Intermittent GECKO(6424) | SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/PLDHashTable.h:327:32 in Get
Categories
(Core :: Storage: localStorage & sessionStorage, defect, P2)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox-esr60 | --- | unaffected |
| firefox64 | --- | unaffected |
| firefox65 | --- | wontfix |
| firefox66 | --- | wontfix |
| firefox67 | --- | fixed |
| firefox68 | --- | fixed |
People
(Reporter: intermittent-bug-filer, Assigned: janv)
References
(Blocks 1 open bug)
Details
(Keywords: crash, intermittent-failure, Whiteboard: [stockwell unknown])
Comment 1•7 years ago
|
||
Updated•7 years ago
|
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
Updated•7 years ago
|
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
Updated•7 years ago
|
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
Comment 11•7 years ago
|
||
Moving these bugs (intermittent test failures with crashes) out of P5.
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
Comment 17•6 years ago
|
||
There are 42 total failures in the last 7 days on linux64 asan: https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?startday=2019-04-24&endday=2019-05-01&tree=trunk&bug=1513065
Recent failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=243920373&repo=autoland&lineNumber=1683
[task 2019-05-01T14:03:29.964Z] 14:03:29 INFO - TEST-START | browser/base/content/test/captivePortal/browser_CaptivePortalWatcher.js
[task 2019-05-01T14:03:55.398Z] 14:03:55 INFO - GECKO(1081) | AddressSanitizer:DEADLYSIGNAL
[task 2019-05-01T14:03:55.399Z] 14:03:55 INFO - GECKO(1081) | =================================================================
[task 2019-05-01T14:03:55.399Z] 14:03:55 ERROR - GECKO(1081) | ==1161==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000078 (pc 0x7fc7ac55c075 bp 0x7fff4e385690 sp 0x7fff4e385560 T0)
[task 2019-05-01T14:03:55.399Z] 14:03:55 INFO - GECKO(1081) | ==1161==The signal is caused by a READ memory access.
[task 2019-05-01T14:03:55.399Z] 14:03:55 INFO - GECKO(1081) | ==1161==Hint: address points to the zero page.
[task 2019-05-01T14:03:56.604Z] 14:03:56 INFO - GECKO(1081) | #0 0x7fc7ac55c074 in Get /builds/worker/workspace/build/src/obj-firefox/dist/include/PLDHashTable.h:327:32
[task 2019-05-01T14:03:56.604Z] 14:03:56 INFO - GECKO(1081) | #1 0x7fc7ac55c074 in PLDHashTable::Search(void const*) const /builds/worker/workspace/build/src/xpcom/ds/PLDHashTable.cpp:506
[task 2019-05-01T14:03:56.661Z] 14:03:56 INFO - GECKO(1081) | #2 0x7fc7b7bfe217 in GetEntry /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTHashtable.h:135:16
[task 2019-05-01T14:03:56.663Z] 14:03:56 INFO - GECKO(1081) | #3 0x7fc7b7bfe217 in EnsureRemoved /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTHashtable.h:202
[task 2019-05-01T14:03:56.664Z] 14:03:56 INFO - GECKO(1081) | #4 0x7fc7b7bfe217 in EvictCachedContext /builds/worker/workspace/build/src/docshell/base/BrowsingContextGroup.cpp:91
[task 2019-05-01T14:03:56.666Z] 14:03:56 INFO - GECKO(1081) | #5 0x7fc7b7bfe217 in mozilla::dom::BrowsingContext::Detach(bool) /builds/worker/workspace/build/src/docshell/base/BrowsingContext.cpp:282
[task 2019-05-01T14:03:56.667Z] 14:03:56 INFO - GECKO(1081) | #6 0x7fc7b7c2715d in nsDocShell::Destroy() /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:5033:21
[task 2019-05-01T14:03:56.673Z] 14:03:56 INFO - GECKO(1081) | #7 0x7fc7b823974d in nsWebBrowser::SetDocShell(nsIDocShell*) /builds/worker/workspace/build/src/toolkit/components/browser/nsWebBrowser.cpp:1238:23
[task 2019-05-01T14:03:56.677Z] 14:03:56 INFO - GECKO(1081) | #8 0x7fc7b8237bec in nsWebBrowser::InternalDestroy() /builds/worker/workspace/build/src/toolkit/components/browser/nsWebBrowser.cpp:192:3
[task 2019-05-01T14:03:56.678Z] 14:03:56 INFO - GECKO(1081) | #9 0x7fc7b824228c in Destroy /builds/worker/workspace/build/src/toolkit/components/browser/nsWebBrowser.cpp:909:3
