1660342 - Crash in [@ mozilla::dom::BrowsingContextGroup::Unsubscribe]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P3)

Description

[Sean Feng [:sefeng]]

Crash report: https://crash-stats.mozilla.org/report/index/4727fdf9-5251-4492-8dcb-721fc0200726

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::BrowsingContextGroup::Unsubscribe docshell/base/BrowsingContextGroup.cpp:167
1 xul.dll mozilla::dom::ContentParent::ActorDestroy dom/ipc/ContentParent.cpp:1937
2 xul.dll mozilla::ipc::IProtocol::DestroySubtree ipc/glue/ProtocolUtils.cpp:590
3 xul.dll mozilla::dom::PContentParent::OnChannelClose ipc/ipdl/PContentParent.cpp:15223
4 xul.dll mozilla::ipc::MessageChannel::Close ipc/glue/MessageChannel.cpp:2713
5 xul.dll mozilla::dom::ContentParent::ShutDownProcess dom/ipc/ContentParent.cpp:1598
6 xul.dll mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:9823
7 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2074
8 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1953
9 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:512

This is similar to bug 1660001.
Crash reason MOZ_DIAGNOSTIC_ASSERT(!hostEntry || hostEntry.Data() != aProcess, "Unsubscribing existing host entry");

Nika, can you take a look?

Comment 1

[Nika Layzell [:nika] (ni? for response)]

Not sure how this is happening right now, but I'll land some new assertions to help diagnose this issue.

Comment 2

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1660342 - Add more assertions around host state,

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/db52cf052477
Add more assertions around host state, r=kmag

Comment 4

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/db52cf052477

Comment 5

[Noemi Erli[:noemi_erli]]

Backed out changeset db52cf052477 (Bug 1660342) for causing Bug 1661364 a=backout as requested by jcristau
https://hg.mozilla.org/mozilla-central/rev/b4055ac79297914c4b33dde0c7832fe63a5d5787

Comment 6

[Nika Layzell [:nika] (ni? for response)]

This bug should be fixed when bug 1661364 is fixed (as that bug is caused by the new assertions added by the patch on this bug to help me diagnose the root of the issue). This issue should hopefully be fixed soon once those patches are reviewed.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:farre, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ae991d4209a7
Add more assertions around host state, r=kmag

Comment 9

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/ae991d4209a7

Comment 10

[Bogdan Tara[:bogdan_tara | bogdant]]

Backed out 7 changesets (bug 1661364, bug 1660342) for making bug 1551615 perma fail.

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&selectedTaskRun=JOtk5CD-SiqCHnKUTcQJTQ.0&searchStr=linux%2C18.04%2Cx64%2Casan%2Copt%2Cweb%2Cplatform%2Ctests%2Ctest-linux1804-64-asan%2Fopt-web-platform-tests-e10s%2Cwpt18&fromchange=97bb7fd483e0e1802da6562ed37831198e036896&tochange=a56449ddacc90ad5136af43a455586df77988c1f

Backout link: https://hg.mozilla.org/integration/autoland/rev/433c4ac7d65a7ee98ae406cbc0421185a0c23021

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=315433318&repo=autoland&lineNumber=3109

