Closed Bug 1544632 Opened 5 years ago Closed 5 years ago

Intermittent /encoding/api-invalid-label.any.html | application crashed [@ xpc::XrayTraits::resolveOwnProperty(JSContext* JS::Handle<JSObject*> JS::Handle<JSObject* JS::Handle<JSObject*> JS::Handle<JS::PropertyKey> JS::MutableHandle<JS::PropertyDescriptor

Categories

(Core :: Internationalization, defect, P3)

Product:
Core
Component:
Internationalization
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla68
Tracking Flags:
Tracking Status
firefox-esr60 --- unaffected
firefox67 --- unaffected
firefox68 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: hsivonen)

References

(Regression)

Details

(Keywords: crash, intermittent-failure, regression)

Crash Data

Attachments

(1 file)

Bug 1544632 - Check for BrowserParent destruction before sending StopIMEStateManagement IPC message.
47 bytes, text/x-phabricator-request
Details | Review

#[markdown(off)]
Filed by: csabou [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=240531095&repo=autoland

https://queue.taskcluster.net/v1/task/BKuMgKOcRR20xjSwbXYHcw/runs/0/artifacts/public/logs/live_backing.log

01:41:36 INFO - TEST-OK | /encoding/api-invalid-label.any.worker.html | took 2500ms
01:41:36 INFO - TEST-START | /encoding/api-invalid-label.any.html
01:41:36 INFO - Closing window 6442450953
01:41:37 INFO - PID 2715 | ###!!! [Parent][MessageChannel] Error: (msgtype=0x1E0070,name=PBrowser::Msg_StopIMEStateManagement) Channel error: cannot send/recv
01:41:37 INFO - PID 2715 | ###!!! [Parent][MessageChannel] Error: (msgtype=0x1E008B,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv
01:41:37 INFO - PID 2715 | A content process crashed and MOZ_CRASHREPORTER_SHUTDOWN is set, shutting down
01:41:37 INFO - Browser not responding, setting status to CRASH
01:41:37 INFO - mozcrash Downloading symbols from: https://queue.taskcluster.net/v1/task/CGzAmc-mRteVIteJVyByYg/artifacts/public/build/target.crashreporter-symbols.zip
01:41:37 INFO - PID 2715 | 1555378897892 Marionette INFO Stopped listening on port 2828
01:41:42 INFO - mozcrash Copy/paste: /Users/cltbld/tasks/task_1555378149/build/macosx64-minidump_stackwalk /var/folders/hz/52pqmkl14cb7jcswxyb48zg800000x/T/tmpGwqDGJ.mozrunner/minidumps/8396B4DD-031D-4C7B-9E0D-0191269BFF32.dmp /var/folders/hz/52pqmkl14cb7jcswxyb48zg800000x/T/tmpn0jE7Y
01:41:47 INFO - mozcrash Saved minidump as /Users/cltbld/tasks/task_1555378149/build/blobber_upload_dir/8396B4DD-031D-4C7B-9E0D-0191269BFF32.dmp
01:41:47 INFO - mozcrash Saved app info as /Users/cltbld/tasks/task_1555378149/build/blobber_upload_dir/8396B4DD-031D-4C7B-9E0D-0191269BFF32.extra
01:41:47 INFO - PROCESS-CRASH | /encoding/api-invalid-label.any.html | application crashed [@ xpc::XrayTraits::resolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::PropertyDescriptor>)]
01:41:47 INFO - Crash dump filename: /var/folders/hz/52pqmkl14cb7jcswxyb48zg800000x/T/tmpGwqDGJ.mozrunner/minidumps/8396B4DD-031D-4C7B-9E0D-0191269BFF32.dmp
01:41:47 INFO - Operating system: Mac OS X
01:41:47 INFO - 10.10.5 14F27
01:41:47 INFO - CPU: amd64
01:41:47 INFO - family 6 model 69 stepping 1
01:41:47 INFO - 4 CPUs
01:41:47 INFO -
01:41:47 INFO - GPU: UNKNOWN
01:41:47 INFO -
01:41:47 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
01:41:47 INFO - Crash address: 0x0
01:41:47 INFO - Process uptime: 8 seconds
01:41:47 INFO -
01:41:47 INFO - Thread 0 (crashed)
01:41:47 INFO - 0 XUL!xpc::XrayTraits::resolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::PropertyDescriptor>) [XrayWrapper.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 0 + 0x16]
01:41:47 INFO - rax = 0x000000010eb723a4 rdx = 0x00007fff576c3230
01:41:47 INFO - rcx = 0x0000000113565788 rbx = 0x0000000119727020
01:41:47 INFO - rsi = 0x00007fff576c30c8 rdi = 0x000000010fdf0d38
01:41:47 INFO - rbp = 0x00007fff576c2ff0 rsp = 0x00007fff576c2f50
01:41:47 INFO - r8 = 0x00007fff576c3570 r9 = 0x00007fff576c3148
01:41:47 INFO - r10 = 0x000039012ed263c4 r11 = 0x0000000000000000
01:41:47 INFO - r12 = 0x0000000119727000 r13 = 0x00007fff576c30c8
01:41:47 INFO - r14 = 0x00007fff576c3148 r15 = 0x00007fff576c30e8
01:41:47 INFO - rip = 0x0000000109e8af35
01:41:47 INFO - Found by: given as instruction pointer in context
01:41:47 INFO - 1 XUL!xpc::JSXrayTraits::resolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::PropertyDescriptor>) [XrayWrapper.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 507 + 0x14]
