Crash in JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode

VERIFIED FIXED in Firefox 55

Status

()

Core
XPConnect
--
critical
VERIFIED FIXED
10 months ago
6 months ago

People

(Reporter: calixte, Assigned: kmag)

Tracking

(Blocks: 1 bug, {crash, regression, topcrash})

55 Branch
mozilla55
crash, regression, topcrash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox53 unaffected, firefox54 unaffected, firefox55blocking fixed)

Details

(Whiteboard: [clouseau], crash signature)

MozReview Requests

()

Submitter Diff Changes Open Issues Last Updated
Loading...
Error loading review requests:

Attachments

(1 attachment)

(Reporter)

Description

10 months ago
This bug was filed from the Socorro interface and is 
report bp-382399f2-e291-4157-b43a-a1abf0170515.
=============================================================

There are 8 crashes on nightly 55 with buildid 20170515030205. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1361900.

[1] https://hg.mozilla.org/mozilla-central/rev?node=906aee9cc744ab3fed98ede38756596263bc9319
Flags: needinfo?(kmaglione+bmo)
(Reporter)

Comment 1

10 months ago
There are 5 crashes for signature "JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::PrepareCacheWrite".
Crash Signature: [@ JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode] → [@ JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode] [@ JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::PrepareCacheWrite]
(Reporter)

Comment 2

10 months ago
The signature "JSAutoCompartment::JSAutoCompartment | mozilla::ScriptPreloader::CachedScript::XDREncode" has rank #7 in topcrash.
Keywords: topcrash
Assignee: nobody → kmaglione+bmo
Flags: needinfo?(kmaglione+bmo)
Hi. 
I've ran into this signature while testing for bug 1364878. 
I have some steps for reproducing this issue:

1. Install Nightly 55.0a1 (20170515030205) on macOS 10.12
2. Make sure you use a profile that does not let Nightly update itself.
3. Install "No Script" add-on from addons.mozilla.org and click the "restart" button from the doorhanger to restart the browser. (make sure the browser does not update itself)

[Expected Result]
The browser restarts and the add-on is installed and usable.

[Actual Result]
The browser restarts and after a few seconds it crashes completely.

Please note that the issue is also reproducible on Nightly 55.0a1 (id: 20170516030206).

UUID: b8fbd13e-f6f2-42e2-905a-39dd20170517
This has now moved into the top spot for browser crashes on 55 with 394 crashes and affects both Windows and Mac.
OS: Mac OS X → All
Hardware: Unspecified → All
I've finally managed to reproduce this locally on OS-X. I should be able to come up with a fix tomorrow.
Comment hidden (mozreview-request)
marking as blocker based on the crash volume in nightly.
tracking-firefox55: --- → blocking
status-firefox53: --- → unaffected
status-firefox54: --- → unaffected
status-firefox-esr52: --- → unaffected
Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144204

::: js/xpconnect/loader/ScriptPreloader.cpp:730
(Diff revision 1)
>              auto& data = script->Array();
>              script->mXDRRange.emplace(data.Elements(), data.Length());
>          }
>      }
>  
> +    if (!script->mSize && !script->mScript) {

Sorry I think I'm missing something, why are we noting a script at all after we flushed?
Attachment #8868884 - Flags: review?(erahm)
(Assignee)

Comment 9

9 months ago
mozreview-review-reply
Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144204

> Sorry I think I'm missing something, why are we noting a script at all after we flushed?

We flushed in the parent process, but that doesn't guarantee that we also flushed in the child process, or that the child process received its flush message before it sent this script to the parent.
Comment hidden (mozreview-request)
Comment on attachment 8868884 [details]
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush.

https://reviewboard.mozilla.org/r/140498/#review144408

Thanks for the comments and name changes Kris, it's much clearing now.
Attachment #8868884 - Flags: review?(erahm) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/1f2d2409ec8b374e4b9444a517cc73b2107a9789
Bug 1364934: Ignore cached scripts from content processes which were removed in a cache flush. r=erahm

Comment 13

9 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/1f2d2409ec8b
Status: NEW → RESOLVED
Last Resolved: 9 months ago
status-firefox55: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
Confirmed: this was a topcrash in Nightly 20170519030205, but has disappeared in Nightly 20170520030204. Thank you for the fix.
Status: RESOLVED → VERIFIED
Blocks: 1396527
You need to log in before you can comment on or make changes to this bug.