1532190 - Exception thrown in ntdll.dll when closing the sole tab of firefox.

Status: RESOLVED FIXED

(Toolkit :: Application Update, defect, P3)

Description

[Joe Searle]

Attachment: Screenshot (32).png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.17763

Steps to reproduce:

Ina command window on Windows 10, I rin firefox thusly:
export MOZ_NO_REMOTE=1
export MOZ_FORCE_DISABLE_E10S=1
export XRE_NO_DLL_READAHEAD=1
./mach run --debug

Actual results:

After testing an html page on firefox, I close firefox by closing the only tab thereof, and I'm rather consistently experiencing an exception being thrown and Visual Studio 2017 suspending the execution of firefox.

Expected results:

Firefox should exit.

Comment 1

[Joe Searle]

Attachment: mozconfig

Comment 2

[Joe Searle]

Attachment: OUTPUT.txt

Comment 3

[Joe Searle]

Attachment: CALLSTACK.txt

Comment 4

[Jason Orendorff [:jorendorff]]

Joe, thank you for the bug report. Would you be interested in helping to team-debug this over a Google Hangout?

Ted, do you have a Windows build handy? Does this reproduce in Nightly?

Comment 5

[Ted Campbell [:tcampbell]]

This looks like a race in the Update Service when the browser forces a shutdown during slow shutdown. You are probably experiencing this to to running '--disable-optimize' which makes the browser quite slow.

The specific failure is that in [1] we call the 'CloseHandle' function in ntdll with a null handle, which generates the bad handle exception you see in the debugger. The crash is safe and seems to be a race during unoptimized builds which seems like a very low priority.

[1] https://searchfox.org/mozilla-central/rev/b59a99943de4dd314bae4e44ab43ce7687ccbbec/toolkit/mozapps/update/UpdateService.jsm#1943

Comment 7

[Ted Campbell [:tcampbell]]

Attachment: Bug 1532190 - Don't call CloseHandle on invalid handle during update service. r?rstrong

During forced shutdown, we may call 'closeHandle' without having a
proper mutex. This results in a crash in ntdll, so instead just do
nothing if the handle is missing.

Comment 9

[Joe Searle]

This is still happening. It seems I have the best chance of reproducing it when I let my version of nightly quiesce before going on to the next step to reproduce it. I tried setting a break point in js code but it seems the js debugger us wiped out before my break point had a chance to be hit. Currently my build is at:
changeset: 472619:5ca7ab463290
tag: tip
parent: 472530:d7235ef1becf
parent: 472618:eb5b01e0b309
user: JayJ <[e-mail]>
date: Fri May 03 15:58:33 2019 -0700
summary: Merge Updates

changeset: 472618:eb5b01e0b309
user: Ted Campbell <[e-mail]>
date: Fri May 03 18:17:39 2019 +0000
summary: Bug 1548903 - Remove unused JS TypeInference methods. r=iain

Comment 10

[Joe Searle]

(In reply to Jason Orendorff [:jorendorff] from comment #4)

Joe, thank you for the bug report. Would you be interested in helping to team-debug this over a Google Hangout?

Ted, do you have a Windows build handy? Does this reproduce in Nightly?

It still is happening. I can help whenever you want. I live in California so I'm currently on PDT.

Comment 11

[Jason Orendorff [:jorendorff]]

Joe, we think we have a fix, but it is still waiting for a code review. Rob?

Comment 12

[Jason Orendorff [:jorendorff]]

Correction. This is approved and just needs to land.

Comment 13

[Joe Searle]

(In reply to Jason Orendorff [:jorendorff] from comment #12)

Correction. This is approved and just needs to land.

OK. I'll look for it to get to mozilla-central.

Thanks, Joe

Comment 14

[Release mgmt bot [:sylvestre / :calixte / :marco for bugbug]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:tcampbell, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 15

[Ted Campbell [:tcampbell]]

Pushed to lando.

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ca8e3e6b3a82
Don't call CloseHandle on invalid handle during update service. r=rstrong

Comment 17

[Sebastian Hengst [:aryx] (needinfo on intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/ca8e3e6b3a82