Open Bug 1449582 Opened 2 years ago Updated 8 months ago

Assertion failure: IsIdle(oldState), at /home/worker/workspace/build/src/xpcom/glue/PLDHashTable.h:132

Categories

(Core :: DOM: Core & HTML, defect, P3)

59 Branch
defect

Tracking

()

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file trigger.html
Testcase found while fuzzing esr52 rev d61516b059c1.

rax = 0x0000000000625d50   rdx = 0x00007f9f95e83403
rcx = 0x00007f9f90f5d2dd   rbx = 0x00007f9f72b373f0
rsi = 0x00007f9f9122c770   rdi = 0x00007f9f9122b540
rbp = 0x00007ffcc54fe7d0   rsp = 0x00007ffcc54fe7c0
r8 = 0x00007f9f9122c770    r9 = 0x00007f9f987e1c00
r10 = 0x0000000000000012   r11 = 0x0000000000000000
r12 = 0x00007f9f72b373f0   r13 = 0x00007ffcc54fe810
r14 = 0x0000000000000000   r15 = 0x00007f9f72b3b950
rip = 0x00007f9f92a5a0c4
OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|Checker::StartWriteOp|hg:hg.mozilla.org/releases/mozilla-esr52:xpcom/glue/PLDHashTable.h:d61516b059c1|132|0x0
0|1|libxul.so|PLDHashTable::Remove|hg:hg.mozilla.org/releases/mozilla-esr52:xpcom/glue/PLDHashTable.cpp:d61516b059c1|36|0x5
0|2|libxul.so|nsDOMAttributeMap::DropAttribute|hg:hg.mozilla.org/releases/mozilla-esr52:xpcom/glue/nsTHashtable.h:d61516b059c1|171|0xb
0|3|libxul.so|mozilla::dom::Element::UnsetAttr|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/Element.cpp:d61516b059c1|2716|0xe
0|4|libxul.so|nsGenericHTMLElement::UnsetAttr|hg:hg.mozilla.org/releases/mozilla-esr52:dom/html/nsGenericHTMLElement.cpp:d61516b059c1|876|0x12
0|5|libxul.so|mozilla::dom::HTMLSharedElement::UnsetAttr|hg:hg.mozilla.org/releases/mozilla-esr52:dom/html/HTMLSharedElement.cpp:d61516b059c1|263|0x5
0|6|libxul.so|nsDOMAttributeMap::BlastSubtreeToPieces|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsDocument.cpp:d61516b059c1|7187|0xf
0|7|libxul.so|nsDOMAttributeMap::BlastSubtreeToPieces|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsDocument.cpp:d61516b059c1|7197|0x5
0|8|libxul.so|nsIDocument::AdoptNode|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsDocument.cpp:d61516b059c1|7357|0x8
0|9|libxul.so|nsDocument::AdoptNode|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsDocument.cpp:d61516b059c1|7211|0x16
0|10|libxul.so|AdoptNodeIntoOwnerDoc|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsINode.cpp:d61516b059c1|1539|0x14
0|11|libxul.so|nsINode::ReplaceOrInsertBefore|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsINode.cpp:d61516b059c1|2427|0xf
0|12|libxul.so|mozilla::dom::NodeBinding::appendChild|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsINode.h:d61516b059c1|1850|0x12
0|13|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/releases/mozilla-esr52:dom/bindings/BindingUtils.cpp:d61516b059c1|2904|0x9
0|14|libxul.so|js::CallJSNative|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jscntxtinlines.h:d61516b059c1|239|0x9
0|15|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Interpreter.cpp:d61516b059c1|459|0xf
0|16|libxul.so|js::jit::DoCallFallback|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/BaselineIC.cpp:d61516b059c1|6020|0x13
0|17|||||0x32c1806a7111
0|18|||||0x7f9f72bc32f8
0|19|libxul.so|js::jit::IonCannon|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/Ion.cpp:d61516b059c1|2855|0x3a
0|20|libxul.so||||0x3550880
0|21|libnspr4.so|PR_SetThreadPrivate|hg:hg.mozilla.org/releases/mozilla-esr52:nsprpub/pr/src/threads/prtpd.c:d61516b059c1|187|0x13
0|22|libxul.so|NS_LogAddRef|hg:hg.mozilla.org/releases/mozilla-esr52:xpcom/base/nsTraceRefcnt.cpp:d61516b059c1|1016|0x5