[task 2020-09-11T10:43:39.147Z] 10:43:39     INFO - TEST-START | /encrypted-media/clearkey-mp4-setmediakeys-at-same-time.https.html
[task 2020-09-11T10:43:39.170Z] 10:43:39     INFO - Closing window 86
[task 2020-09-11T10:43:39.331Z] 10:43:39     INFO - PID 5745 | AddressSanitizer:DEADLYSIGNAL
[task 2020-09-11T10:43:39.331Z] 10:43:39     INFO - PID 5745 | =================================================================
[task 2020-09-11T10:43:39.331Z] 10:43:39    ERROR - PID 5745 | ==6830==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f315172c53b bp 0x7fff5f859190 sp 0x7fff5f858fe0 T0)
[task 2020-09-11T10:43:39.331Z] 10:43:39     INFO - PID 5745 | ==6830==The signal is caused by a WRITE memory access.
[task 2020-09-11T10:43:39.331Z] 10:43:39     INFO - PID 5745 | ==6830==Hint: address points to the zero page.
[task 2020-09-11T10:43:39.865Z] 10:43:39     INFO - PID 5745 | error: address range table at offset 0x5ac0 has an invalid tuple (length = 0) at offset 0x5ae0
[task 2020-09-11T10:43:40.042Z] 10:43:40     INFO - PID 5745 |     #0 0x7f315172c53b in mozilla::ipc::MessageChannel::Clear() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:733:9
[task 2020-09-11T10:43:40.043Z] 10:43:40     INFO - PID 5745 |     #1 0x7f315172af3a in mozilla::ipc::MessageChannel::~MessageChannel() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:630:3
[task 2020-09-11T10:43:40.051Z] 10:43:40     INFO - PID 5745 |     #2 0x7f3151a4076c in ~IToplevelProtocol /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/ProtocolUtils.h:392:32
[task 2020-09-11T10:43:40.051Z] 10:43:40     INFO - PID 5745 |     #3 0x7f3151a4076c in mozilla::gmp::PGMPContentParent::~PGMPContentParent() /builds/worker/workspace/obj-build/ipc/ipdl/PGMPContentParent.cpp:56:1
[task 2020-09-11T10:43:40.072Z] 10:43:40     INFO - PID 5745 |     #4 0x7f31565ae0f7 in Release /builds/worker/checkouts/gecko/dom/media/gmp/GMPContentParent.h:25:3
[task 2020-09-11T10:43:40.073Z] 10:43:40     INFO - PID 5745 |     #5 0x7f31565ae0f7 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
[task 2020-09-11T10:43:40.073Z] 10:43:40     INFO - PID 5745 |     #6 0x7f31565ae0f7 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
[task 2020-09-11T10:43:40.074Z] 10:43:40     INFO - PID 5745 |     #7 0x7f31565ae0f7 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
[task 2020-09-11T10:43:40.074Z] 10:43:40     INFO - PID 5745 |     #8 0x7f31565ae0f7 in ~nsBaseHashtableET /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:72:32
[task 2020-09-11T10:43:40.074Z] 10:43:40     INFO - PID 5745 |     #9 0x7f31565ae0f7 in nsTHashtable<nsBaseHashtableET<nsUint64HashKey, RefPtr<mozilla::gmp::GMPContentParent> > >::s_ClearEntry(PLDHashTable*, PLDHashEntryHdr*) /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:512:37
[task 2020-09-11T10:43:40.081Z] 10:43:40     INFO - PID 5745 |     #10 0x7f315043e6b6 in operator() /builds/worker/checkouts/gecko/xpcom/ds/PLDHashTable.cpp:292:7
[task 2020-09-11T10:43:40.082Z] 10:43:40     INFO - PID 5745 |     #11 0x7f315043e6b6 in ForEachSlot<(lambda at /builds/worker/checkouts/gecko/xpcom/ds/PLDHashTable.cpp:290:51)> /builds/worker/workspace/obj-build/dist/include/PLDHashTable.h:357:9
[task 2020-09-11T10:43:40.083Z] 10:43:40     INFO - PID 5745 |     #12 0x7f315043e6b6 in ForEachSlot<(lambda at /builds/worker/checkouts/gecko/xpcom/ds/PLDHashTable.cpp:290:51)> /builds/worker/workspace/obj-build/dist/include/PLDHashTable.h:347:7
[task 2020-09-11T10:43:40.083Z] 10:43:40     INFO - PID 5745 |     #13 0x7f315043e6b6 in PLDHashTable::~PLDHashTable() /builds/worker/checkouts/gecko/xpcom/ds/PLDHashTable.cpp:290:15
[task 2020-09-11T10:43:40.083Z] 10:43:40     INFO - PID 5745 |     #14 0x7f315658234e in ~nsTHashtable /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:170:27
[task 2020-09-11T10:43:40.083Z] 10:43:40     INFO - PID 5745 |     #15 0x7f315658234e in ~GMPServiceChild /builds/worker/checkouts/gecko/dom/media/gmp/GMPServiceChild.cpp:426:35