[task 2019-05-01T14:03:56.678Z] 14:03:56 INFO - GECKO(1081) | #10 0x7fc7b824228c in non-virtual thunk to nsWebBrowser::Destroy() /builds/worker/workspace/build/src/toolkit/components/browser/nsWebBrowser.cpp
[task 2019-05-01T14:03:56.738Z] 14:03:56 INFO - GECKO(1081) | #11 0x7fc7b4253e94 in mozilla::dom::BrowserChild::DestroyWindow() /builds/worker/workspace/build/src/dom/ipc/BrowserChild.cpp:981:31
[task 2019-05-01T14:03:56.743Z] 14:03:56 INFO - GECKO(1081) | #12 0x7fc7b426b867 in mozilla::dom::BrowserChild::RecvDestroy() /builds/worker/workspace/build/src/dom/ipc/BrowserChild.cpp:2359:3
[task 2019-05-01T14:03:56.804Z] 14:03:56 INFO - GECKO(1081) | #13 0x7fc7adff2486 in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBrowserChild.cpp:5227:20
[task 2019-05-01T14:03:56.913Z] 14:03:56 INFO - GECKO(1081) | #14 0x7fc7ad8d3bb1 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PContentChild.cpp:6482:28
[task 2019-05-01T14:03:56.933Z] 14:03:56 INFO - GECKO(1081) | #15 0x7fc7ad71a3b9 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2151:21
[task 2019-05-01T14:03:56.934Z] 14:03:56 INFO - GECKO(1081) | #16 0x7fc7ad717454 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2078:9
[task 2019-05-01T14:03:56.935Z] 14:03:56 INFO - GECKO(1081) | #17 0x7fc7ad718e5b in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1937:3
[task 2019-05-01T14:03:56.936Z] 14:03:56 INFO - GECKO(1081) | #18 0x7fc7ad7193c7 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1968:13
[task 2019-05-01T14:03:56.952Z] 14:03:56 INFO - GECKO(1081) | #19 0x7fc7ac697ac1 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:295:32
[task 2019-05-01T14:03:56.968Z] 14:03:56 INFO - GECKO(1081) | #20 0x7fc7ac6c8b91 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1180:14
[task 2019-05-01T14:03:56.970Z] 14:03:56 INFO - GECKO(1081) | #21 0x7fc7ac6ceca8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
[task 2019-05-01T14:03:56.970Z] 14:03:56 INFO - GECKO(1081) | #22 0x7fc7ad72172f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:110:5
[task 2019-05-01T14:03:56.986Z] 14:03:56 INFO - GECKO(1081) | #23 0x7fc7ad64f1e2 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
[task 2019-05-01T14:03:56.987Z] 14:03:56 INFO - GECKO(1081) | #24 0x7fc7ad64f1e2 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
[task 2019-05-01T14:03:56.989Z] 14:03:56 INFO - GECKO(1081) | #25 0x7fc7ad64f1e2 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
[task 2019-05-01T14:03:56.995Z] 14:03:56 INFO - GECKO(1081) | #26 0x7fc7b4bac559 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
[task 2019-05-01T14:03:56.997Z] 14:03:56 INFO - GECKO(1081) | #27 0x7fc7b880fc1f in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:919:20
[task 2019-05-01T14:03:56.998Z] 14:03:56 INFO - GECKO(1081) | #28 0x7fc7ad64f1e2 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
[task 2019-05-01T14:03:56.999Z] 14:03:56 INFO - GECKO(1081) | #29 0x7fc7ad64f1e2 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
[task 2019-05-01T14:03:57.000Z] 14:03:57 INFO - GECKO(1081) | #30 0x7fc7ad64f1e2 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
[task 2019-05-01T14:03:57.001Z] 14:03:57 INFO - GECKO(1081) | #31 0x7fc7b880f5c6 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:757:34
[task 2019-05-01T14:03:57.018Z] 14:03:57 INFO - GECKO(1081) | #32 0x55754e77a3a7 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
[task 2019-05-01T14:03:57.018Z] 14:03:57 INFO - GECKO(1081) | #33 0x55754e77a3a7 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:263
[task 2019-05-01T14:03:57.096Z] 14:03:57 INFO - GECKO(1081) | #34 0x7fc7ccdfb82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
[task 2019-05-01T14:03:57.097Z] 14:03:57 INFO - GECKO(1081) | #35 0x55754e69baf8 in _start (/builds/worker/workspace/build/application/firefox/firefox+0x2aaf8)
[task 2019-05-01T14:03:57.097Z] 14:03:57 INFO - GECKO(1081) | AddressSanitizer can not provide additional info.
[task 2019-05-01T14:03:57.097Z] 14:03:57 INFO - GECKO(1081) | SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/PLDHashTable.h:327:32 in Get
[task 2019-05-01T14:03:57.098Z] 14:03:57 INFO - GECKO(1081) | ==1161==ABORTING
[task 2019-05-01T14:03:57.563Z] 14:03:57 INFO - GECKO(1081) | ###!!! [Parent][MessageChannel] Error: (msgtype=0x1E008C,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv
[task 2019-05-01T14:03:58.526Z] 14:03:58 INFO - GECKO(1081) | MEMORY STAT vsizeMaxContiguous not supported in this build configuration.
[task 2019-05-01T14:03:58.527Z] 14:03:58 INFO - GECKO(1081) | MEMORY STAT heapAllocated not supported in this build configuration.
[task 2019-05-01T14:03:58.529Z] 14:03:58 INFO - GECKO(1081) | MEMORY STAT | vsize 20975105MB | residentFast 1187MB
| Comment hidden (Intermittent Failures Robot) |
Comment 20•6 years ago
|
||
Hi Andreas,
When looking at comment 17, I see "BrowsingContextGroup.cpp" in the stacktrace and there are changes made to the code recently. Could that be the issue causing failure increase recently? Thank you.
Comment 21•6 years ago
|
||
Looking at https://treeherder.mozilla.org/#/jobs?repo=try&revision=b6b7392710c3e88de7833f098c0886fda54be497&group_state=expanded it looks like the patch that I intend to fix bug 1547871 with also fixes this issue.
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
| Comment hidden (Intermittent Failures Robot) |
Comment 25•6 years ago
|
||
After the fix for Bug 1547871 landed no reports seem to be because BrowsingContext related issues. All failures in Comment 24 comes through mozilla::dom::LSDatabase::Observer::Observe. Andrew, that's Web Storage, right?
Comment 26•6 years ago
•
|
||
Yes, LS is LocalStorage which falls under the Web Storage bucket, thanks for moving this.
Jan, it looks like gLSDatabases is null at https://searchfox.org/mozilla-central/rev/cc280c4be94ff8cf64a27cc9b3d6831ffa49fa45/dom/localstorage/LSDatabase.cpp#373 in the crashes like https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=246034918&repo=autoland&lineNumber=5043
This looks like it is probably an instance of a sequence where:
- nsObserverList::NotifyObservers snapshots the observer list for the given subject at https://searchfox.org/mozilla-central/rev/cc280c4be94ff8cf64a27cc9b3d6831ffa49fa45/xpcom/ds/nsObserverList.cpp#60
- The observer notification fires for an indirectly related observer U, and during its actions, the LSDatabase D which is the last remaining database and has observer O is destroyed. Observer O is removed, but is still present in the observer list being processed.
- The observer firing reaches observer O. gLSDatabases is null at this point.
The code was assuming that atomically removing the observer would prevent situations like this, but we ran into nuance that the observer list is snapshotted. Options seem to be:
- Make the LSDatabase::Observer responsible for adding and removing itself from the observer service. When it removes itself, it sets an internal flag like mRemoved that we use to bail out of the ::Observe notification early.
- Just check gLSDatabases before using it. Add some comments.
| Assignee | ||
Comment 27•6 years ago
|
||
The issue described in comment 26 is being fixed in bug 1548847.
| Assignee | ||
Comment 28•6 years ago
|
||
Yeah, bug 1548847 has been fixed and the orange factor (graph) here also looks good.
| Comment hidden (Intermittent Failures Robot) |
Updated•6 years ago
|
Updated•6 years ago
|
Description
•