1709931 - Intermittent org.mozilla.geckoview.test.NavigationDelegateTest.onNewSession_childShouldLoad | application crashed [@ mozilla::dom::ContentParent::Pid() const]

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect)

Description

[Treeherder Bug Filer]

Filed by: smolnar [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=338973288&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/DOo2JMoPRUqsQGjdShP9zg/runs/0/artifacts/public/logs/live_backing.log

---

INFO -  TEST-START | org.mozilla.geckoview.test.NavigationDelegateTest.onNewSession_childShouldLoad
[task 2021-05-06T18:45:25.412Z] 18:45:25     INFO -  org.mozilla.geckoview.test | INSTRUMENTATION_RESULT: shortMsg=Process crashed.
[task 2021-05-06T18:45:25.412Z] 18:45:25     INFO -  org.mozilla.geckoview.test | INSTRUMENTATION_CODE: 0
[task 2021-05-06T18:45:25.420Z] 18:45:25     INFO -  org.mozilla.geckoview.test | adb_returncode=0
[task 2021-05-06T18:45:25.422Z] 18:45:25     INFO -  Passed: 318
[task 2021-05-06T18:45:25.422Z] 18:45:25     INFO -  Failed: 0
[task 2021-05-06T18:45:25.422Z] 18:45:25     INFO -  Todo: 40
[task 2021-05-06T18:45:25.422Z] 18:45:25     INFO -  SUITE-END | took 314s
[task 2021-05-06T18:45:25.507Z] 18:45:25     INFO -  mozcrash Copy/paste: /builds/worker/fetches/minidump_stackwalk/minidump_stackwalk /tmp/tmplWpREt/6bf0278a-4050-8d78-b02d-6d568caaed3c.dmp /builds/worker/workspace/build/symbols
[task 2021-05-06T18:45:31.253Z] 18:45:31     INFO -  mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/6bf0278a-4050-8d78-b02d-6d568caaed3c.dmp
[task 2021-05-06T18:45:31.253Z] 18:45:31     INFO -  mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/6bf0278a-4050-8d78-b02d-6d568caaed3c.extra
[task 2021-05-06T18:45:31.262Z] 18:45:31  WARNING -  PROCESS-CRASH | org.mozilla.geckoview.test.NavigationDelegateTest.onNewSession_childShouldLoad | application crashed [@ mozilla::dom::ContentParent::Pid() const]
[task 2021-05-06T18:45:31.262Z] 18:45:31     INFO -  Crash dump filename: /tmp/tmplWpREt/6bf0278a-4050-8d78-b02d-6d568caaed3c.dmp
[task 2021-05-06T18:45:31.262Z] 18:45:31     INFO -  Operating system: Android
[task 2021-05-06T18:45:31.262Z] 18:45:31     INFO -                    0.0.0 Linux 3.10.0+ #260 SMP PREEMPT Fri May 19 12:48:14 PDT 2017 x86_64
[task 2021-05-06T18:45:31.262Z] 18:45:31     INFO -  CPU: amd64
[task 2021-05-06T18:45:31.262Z] 18:45:31     INFO -       family 6 model 6 stepping 3
[task 2021-05-06T18:45:31.262Z] 18:45:31     INFO -       4 CPUs
[task 2021-05-06T18:45:31.262Z] 18:45:31     INFO -  GPU: UNKNOWN
[task 2021-05-06T18:45:31.262Z] 18:45:31     INFO -  Crash reason:  SIGSEGV /0x00000080
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -  Crash address: 0x0
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -  Process uptime: not available
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -  Thread 15 (crashed)
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -   0  libxul.so!mozilla::dom::ContentParent::Pid() const [ContentParent.cpp:c9980e971a31b2bd47783dc4a9a26fca4a4c57d6 : 3185 + 0xc]
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -      rax = 0xe5e5e5e5e5e5e5e5   rdx = 0x0000000000000001
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -      rcx = 0x00007ec7edcc8450   rbx = 0x0000000000000000
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -      rsi = 0x0000000000000000   rdi = 0x00007ec7d1667000
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -      rbp = 0x00007ec7edcc66b0   rsp = 0x00007ec7edcc66b0
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -       r8 = 0x0000000000010001    r9 = 0x0000000000000000
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -      r10 = 0x0000000000000000   r11 = 0x0000000000000246
[task 2021-05-06T18:45:31.263Z] 18:45:31     INFO -      r12 = 0x00000000ffffffff   r13 = 0x00007ec7cd4e0870
[task 2021-05-06T18:45:31.264Z] 18:45:31     INFO -      r14 = 0x00007ec7cd59cda8   r15 = 0x00007ec7cd59cd60
[task 2021-05-06T18:45:31.264Z] 18:45:31     INFO -      rip = 0x00007ec7e4d6d33a
INFO -      Found by: given as instruction pointer in context
[task 2021-05-06T18:45:31.264Z] 18:45:31     INFO -   1  libxul.so!(anonymous namespace)::ParticularProcessPriorityManager::SetPriorityNow(mozilla::hal::ProcessPriority) [ProcessPriorityManager.cpp:c9980e971a31b2bd47783dc4a9a26fca4a4c57d6 : 695 + 0x8]
[task 2021-05-06T18:45:31.264Z] 18:45:31     INFO -      rbp = 0x00007ec7edcc6830   rsp = 0x00007ec7edcc66c0
[task 2021-05-06T18:45:31.264Z] 18:45:31     INFO -      rip = 0x00007ec7e4db36ec
[task 2021-05-06T18:45:31.264Z] 18:45:31     INFO -      Found by: previous frame's frame pointer
[task 2021-05-06T18:45:31.264Z] 18:45:31     INFO -   2  libxul.so!(anonymous namespace)::ParticularProcessPriorityManager::Notify(nsITimer*) [ProcessPriorityManager.cpp:c9980e971a31b2bd47783dc4a9a26fca4a4c57d6 : 641 + 0x12]
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -      rbp = 0x00007ec7edcc6860   rsp = 0x00007ec7edcc6840
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -      rip = 0x00007ec7e4db3309
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -      Found by: previous frame's frame pointer
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -   3  libxul.so!{virtual override thunk({offset(-8)}, (anonymous namespace)::ParticularProcessPriorityManager::Notify(nsITimer*))} + 0xd
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -      rbp = 0x00007ec7edcc6870   rsp = 0x00007ec7edcc6870
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -      rip = 0x00007ec7e4db339d
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -      Found by: previous frame's frame pointer
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -   4  libxul.so!nsTimerImpl::Fire(int) [nsTimerImpl.cpp:c9980e971a31b2bd47783dc4a9a26fca4a4c57d6 : 565 + 0xe]
[task 2021-05-06T18:45:31.265Z] 18:45:31     INFO -      rbp = 0x00007ec7edcc6920   rsp = 0x00007ec7edcc6880
[task 2021-05-06T18:45:31.266Z] 18:45:31     INFO -      rip = 0x00007ec7e2753b31
[task 2021-05-06T18:45:31.266Z] 18:45:31     INFO -      Found by: previous frame's frame pointer
[task 2021-05-06T18:45:31.266Z] 18:45:31     INFO -   5  libxul.so!nsTimerEvent::Run() [TimerThread.cpp:c9980e971a31b2bd47783dc4a9a26fca4a4c57d6 : 252 + 0x14]
[task 2021-05-06T18:45:31.266Z] 18:45:31     INFO -      rbp = 0x00007ec7edcc6960   rsp = 0x00007ec7edcc6930
[task 2021-05-06T18:45:31.266Z] 18:45:31     INFO -      rip = 0x00007ec7e2734385
[task 2021-05-06T18:45:31.266Z] 18:45:31     INFO -      Found by: previous frame's frame pointer
[task 2021-05-06T18:45:31.266Z] 18:45:31     INFO -   6  libxul.so!mozilla::RunnableTask::Run() [TaskController.cpp:c9980e971a31b2bd47783dc4a9a26fca4a4c57d6 : 482 + 0x11]
[task 2021-05-06T18:45:31.267Z] 18:45:31     INFO -      rbp = 0x00007ec7edcc6df0   rsp = 0x00007ec7edcc6970
[task 2021-05-06T18:45:31.267Z] 18:45:31     INFO -      rip = 0x00007ec7e2743c8a
<...>