[task 2020-09-11T10:43:40.083Z] 10:43:40     INFO - PID 5745 |     #16 0x7f315658234e in mozilla::gmp::GMPServiceChild::~GMPServiceChild() /builds/worker/checkouts/gecko/dom/media/gmp/GMPServiceChild.cpp:426:35
[task 2020-09-11T10:43:40.084Z] 10:43:40     INFO - PID 5745 |     #17 0x7f315658113d in operator() /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:460:5
[task 2020-09-11T10:43:40.084Z] 10:43:40     INFO - PID 5745 |     #18 0x7f315658113d in reset /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:302:7
[task 2020-09-11T10:43:40.085Z] 10:43:40     INFO - PID 5745 |     #19 0x7f315658113d in operator= /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:275:5
[task 2020-09-11T10:43:40.086Z] 10:43:40     INFO - PID 5745 |     #20 0x7f315658113d in mozilla::gmp::GeckoMediaPluginServiceChild::Observe(nsISupports*, char const*, char16_t const*) /builds/worker/checkouts/gecko/dom/media/gmp/GMPServiceChild.cpp:357:21
[task 2020-09-11T10:43:40.086Z] 10:43:40     INFO - PID 5745 |     #21 0x7f315658124c in non-virtual thunk to mozilla::gmp::GeckoMediaPluginServiceChild::Observe(nsISupports*, char const*, char16_t const*) /builds/worker/checkouts/gecko/dom/media/gmp/GMPServiceChild.cpp
[task 2020-09-11T10:43:40.087Z] 10:43:40     INFO - PID 5745 |     #22 0x7f315045c9de in nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) /builds/worker/checkouts/gecko/xpcom/ds/nsObserverList.cpp:70:19
[task 2020-09-11T10:43:40.088Z] 10:43:40     INFO - PID 5745 |     #23 0x7f3150463151 in nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) /builds/worker/checkouts/gecko/xpcom/ds/nsObserverService.cpp:287:19
[task 2020-09-11T10:43:40.089Z] 10:43:40     INFO - PID 5745 |     #24 0x7f3150611fb0 in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/checkouts/gecko/xpcom/build/XPCOMInit.cpp:640:24
[task 2020-09-11T10:43:40.091Z] 10:43:40     INFO - PID 5745 |     #25 0x7f315b499dfc in XRE_TermEmbedding() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:223:3
[task 2020-09-11T10:43:40.092Z] 10:43:40     INFO - PID 5745 |     #26 0x7f315174f72e in mozilla::ipc::ScopedXREEmbed::Stop() /builds/worker/checkouts/gecko/ipc/glue/ScopedXREEmbed.cpp:90:5
[task 2020-09-11T10:43:40.092Z] 10:43:40     INFO - PID 5745 |     #27 0x7f315b49aefd in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:748:16
[task 2020-09-11T10:43:40.099Z] 10:43:40     INFO - PID 5745 |     #28 0x5639631532cd in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
[task 2020-09-11T10:43:40.100Z] 10:43:40     INFO - PID 5745 |     #29 0x56396315370a in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
[task 2020-09-11T10:43:40.120Z] 10:43:40     INFO - PID 5745 |     #30 0x7f3170e4cb96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
[task 2020-09-11T10:43:40.120Z] 10:43:40     INFO - PID 5745 |     #31 0x5639630a6c85 in _start (/builds/worker/workspace/build/application/firefox/firefox+0x57c85)
[task 2020-09-11T10:43:40.121Z] 10:43:40     INFO - PID 5745 | AddressSanitizer can not provide additional info.
[task 2020-09-11T10:43:40.121Z] 10:43:40     INFO - PID 5745 | SUMMARY: AddressSanitizer: SEGV /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:733:9 in mozilla::ipc::MessageChannel::Clear()
[task 2020-09-11T10:43:40.121Z] 10:43:40     INFO - PID 5745 | ==6830==ABORTING
[task 2020-09-11T10:43:40.661Z] 10:43:40     INFO - PID 7344 | console.error: SearchCache: "_readCacheFile: Error reading cache file:" (new Error("", "(unknown module)"))
[task 2020-09-11T10:43:41.331Z] 10:43:41     INFO - .
[task 2020-09-11T10:43:41.331Z] 10:43:41     INFO - TEST-OK | /encrypted-media/clearkey-mp4-setmediakeys-at-same-time.https.html | took 2189ms

Comment 11

[Neha Kochar [:neha]]

These crashes are not Fission-only, but we do want them fixed asap. Moving to M6c for tracking.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0f90e57aec46
Add more assertions around host state, r=kmag

Comment 13

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/0f90e57aec46