01:41:47 INFO - rbp = 0x00007fff576c3090 rsp = 0x00007fff576c3000
01:41:47 INFO - rip = 0x0000000109e83b0a
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 2 XUL!xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::PropertyDescriptor>) const [XrayWrapper.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 1895 + 0x1a]
01:41:47 INFO - rbp = 0x00007fff576c3120 rsp = 0x00007fff576c30a0
01:41:47 INFO - rip = 0x0000000109e83a6b
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 3 XUL!xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::hasOwn(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) const [XrayWrapper.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 2126 + 0x5b]
01:41:47 INFO - rbp = 0x00007fff576c3180 rsp = 0x00007fff576c3130
01:41:47 INFO - rip = 0x0000000109e87ad5
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 4 XUL!js::Proxy::has(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) [Proxy.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 238 + 0x12]
01:41:47 INFO - rbp = 0x00007fff576c3200 rsp = 0x00007fff576c3190
01:41:47 INFO - rip = 0x000000010e08bd08
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 5 XUL!js::Proxy::has(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) [Proxy.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 253 + 0x2e]
01:41:47 INFO - rbp = 0x00007fff576c3280 rsp = 0x00007fff576c3210
01:41:47 INFO - rip = 0x000000010e08bdd2
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 6 XUL!xpc::JSXrayTraits::getOwnPropertyFromTargetIfSafe(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::PropertyDescriptor>) [XrayWrapper.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 366 + 0xe]
01:41:47 INFO - rbp = 0x00007fff576c3340 rsp = 0x00007fff576c3290
01:41:47 INFO - rip = 0x0000000109e8c6b7
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 7 XUL!xpc::JSXrayTraits::getOwnPropertyFromWrapperIfSafe(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::PropertyDescriptor>) [XrayWrapper.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 289 + 0x11]
01:41:47 INFO - rbp = 0x00007fff576c33b0 rsp = 0x00007fff576c3350
01:41:47 INFO - rip = 0x0000000109e8ba84
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 8 XUL!xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::PropertyDescriptor>) const [XrayWrapper.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 1895 + 0x1a]
01:41:47 INFO - rbp = 0x00007fff576c3440 rsp = 0x00007fff576c33c0
01:41:47 INFO - rip = 0x0000000109e83a6b
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 9 XUL!xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::hasOwn(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) const [XrayWrapper.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 2126 + 0x5b]
01:41:47 INFO - rbp = 0x00007fff576c34a0 rsp = 0x00007fff576c3450
01:41:47 INFO - rip = 0x0000000109e87ad5
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 10 XUL!js::ProxyGetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) [Proxy.cpp:9feaaddc3761202159be41a34280f3cec61a58d4 : 358 + 0x1f]
01:41:47 INFO - rbp = 0x00007fff576c3530 rsp = 0x00007fff576c34b0
01:41:47 INFO - rip = 0x000000010e08c9bd
01:41:47 INFO - Found by: previous frame's frame pointer
01:41:47 INFO - 11 0x24d61246377a
01:41:47 INFO - rbp = 0x00007fff576c3578 rsp = 0x00007fff576c3540
01:41:47 INFO - rip = 0x000024d61246377a
01:41:47 INFO - Found by: previous frame's frame pointer

Don't mark intermittent crashes as P5s. We want them to go to triage owners.

Priority: P5 → --

The priority flag is not set for this bug.
:m_kato, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(m_kato)

Henri, could you look this issue?

Flags: needinfo?(m_kato) → needinfo?(hsivonen)
Priority: -- → P3

It looks like the IPC send needs to be wrapped in an "is destroying" check.

Assignee: nobody → hsivonen
Status: NEW → ASSIGNED
Flags: needinfo?(hsivonen)
Pushed by hsivonen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/ced775b2651e
Check for BrowserParent destruction before sending StopIMEStateManagement IPC message. r=masayuki

https://hg.mozilla.org/mozilla-central/rev/ced775b2651e

Status: ASSIGNED → RESOLVED
Closed: 5 years ago
status-firefox68: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: