilla-central/rev/1f2d2409ec8b
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
Confirmed: this was a topcrash in Nightly 20170519030205, but has disappeared in Nightly 20170520030204. Thank you for the fix.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.