Closed Bug 1636545 Opened 5 years ago Closed 3 years ago

Intermittent browser/components/originattributes/test/browser/browser_firstPartyIsolation_aboutPages.js | application crashed [@ mozilla::MozPromise<unsigned long, nsresult, true>::AssertIsDead]

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: intermittent-bug-filer, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

Filed by: nbeleuzu [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=301428313&repo=mozilla-central
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/JS0vOxAgSlaIIn3P9R7OtA/runs/0/artifacts/public/logs/live_backing.log

[task 2020-05-08T16:33:52.493Z] 16:33:52 INFO - PROCESS-CRASH | browser/components/originattributes/test/browser/browser_firstPartyIsolation_aboutPages.js | application crashed [@ mozilla::MozPromise<unsigned long, nsresult, true>::AssertIsDead()]
[task 2020-05-08T16:33:52.494Z] 16:33:52 INFO - Mozilla crash reason: MOZ_DIAGNOSTIC_ASSERT(Request::mDisconnected)
[task 2020-05-08T16:33:52.494Z] 16:33:52 INFO - Crash dump filename: /tmp/tmpvKBQ9B.mozrunner/minidumps/06dc5a82-2a6d-cdb8-2032-6c61907b263f.dmp
[task 2020-05-08T16:33:52.495Z] 16:33:52 INFO - Operating system: Linux
[task 2020-05-08T16:33:52.495Z] 16:33:52 INFO - 0.0.0 Linux 4.4.0-1014-aws #14taskcluster1-Ubuntu SMP Tue Apr 3 10:27:00 UTC 2018 x86_64
[task 2020-05-08T16:33:52.496Z] 16:33:52 INFO - CPU: amd64
[task 2020-05-08T16:33:52.496Z] 16:33:52 INFO - family 6 model 85 stepping 7
[task 2020-05-08T16:33:52.497Z] 16:33:52 INFO - 2 CPUs
[task 2020-05-08T16:33:52.497Z] 16:33:52 INFO -
[task 2020-05-08T16:33:52.498Z] 16:33:52 INFO - GPU: UNKNOWN
[task 2020-05-08T16:33:52.498Z] 16:33:52 INFO -
[task 2020-05-08T16:33:52.498Z] 16:33:52 INFO - Crash reason: SIGSEGV /SEGV_MAPERR
[task 2020-05-08T16:33:52.499Z] 16:33:52 INFO - Crash address: 0x0
[task 2020-05-08T16:33:52.499Z] 16:33:52 INFO - Process uptime: not available
[task 2020-05-08T16:33:52.500Z] 16:33:52 INFO -
[task 2020-05-08T16:33:52.500Z] 16:33:52 INFO - Thread 0 (crashed)
[task 2020-05-08T16:33:52.501Z] 16:33:52 INFO - 0 libxul.so!mozilla::MozPromise<unsigned long, nsresult, true>::AssertIsDead() [MozPromise.h:ac7a5cda729f6f9d9c34463a1996b0bf06b9905f : 443 + 0x0]
[task 2020-05-08T16:33:52.501Z] 16:33:52 INFO - rax = 0x00007f1bd28fdac9 rdx = 0x0000000000000001
[task 2020-05-08T16:33:52.501Z] 16:33:52 INFO - rcx = 0x000055ef71289df8 rbx = 0x00007f1baf8e7700
[task 2020-05-08T16:33:52.502Z] 16:33:52 INFO - rsi = 0x0000000000000003 rdi = 0x00007f1baf8e7700
[task 2020-05-08T16:33:52.502Z] 16:33:52 INFO - rbp = 0x00007ffe3da1b1d0 rsp = 0x00007ffe3da1b1a0
[task 2020-05-08T16:33:52.503Z] 16:33:52 INFO - r8 = 0x00007f1bbf694f88 r9 = 0x0000000000000010
[task 2020-05-08T16:33:52.503Z] 16:33:52 INFO - r10 = 0x0000000081bed3e6 r11 = 0x000000000000001d
[task 2020-05-08T16:33:52.503Z] 16:33:52 INFO - r12 = 0x0000000000000000 r13 = 0x0000000000000000