0|23|libxul.so||||0x3b06f30
0|24|libxul.so|_fini|||0x1d1c7b0
0|25|libxul.so|mozilla::dom::ScriptSettingsStack::Push|hg:hg.mozilla.org/releases/mozilla-esr52:mfbt/ThreadLocal.h:d61516b059c1|198|0xc
0|26|libxul.so|mozilla::dom::AutoJSAPI::InitInternal|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/ScriptSettings.cpp:d61516b059c1|368|0x5
0|27|libxul.so|_fini|||0x1d1cb98
0|28|libxul.so|js::ThisThread::GetId|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/threading/posix/Thread.cpp:d61516b059c1|134|0x5
0|29|libxul.so|js::CurrentThreadCanAccessRuntime|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Runtime.cpp:d61516b059c1|896|0x1d
0|30|libxul.so|js::jit::OptimizationInfo::compilerWarmUpThreshold|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/Ion.h:d61516b059c1|199|0x8
0|31|libxul.so|js::jit::OptimizationLevelInfo::levelForScript|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/IonOptimizationLevels.cpp:d61516b059c1|168|0x5
0|32|libxul.so|js::jit::Compile|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/Ion.cpp:d61516b059c1|2465|0x10
0|33|libxul.so|JS::Value::toObject|hg:hg.mozilla.org/releases/mozilla-esr52:js/public/Value.h:d61516b059c1|657|0x5
0|34|libxul.so|js::jit::CanEnter|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/Ion.cpp:d61516b059c1|2602|0xb
0|35|libxul.so|js::RunScript|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Interpreter.cpp:d61516b059c1|385|0xb
0|36|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/releases/mozilla-esr52:nsprpub/pr/src/threads/prtpd.c:d61516b059c1|204|0x5
0|37|libxul.so|mozilla::dom::Event::QueryInterface|hg:hg.mozilla.org/releases/mozilla-esr52:dom/events/Event.cpp:d61516b059c1|139|0xf
0|38|libxul.so|mozilla::dom::MutationEvent::QueryInterface|hg:hg.mozilla.org/releases/mozilla-esr52:dom/events/MutationEvent.cpp:d61516b059c1|25|0x5
0|39|libxul.so|mozilla::Vector<JS::Value, 8ul, js::TempAllocPolicy>::~Vector|hg:hg.mozilla.org/releases/mozilla-esr52:mfbt/ReentrancyGuard.h:d61516b059c1|44|0x5
0|40|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Interpreter.cpp:d61516b059c1|477|0xb
0|41|libxul.so|_fini|||0x1d08ed8
0|42|libxul.so|js::Call|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Interpreter.cpp:d61516b059c1|523|0x5
0|43|libxul.so|JS::Call|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jsapi.cpp:d61516b059c1|2828|0x20
0|44|libxul.so|mozilla::net::RequestContext::RemoveBlockingTransaction|hg:hg.mozilla.org/releases/mozilla-esr52:netwerk/base/RequestContextService.cpp:d61516b059c1|74|0x3
0|45|libxul.so|mozilla::dom::EventListener::HandleEvent|hg:hg.mozilla.org/releases/mozilla-esr52:obj-firefox/dom/bindings/EventListenerBinding.cpp:d61516b059c1|48|0xc
0|46|libxul.so|mozilla::net::RequestContext::RemoveBlockingTransaction|hg:hg.mozilla.org/releases/mozilla-esr52:netwerk/base/RequestContextService.cpp:d61516b059c1|74|0x3
0|47|libxul.so|JS::Value::toObject|hg:hg.mozilla.org/releases/mozilla-esr52:js/public/Value.h:d61516b059c1|657|0x5
0|48|libxul.so|mozilla::dom::TryToOuterize|hg:hg.mozilla.org/releases/mozilla-esr52:dom/bindings/BindingUtils.h:d61516b059c1|943|0x8
0|49|libxul.so|mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>|hg:hg.mozilla.org/releases/mozilla-esr52:obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:d61516b059c1|64|0x1c
0|50|libxul.so|RefPtr<xpc::ErrorReport>::~RefPtr|hg:hg.mozilla.org/releases/mozilla-esr52:mfbt/RefPtr.h:d61516b059c1|80|0x2
Flags: in-testsuite?
That stack has a lot of weird stuff going on.
Component: XPCOM → DOM
Priority: -- → P3

Here is another stack: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=220616366&repo=try&lineNumber=1137

08:25:03 INFO - GECKO(809) | Assertion failure: IsIdle(oldState), at /builds/worker/workspace/build/src/xpcom/ds/PLDHashTable.h:137
08:26:38 INFO - GECKO(809) | #01: <name omitted> [xpcom/ds/PLDHashTable.cpp:572]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #02: mozilla::dom::TabGroup::AddDocument(nsTSubstring<char> const&, nsIDocument*) [dom/base/TabGroup.cpp:143]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #03: nsIDocument::SetScopeObject(nsIGlobalObject*) [mfbt/AlreadyAddRefed.h:145]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #04: nsIDocument::SetScriptGlobalObject(nsIScriptGlobalObject*) [dom/base/nsDocument.cpp:4423]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #05: nsGlobalWindowOuter::SetNewDocument(nsIDocument*, nsISupports*, bool) [dom/base/nsGlobalWindowOuter.cpp:1895]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #06: nsDocumentViewer::InitInternal(nsIWidget*, nsISupports*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, bool, bool) [layout/base/nsDocumentViewer.cpp:970]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #07: nsDocumentViewer::Init(nsIWidget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) [layout/base/nsDocumentViewer.cpp:716]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #08: nsDocShell::SetupNewViewer(nsIContentViewer*) [docshell/base/nsDocShell.cpp:8451]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #09: nsDocShell::Embed(nsIContentViewer*, char const*, nsISupports*) [docshell/base/nsDocShell.cpp:6346]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #10: nsDocShell::CreateAboutBlankContentViewer(nsIPrincipal*, nsIURI*, bool, bool) [docshell/base/nsDocShell.cpp:7197]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #11: nsDocShell::EnsureContentViewer() [xpcom/base/nsCOMPtr.h:839]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #12: nsDocShell::GetDocument(nsIDocument**) [docshell/base/nsDocShell.cpp:4745]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #13: nsDOMWindowList::EnsureFresh() [xpcom/base/nsCOMPtr.h:823]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #14: nsDOMWindowList::GetLength() [dom/base/nsDOMWindowList.cpp:46]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #15: mozilla::GetTabSizes(nsGlobalWindowOuter*, nsTabSizes*) [toolkit/components/perfmonitoring/PerformanceUtils.cpp:75]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #16: mozilla::GetTabSizes(nsGlobalWindowOuter*, nsTabSizes*) [toolkit/components/perfmonitoring/PerformanceUtils.cpp:0]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #17: mozilla::CollectMemoryInfo(nsCOMPtr<nsPIDOMWindowOuter> const&, RefPtr<mozilla::AbstractThread> const&) [toolkit/components/perfmonitoring/PerformanceUtils.cpp:91]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #18: mozilla::dom::DocGroup::ReportPerformanceInfo() [mfbt/RefPtr.h:296]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #19: mozilla::CollectPerformanceInfo() [xpcom/ds/nsTArray.h:344]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #20: mozilla::dom::ContentChild::RecvRequestPerformanceMetrics(nsID const&) [dom/ipc/ContentChild.cpp:0]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #21: mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) [ipc/glue/ProtocolUtils.h:375]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #22: mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) [ipc/glue/MessageChannel.h:650]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #23: mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) [ipc/glue/MessageChannel.cpp:2086]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #24: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) [ipc/glue/MessageChannel.cpp:0]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #25: mozilla::ipc::MessageChannel::MessageTask::Run() [xpcom/threads/Monitor.h:33]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #26: nsThread::ProcessNextEvent(bool, bool*) [xpcom/threads/nsThread.cpp:1144]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #27: NS_ProcessNextEvent(nsIThread*, bool) [xpcom/threads/nsThreadUtils.cpp:468]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #28: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [ipc/glue/MessagePump.cpp:86]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #29: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:583]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #30: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:139]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #31: nsAppShell::Run() [widget/cocoa/nsAppShell.mm:745]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #32: XRE_RunAppShell() [toolkit/xre/nsEmbedFunctions.cpp:915]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #33: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [ipc/glue/MessagePump.cpp:238]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #34: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:583]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #35: XRE_InitChildProcess(int, char**, XREChildData const*) [toolkit/xre/nsEmbedFunctions.cpp:757]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #36: main [ipc/contentproc/plugin-container.cpp:49]

Do we really want GetLength() to create an empty document (via EnsureFresh) ?

https://searchfox.org/mozilla-central/source/dom/base/nsDOMWindowList.cpp#44

The goal of GetLength() is to get the size of the list so if it's empty maybe we could avoid creating a document?
OTHO this logic has been there for ages so I am not sure what is the appropriate fix.

but we should avoid creating new documents just when we want to count the existing ones

adding Baku for advice

Flags: needinfo?(amarchesini)
See Also: → 1519038

The issue here is that we write into the hashtable while reading. The reading happens here:

https://searchfox.org/mozilla-central/rev/c43240cef5829b8a2dec118faff8a5e1fec6ae1b/toolkit/components/perfmonitoring/PerformanceUtils.cpp#47-49

https://searchfox.org/mozilla-central/rev/c43240cef5829b8a2dec118faff8a5e1fec6ae1b/dom/base/TabGroup.cpp#141

It's not trivial to know if we can remove the nsDOMWindowList::EnsureFresh() call in nsDOMWindowList::GetLength().
An easy fix is to change PerformanceUtils.cpp to create an array of nsTArray<RefPtr> docGroups (or raw pointers) and use them out of the iterator.

Flags: needinfo?(amarchesini)

Thanks a lot Andrea for the investigation ! I will work on a patch

Assignee: nobody → tarek

Will work on Bug 1519861 since this one is the same kind of failure but unrelated to the one triggered by about:performance

Assignee: tarek → nobody

Sorry, I meant bug 1519038

Component: DOM → DOM: Core & HTML

FWIW, looks like this bug contains many different cases when IsIdle(oldState) is triggered. Those can be totally unrelated.

You need to log in before you can comment on or make changes to this bug.