Comment 1

[Andrew McCreight [:mccr8]]

It looks to me like the timer for a ParticularProcessPriorityManager is running after the manager PPPM has been destroyed.

The timer gets cancelled in ShutDown when the ContentParent is destroyed, but I guess if the PPPM gets destroyed for some other reason then we fail to do that.

Comment 2

[Andrew McCreight [:mccr8]]

Bug 1710153 is the public version of this crash. It has happened a few times, and the same poison values are seen in the registers. I'm still not sure how this can happen, but given that the failures are all in a single specific set of Android unit tests, I'd surmise that the tests do something weird with creating and shutting down content process that exposes this issue.

I'll mark this sec-moderate because it is only being seen in an Android unit test.

Comment 3

[Andrew McCreight [:mccr8]]

Attachment: Bug 1709931 - Properly shut down ParticularProcessPriorityManager when destroying it.

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Properly shut down ParticularProcessPriorityManager when destroying it. r=gsvelto
https://hg.mozilla.org/integration/autoland/rev/6751f446bdf06902c0077de692ce36fd37ffb7f1
https://hg.mozilla.org/mozilla-central/rev/6751f446bdf0

Comment 5

[Andrew McCreight [:mccr8]]

I don't think this is a regression from my patch. The instance in comment 0 happened after my patch was backed out and before it relanded, AFAICT. But I'm not sure what actually caused it. Very weird coincidence.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

OK, timing seemed pretty sus to me, but probably not worth losing any sleep over.

Comment 7

[Andrew McCreight [:mccr8]]

It looks like this crash is continuing to happen, which isn't great.