[task 2020-05-08T16:33:52.504Z] 16:33:52 INFO - r14 = 0x00007f1bbf694f88 r15 = 0x00007f1bbf694f70
[task 2020-05-08T16:33:52.504Z] 16:33:52 INFO - rip = 0x00007f1bcddc8a6f
[task 2020-05-08T16:33:52.505Z] 16:33:52 INFO - Found by: given as instruction pointer in context
[task 2020-05-08T16:33:52.505Z] 16:33:52 INFO - 1 libxul.so!mozilla::MozPromise<unsigned long, nsresult, true>::~MozPromise() [MozPromise.h:ac7a5cda729f6f9d9c34463a1996b0bf06b9905f : 1023 + 0x9]
[task 2020-05-08T16:33:52.505Z] 16:33:52 INFO - rbx = 0x00007f1bbf694f70 rbp = 0x00007ffe3da1b210
[task 2020-05-08T16:33:52.506Z] 16:33:52 INFO - rsp = 0x00007ffe3da1b1e0 r12 = 0x0000000000000fa4
[task 2020-05-08T16:33:52.506Z] 16:33:52 INFO - r13 = 0x00000000000006b1 r14 = 0x00007f1bbf694f70
[task 2020-05-08T16:33:52.507Z] 16:33:52 INFO - r15 = 0x00007f1bde6a5a00 rip = 0x00007f1bcddc8ae5
[task 2020-05-08T16:33:52.507Z] 16:33:52 INFO - Found by: call frame info
[task 2020-05-08T16:33:52.510Z] 16:33:52 INFO - 2 libxul.so!mozilla::MozPromise<unsigned long, nsresult, true>::Private::~Private() [MozPromise.h:ac7a5cda729f6f9d9c34463a1996b0bf06b9905f : 253 + 0xe]
[task 2020-05-08T16:33:52.510Z] 16:33:52 INFO - rbx = 0x00007f1bbf694f70 rbp = 0x00007ffe3da1b230
[task 2020-05-08T16:33:52.510Z] 16:33:52 INFO - rsp = 0x00007ffe3da1b220 r12 = 0x0000000000000fa4
[task 2020-05-08T16:33:52.511Z] 16:33:52 INFO - r13 = 0x00000000000006b1 r14 = 0x00007f1baf8e76b0
[task 2020-05-08T16:33:52.511Z] 16:33:52 INFO - r15 = 0x00007f1bde6a5a00 rip = 0x00007f1bcddc88fe
[task 2020-05-08T16:33:52.511Z] 16:33:52 INFO - Found by: call frame info
[task 2020-05-08T16:33:52.511Z] 16:33:52 INFO - 3 libxul.so!std::_Function_base::_Base_manager<mozilla::MozPromise<unsigned long, nsresult, true>::FromDomPromise(mozilla::dom::Promise*)::{lambda(JSContext*, JS::Handle<JS::Value>)#1}>::_M_manager(std::_Any_data&, std::_Function_base::_Base_manager<mozilla::MozPromise<unsigned long, nsresult, true>::FromDomPromise(mozilla::dom::Promise*)::{lambda(JSContext*, JS::Handle<JS::Value>)#1}> const&, std::_Manager_operation) [std_function.h : 231 + 0x1e]
[task 2020-05-08T16:33:52.512Z] 16:33:52 INFO - rbx = 0x00007f1bb7e62f40 rbp = 0x00007ffe3da1b250
[task 2020-05-08T16:33:52.512Z] 16:33:52 INFO - rsp = 0x00007ffe3da1b240 r12 = 0x0000000000000fa4
[task 2020-05-08T16:33:52.512Z] 16:33:52 INFO - r13 = 0x00000000000006b1 r14 = 0x00007f1baf8e76b0
[task 2020-05-08T16:33:52.512Z] 16:33:52 INFO - r15 = 0x00007f1bde6a5a00 rip = 0x00007f1bcddc8d8f
[task 2020-05-08T16:33:52.513Z] 16:33:52 INFO - Found by: call frame info
[task 2020-05-08T16:33:52.513Z] 16:33:52 INFO - 4 libxul.so!mozilla::dom::DomPromiseListener::~DomPromiseListener() [PromiseNativeHandler.h:ac7a5cda729f6f9d9c34463a1996b0bf06b9905f : 54 + 0x4d]
[task 2020-05-08T16:33:52.513Z] 16:33:52 INFO - rbx = 0x00007f1baf8e76a0 rbp = 0x00007ffe3da1b270
[task 2020-05-08T16:33:52.513Z] 16:33:52 INFO - rsp = 0x00007ffe3da1b260 r12 = 0x0000000000000fa4
