Closed Bug 1535495 Opened 6 years ago Closed 6 years ago

Intermittent dom/cache/test/mochitest/test_cache_match_request.html | application crashed [@ TimerThread::Run()]

Categories

(Core :: DOM: Core & HTML, defect, P3)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1334383

People

(Reporter: intermittent-bug-filer, Unassigned)

References

(Depends on 1 open bug)

Details

(Keywords: crash, intermittent-failure, regression)

Crash Data

#[markdown(off)]
Filed by: aciure [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=233998410&repo=mozilla-inbound

https://queue.taskcluster.net/v1/task/ItFbjTthRi-p-8g35dmC3Q/runs/1/artifacts/public/logs/live_backing.log

[task 2019-03-14T22:33:48.780Z] 22:33:48 INFO - 25 INFO TEST-START | dom/cache/test/mochitest/test_cache_match_request.html
[task 2019-03-14T22:34:30.768Z] 22:34:30 INFO - wait for org.mozilla.fennec_aurora complete; top activity=com.android.launcher
[task 2019-03-14T22:34:30.972Z] 22:34:30 INFO - remoteautomation.py | Application ran for: 0:07:35.199423
[task 2019-03-14T22:34:31.691Z] 22:34:31 INFO - mozcrash Copy/paste: /builds/worker/workspace/build/linux64-minidump_stackwalk /tmp/tmp1KhIl9/0ee963c0-46e9-4ff8-4306-a255d9f7250f.dmp /builds/worker/workspace/build/symbols
[task 2019-03-14T22:34:41.586Z] 22:34:41 INFO - mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/0ee963c0-46e9-4ff8-4306-a255d9f7250f.dmp
[task 2019-03-14T22:34:41.586Z] 22:34:41 INFO - mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/0ee963c0-46e9-4ff8-4306-a255d9f7250f.extra
[task 2019-03-14T22:34:41.590Z] 22:34:41 WARNING - PROCESS-CRASH | dom/cache/test/mochitest/test_cache_match_request.html | application crashed [@ TimerThread::Run()]
[task 2019-03-14T22:34:41.590Z] 22:34:41 INFO - Crash dump filename: /tmp/tmp1KhIl9/0ee963c0-46e9-4ff8-4306-a255d9f7250f.dmp
[task 2019-03-14T22:34:41.590Z] 22:34:41 INFO - Operating system: Android
[task 2019-03-14T22:34:41.590Z] 22:34:41 INFO - 0.0.0 Linux 2.6.29-gea477bb #1 Wed Sep 26 11:04:45 PDT 2012 armv7l
[task 2019-03-14T22:34:41.590Z] 22:34:41 INFO - CPU: arm
[task 2019-03-14T22:34:41.590Z] 22:34:41 INFO - ARMv7 ARM Cortex-A8 features: swp,half,thumb,fastmult,vfpv2,edsp,neon,vfpv3
[task 2019-03-14T22:34:41.591Z] 22:34:41 INFO - 1 CPU
[task 2019-03-14T22:34:41.591Z] 22:34:41 INFO - GPU: UNKNOWN
[task 2019-03-14T22:34:41.591Z] 22:34:41 INFO - Crash reason: SIGSEGV /SEGV_MAPERR
[task 2019-03-14T22:34:41.591Z] 22:34:41 INFO - Crash address: 0x0
[task 2019-03-14T22:34:41.591Z] 22:34:41 INFO - Process uptime: not available
[task 2019-03-14T22:34:41.591Z] 22:34:41 INFO - Thread 19 (crashed)
[task 2019-03-14T22:34:41.592Z] 22:34:41 INFO - 0 libxul.so!TimerThread::Run() [Assertions.h:d57a9605a6d156801d07b6572e362a90b2b13bb5 : 38 + 0x4]
[task 2019-03-14T22:34:41.592Z] 22:34:41 INFO - r0 = 0x00000000 r1 = 0x574d070a r2 = 0x574d036b r3 = 0x000001bc
[task 2019-03-14T22:34:41.592Z] 22:34:41 INFO - r4 = 0x000001bc r5 = 0x660ff8c8 r6 = 0x00000000 r7 = 0x660ff920
[task 2019-03-14T22:34:41.592Z] 22:34:41 INFO - r8 = 0x660ff8d0 r9 = 0x52c082e0 r10 = 0x52c08310 r12 = 0x00000003
[task 2019-03-14T22:34:41.592Z] 22:34:41 INFO - fp = 0x00000000 sp = 0x660ff8a0 lr = 0x53639d6d pc = 0x5363cf52
[task 2019-03-14T22:34:41.592Z] 22:34:41 INFO - Found by: given as instruction pointer in context
[task 2019-03-14T22:34:41.593Z] 22:34:41 INFO - 1 libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:d57a9605a6d156801d07b6572e362a90b2b13bb5 : 1179 + 0x5]
[task 2019-03-14T22:34:41.593Z] 22:34:41 INFO - r4 = 0x52cf8db0 r5 = 0x00000000 r6 = 0x00000001 r7 = 0x660ffde8
[task 2019-03-14T22:34:41.593Z] 22:34:41 INFO - r8 = 0xffffffff r9 = 0x660ff9d0 r10 = 0x660ffdf3 fp = 0x52cf8d30
[task 2019-03-14T22:34:41.593Z] 22:34:41 INFO - sp = 0x660ff928 lr = 0x5364101f pc = 0x5364101f
[task 2019-03-14T22:34:41.593Z] 22:34:41 INFO - Found by: call frame info
[task 2019-03-14T22:34:41.594Z] 22:34:41 INFO - 2 libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:d57a9605a6d156801d07b6572e362a90b2b13bb5 : 482 + 0xd]
[task 2019-03-14T22:34:41.594Z] 22:34:41 INFO - r4 = 0x00000000 r5 = 0x52cf8d30 r6 = 0x400721f4 r7 = 0x660ffe08
[task 2019-03-14T22:34:41.594Z] 22:34:41 INFO - r8 = 0x52cc214c r9 = 0x52cf8d30 r10 = 0x52cc2140 fp = 0x400721f4
[task 2019-03-14T22:34:41.594Z] 22:34:41 INFO - sp = 0x660ffdf0 lr = 0x53642de9 pc = 0x53642de9
[task 2019-03-14T22:34:41.594Z] 22:34:41 INFO - Found by: call frame info
[task 2019-03-14T22:34:41.595Z] 22:34:41 INFO - 3 libxul.so!mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) [MessagePump.cpp:d57a9605a6d156801d07b6572e362a90b2b13bb5 : 303 + 0x7]
[task 2019-03-14T22:34:41.595Z] 22:34:41 INFO - r4 = 0x52cc2130 r5 = 0x52cc11c0 r6 = 0x660ffe14 r7 = 0x660ffe38
[task 2019-03-14T22:34:41.595Z] 22:34:41 INFO - r8 = 0x52cc214c r9 = 0x52cf8d30 r10 = 0x52cc2140 fp = 0x400721f4
[task 2019-03-14T22:34:41.595Z] 22:34:41 INFO - sp = 0x660ffe10 lr = 0x53a06637 pc = 0x53a06637
[task 2019-03-14T22:34:41.595Z] 22:34:41 INFO - Found by: call frame info
[task 2019-03-14T22:34:41.596Z] 22:34:41 INFO - 4 libxul.so!MessageLoop::RunInternal() [message_loop.cc:d57a9605a6d156801d07b6572e362a90b2b13bb5 : 315 + 0x7]
[task 2019-03-14T22:34:41.596Z] 22:34:41 INFO - r4 = 0x52cc11c0 r5 = 0x400721f4 r6 = 0x660ffe9c r7 = 0x660ffe60
[task 2019-03-14T22:34:41.596Z] 22:34:41 INFO - r8 = 0x58f1a868 r9 = 0x00000000 r10 = 0x400721f4 fp = 0x660ffe94
[task 2019-03-14T22:34:41.596Z] 22:34:41 INFO - sp = 0x660ffe40 lr = 0x539b7ae9 pc = 0x539b7ae9
[task 2019-03-14T22:34:41.596Z] 22:34:41 INFO - Found by: call frame info

Hi Andrei, the DOM components have been updated but the in-tree metadata sometimes associates test files with components that no longer exist (e.g. the "DOM" component). Bug 1535353 tracks updating the metadata but for now could you please use "DOM: Core & HTML" for general "DOM" bugs.

Details about the change: https://lists.mozilla.org/pipermail/dev-platform/2019-March/023688.html

Component: DOM: Animation → DOM: Core & HTML
Flags: needinfo?(aciure)

Ok thanks for the info Brian. I will use that in the future.

Flags: needinfo?(aciure)

Moving these bugs (intermittent test failures with crashes) out of P5.

Priority: P5 → --

Hi Andrew,
In the past month, there were several cache intermittent failures. Though the crash volume is low, I think it's worth ensuring these issues are on your or other cache folks' radar since they started to appear recently.

Flags: needinfo?(bugmail)
Priority: -- → P3
See Also: → 1516152, 1531624
See Also: → 1535930

This appears to be a bug in the TimerThread.cpp implementation that is perhaps best covered by bug 657962 which has a variant of this signature that's currently receiving crashes. Preliminary investigation suggests that this shouldn't be happening. Specifically:

https://hg.mozilla.org/releases/mozilla-beta/annotate/13d26dc811fe304c8c38bb4b6da79020467164b1/xpcom/threads/TimerThread.cpp#l460 which is the crash point, and that's:
TimeStamp timeout = mTimers[0]->Value()->mTimeout;

But the logic comes after a call to RemoveLeadingCanceledTimersInternal(); which should remove all entries that would return a null pointer for Value(). And there is no intervening opportunity to release the mutex to violate invariants.

There are some interesting stacks going on as it seems Thread 0 is reliably in a nsTimerEvent::Run call that ends up in an nsTimeImpl::Cancel() call that ends up blocking on acquiring the mutex, but that at least is a healthy indication that the mutex is being used correctly.

Depends on: 657962
Flags: needinfo?(bugmail)
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.