1476130 - IPDL protocol error: could not lookup id for PTexture crash in mozilla::ipc::MessageChannel::OnChannelErrorFromLink()

Status: RESOLVED WORKSFORME

(Core :: IPC, defect)

Description

[truckman]

User Agent: Mozilla/5.0 (X11; FreeBSD amd64; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36

Steps to reproduce:

Crashes started after upgrading to Firefox 61.0.1 on FreeBSD 11.2 amd64.  The crashes are somewhat random.  Firefox may crash during a session restore, or Firefox may run for a few hours after a restart, but typically it will crash in less than an hour.  Some sites, such as accuweather.com, are more likely to trigger a crash.

Installed plugins are:
  OpenH264 Video Codec provided by Cisco Systems, Inc. 1.8.0
  Shockwave Flash 30.0 r0

Installed Extensions are:
  Google Analytics Opt-out 0.1.1
  NoScript 10.1.8.2
  uBlock Origin 1.16.12

Performing a Firefox refresh, then reinstalling the extensions and restoring my open tabs did not help.



Actual results:

[snip]
JavaScript error: moz-extension://a53dd9a3-0608-42ba-a82b-94673a67b257/bg/RequestGuard.js, line 280: Error: Could not establish connection. Receiving end does not exist.
JavaScript error: jar:file:///usr/local/lib/firefox/browser/omni.ja!/components/nsBrowserGlue.js, line 2874: NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIContentPermissionRequest.cancel]
JavaScript error: moz-extension://a53dd9a3-0608-42ba-a82b-94673a67b257/bg/RequestGuard.js, line 280: Error: Could not establish connection. Receiving end does not exist.
JavaScript error: moz-extension://a53dd9a3-0608-42ba-a82b-94673a67b257/bg/RequestGuard.js, line 280: Error: Could not establish connection. Receiving end does not exist.
JavaScript error: jar:file:///usr/local/lib/firefox/browser/omni.ja!/components/nsBrowserGlue.js, line 2874: NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIContentPermissionRequest.cancel]
JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489: TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an object.
IPDL protocol error: could not lookup id for PTexture
IPDL protocol error: Error deserializing 'textureParent' (PTexture) member of 'TimedTexture'
Segmentation fault (core dumped)

The IPDL errors are common to all of the crashes.

Core was generated by `/usr/local/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 1'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  mozilla::ipc::MessageChannel::OnChannelErrorFromLink (this=0x8026db0c0)
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/glue/MessageChannel.cpp:2561
2561	/wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/glue/MessageChannel.cpp: No such file or directory.
[Current thread is 1 (LWP 101624)]
(gdb) bt
#0  mozilla::ipc::MessageChannel::OnChannelErrorFromLink (this=0x8026db0c0)
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/glue/MessageChannel.cpp:2561
#1  0x000000080f7f3a90 in non-virtual thunk to mozilla::ipc::ProcessLink::OnChannelError() ()
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/glue/MessageLink.cpp:393
#2  0x0000000816d4703a in ?? () from /usr/local/lib/libevent-2.1.so.6
#3  0x0000000816d42faf in event_base_loop ()
   from /usr/local/lib/libevent-2.1.so.6
#4  0x000000080f7bb0e8 in base::MessagePumpLibevent::Run (this=0x81b61c000, 
    delegate=0x7fffdfffde50)
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/chromium/src/base/message_pump_libevent.cc:380
#5  0x000000080f7b9a4c in MessageLoop::RunInternal (this=<optimized out>)
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/chromium/src/base/message_loop.cc:326
#6  MessageLoop::RunHandler (this=<optimized out>)
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/chromium/src/base/message_loop.cc:319
#7  MessageLoop::Run (this=0x81312801d)
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/chromium/src/base/message_loop.cc:299
---Type <return> to continue, or q <return> to quit---
#8  0x000000080f7cff24 in base::Thread::ThreadMain (this=0x802696c88)
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/chromium/src/base/thread.cc:181
#9  0x000000080f7bfbaa in ThreadFunc (closure=0x814561ce8 <sLogModule>)
    at /wrkdirs/usr/ports/www/firefox/work/firefox-61.0.1/ipc/chromium/src/base/platform_thread_posix.cc:38
#10 0x0000000801da3c06 in thread_start (curthread=0x802619400)
    at /usr/src/lib/libthr/thread/thr_create.c:289
#11 0x0000000000000000 in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffdfffe000

Code at crash location:

    if (ChannelClosing != mChannelState) {
        if (mAbortOnError) {
            MOZ_CRASH("Aborting on channel error.");
        }

(gdb) print ChannelClosing
$1 = mozilla::ipc::ChannelClosing
(gdb) print mChannelState
$2 = mozilla::ipc::ChannelConnected
(gdb) print MAbortOnError
No symbol "MAbortOnError" in current context.
(gdb) print mAbortOnError
$3 = true



Expected results:

Firefox should not have crashed.

Comment 1

[truckman]

The last couple of crashes have had a GraphicsCriticalError before the IPDL errors:

JavaScript error: chrome://browser/content/parent/ext-browser.js, line 0: Error: Invalid tab ID: -1
JavaScript error: chrome://browser/content/parent/ext-browser.js, line 0: Error: Invalid tab ID: -1
Crash Annotation GraphicsCriticalError: |[0][GFX1-]: Failed to create a valid ShmemTextureHost (t=4220.71) [GFX1-]: Failed to create a valid ShmemTextureHost
IPDL protocol error: could not lookup id for PTexture
IPDL protocol error: Error deserializing 'textureParent' (PTexture) member of 'TimedTexture'
Segmentation fault (core dumped)

Comment 2

[u554753]

Setting component as IPC. Please correct if this isn't the case. 

Hi truckman,

Can you visit about:crashes and see if you can support us with a few report IDs related to these crashes?

Comment 3

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

I don't think our crash reporter supports FreeBSD.  But here's another question: How large is /tmp, and is it filling up before this happens?  If so, see bug 1447867; “shared memory” is currently backed by unlinked files in /tmp (or /dev/shm on Linux).


But also, I'd like to know why the graphics stack is apparently sending an invalid (destroyed? from the wrong toplevel?) PTexture, even in an error case.

Comment 4

[truckman]

Yes, about:crashes brings up a page that says "Hmm. That address doesn’t look right."

Lots of free space in /tmp:

Filesystem 1K-blocks    Used     Avail Capacity  Mounted on
mousie/tmp 861629370 2966973 858662397     0%    /tmp

Someone on the FreeBSD email lists just mentioned this old bug:
  https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=181741
and said that it is an issue for Firefox 63.

Unfortunately I get a kernel build failure with the last patch
in that PR.  I'll try to work around that and see if it makes
Firefox happy.

Comment 5

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

That's bug 1475970, and… I don't know if that would explain this, because it seems to cut off the beginning of the message and give the receiving side completely wrong data in place of the header, rather than corrupting data in the middle of the message.

(And even if there were bad data in the middle of the message, that could explain the PTexture error but maybe not the “Failed to create a valid ShmemTextureHost”.)

Comment 6

[truckman]

I only saw the “Failed to create a valid ShmemTextureHost” error a few times.  I always see the IPDL error immediately before the crash.

Currently running the patched kernel ...

Comment 7

[truckman]

The patch in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=181741 appears to have fixed the problem for me.  Firefox has been running the last 15 hours.  Before applying this patch Firefox never managed to run overnight.  If it was running at the end of my day, it was always dead in the morning.

Comment 8

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

I've been seeing this lately with up-to-date FreeBSD 11 and Firefox 63.  It's not frequent, but at least the last two were when I was switching tabs, and this is on a laptop (an old Thinkpad I've been experimenting with) so there's suspend/resume thrown in, for whatever that's worth.

Comment 9

[Jan Beich]

(In reply to Jed Davis [:jld] from comment #8)
> FreeBSD 11 and Firefox 63. 

According to FreeBSD bug the fix didn't make it into FreeBSD 11.2-RELEASE but should be in 11.3. Until 11.2 reaches EOL I'm recommending (downstream) users to set "sysctl net.local.stream.recvspace=16384" as a workaround.

FreeBSD 12.0-RELEASE also contains the fix and is already available on mirrors (to be announced in few days).