[task 2020-05-08T16:33:52.513Z] 16:33:52 INFO - r13 = 0x00000000000006b1 r14 = 0x00000000000002b1
[task 2020-05-08T16:33:52.514Z] 16:33:52 INFO - r15 = 0x00007f1bde6a5a00 rip = 0x00007f1bcfd9551d
[task 2020-05-08T16:33:52.514Z] 16:33:52 INFO - Found by: call frame info
[task 2020-05-08T16:33:52.514Z] 16:33:52 INFO - 5 libxul.so!mozilla::dom::DomPromiseListener::Release() [PromiseNativeHandler.cpp:ac7a5cda729f6f9d9c34463a1996b0bf06b9905f : 14 + 0x22]
[task 2020-05-08T16:33:52.514Z] 16:33:52 INFO - rbx = 0x00007f1bb165a000 rbp = 0x00007ffe3da1b280
[task 2020-05-08T16:33:52.515Z] 16:33:52 INFO - rsp = 0x00007ffe3da1b280 r12 = 0x0000000000000fa4
[task 2020-05-08T16:33:52.515Z] 16:33:52 INFO - r13 = 0x00000000000006b1 r14 = 0x00000000000002b1
[task 2020-05-08T16:33:52.515Z] 16:33:52 INFO - r15 = 0x00007f1bde6a5a00 rip = 0x00007f1bcfd95122
[task 2020-05-08T16:33:52.515Z] 16:33:52 INFO - Found by: call frame info
[task 2020-05-08T16:33:52.515Z] 16:33:52 INFO - 6 libxul.so!nsCycleCollector::CollectWhite() [nsCycleCollector.cpp:ac7a5cda729f6f9d9c34463a1996b0bf06b9905f : 3083 + 0xd]
[task 2020-05-08T16:33:52.516Z] 16:33:52 INFO - rbx = 0x00007f1bb165a000 rbp = 0x00007ffe3da1b310
[task 2020-05-08T16:33:52.516Z] 16:33:52 INFO - rsp = 0x00007ffe3da1b290 r12 = 0x0000000000000fa4
[task 2020-05-08T16:33:52.516Z] 16:33:52 INFO - r13 = 0x00000000000006b1 r14 = 0x00000000000002b1
[task 2020-05-08T16:33:52.516Z] 16:33:52 INFO - r15 = 0x00007f1bde6a5a00 rip = 0x00007f1bcd8a5c6a
[task 2020-05-08T16:33:52.516Z] 16:33:52 INFO - Found by: call frame info
[task 2020-05-08T16:33:52.516Z] 16:33:52 INFO - 7 libxul.so!nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) [nsCycleCollector.cpp:ac7a5cda729f6f9d9c34463a1996b0bf06b9905f : 3432 + 0x8]
[task 2020-05-08T16:33:52.517Z] 16:33:52 INFO - rbx = 0x00007ffe3da1b450 rbp = 0x00007ffe3da1b3c0
[task 2020-05-08T16:33:52.517Z] 16:33:52 INFO - rsp = 0x00007ffe3da1b320 r12 = 0x0000000000000000
[task 2020-05-08T16:33:52.517Z] 16:33:52 INFO - r13 = 0x0000000000000001 r14 = 0x00007f1bde6a5a00
[task 2020-05-08T16:33:52.517Z] 16:33:52 INFO - r15 = 0x00007f1bd28fce88 rip = 0x00007f1bcd8a69fd
[task 2020-05-08T16:33:52.517Z] 16:33:52 INFO - Found by: call frame info
[task 2020-05-08T16:33:52.518Z] 16:33:52 INFO - 8 libxul.so!nsCycleCollector_collectSlice(js::SliceBudget&, bool) [nsCycleCollector.cpp:ac7a5cda729f6f9d9c34463a1996b0bf06b9905f : 3920 + 0x14]
[task 2020-05-08T16:33:52.518Z] 16:33:52 INFO - rbx = 0x00007f1bde6203e0 rbp = 0x00007ffe3da1b410
[task 2020-05-08T16:33:52.518Z] 16:33:52 INFO - rsp = 0x00007ffe3da1b3d0 r12 = 0x00007f1bcbef52b0
[task 2020-05-08T16:33:52.518Z] 16:33:52 INFO - r13 = 0x0000000000000002 r14 = 0x00007ffe3da1b450
[task 2020-05-08T16:33:52.518Z] 16:33:52 INFO - r15 = 0x0000000000000000 rip = 0x00007f1bcd8a7fa4
[task 2020-05-08T16:33:52.518Z] 16:33:52 INFO - Found by: call frame info

Because this bug's Severity is normal and has not been changed, and this bug's priority is -- (none,) indicating it has has not been previously triaged, the bug's Severity is being updated to -- (default, untriaged.)

Severity: normal → --
See Also: → 1635953
See Also: → 1634264
Crash Signature: [@ mozilla::MozPromise<unsigned long, nsresult, true>::AssertIsDead()] → [@ mozilla::MozPromise<unsigned long, nsresult, true>::AssertIsDead]
Summary: Intermittent browser/components/originattributes/test/browser/browser_firstPartyIsolation_aboutPages.js | application crashed [@ mozilla::MozPromise<unsigned long, nsresult, true>::AssertIsDead()] → Intermittent browser/components/originattributes/test/browser/browser_firstPartyIsolation_aboutPages.js | application crashed [@ mozilla::MozPromise<unsigned long, nsresult, true>::AssertIsDead]

This appears to be an issue where a DomPromiseListener is destroyed by the cycle collector without ever resolving or rejecting the corresponding MozPromise - we should perhaps consider calling the Reject member of the DomPromiseListener when it is destroyed without being resolved or rejected as handlers like https://searchfox.org/mozilla-central/rev/d630a6aad368dbbae4d90853f8cff5cb7c852407/dom/credentialmanagement/identity/IdentityCredential.cpp#784 capture MozPromise with it, which does not like being destroyed without being resolved or rejected.

Redirecting to the DOM component, where the DomPromiseListener type originates.

Component: XPCOM → DOM: Core & HTML

(In reply to Nika Layzell [:nika] (ni? for response) from comment #4)

This appears to be an issue where a DomPromiseListener is destroyed by the cycle collector without ever resolving or rejecting the corresponding MozPromise - we should perhaps consider calling the Reject member of the DomPromiseListener when it is destroyed without being resolved or rejected as handlers like https://searchfox.org/mozilla-central/rev/d630a6aad368dbbae4d90853f8cff5cb7c852407/dom/credentialmanagement/identity/IdentityCredential.cpp#784 capture MozPromise with it, which does not like being destroyed without being resolved or rejected.

Redirecting to the DOM component, where the DomPromiseListener type originates.

I moved this general investigation to bug 1824299 as this specific crash seems to have gone away.

See Also: → 1824299
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.