1851192 - Perma xpc PROCESS-CRASH | application crashed [@ __cxa_pure_virtual] | docshell/test/unit/test_privacy_transition.js | devtools/shared/tests/xpcshell/test_console_filtering.js when Gecko 119 merges to Beta on 2023-09-25

Status: VERIFIED FIXED

(Core :: Graphics: Text, defect)

Description

[Sandor Molnar[:smolnar]]

Central as beta simulation

How to run these simulations

Failure log

TEST-PASS | devtools/shared/tests/xpcshell/test_console_filtering.js | run_test - [run_test : 150] 2 == 2
[task 2023-09-01T13:07:42.560Z] 13:07:42     INFO -  (xpcshell/head.js) | test MAIN run_test finished (1)
[task 2023-09-01T13:07:42.560Z] 13:07:42     INFO -  exiting test
[task 2023-09-01T13:07:42.560Z] 13:07:42     INFO -  <<<<<<<
[task 2023-09-01T13:08:03.869Z] 13:08:03  WARNING -  PROCESS-CRASH | application crashed [@ __cxa_pure_virtual] | devtools/shared/tests/xpcshell/test_console_filtering.js
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Process type: main
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Process pid: 6221
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Crash dump filename: /var/folders/px/8yc0cyhn7911lj_f24g3msk0000014/T/xpc-other-76bf0xt8/ED50D63A-8F12-4102-85E5-04694066A512.dmp
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Operating system: Mac OS X
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -                    11.2.3 20D91
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  CPU: arm64
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -       8 CPUs
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Crash address: 0x0
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Mac Crash Info:
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Process uptime: 0 seconds
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -  Thread 6 InitFontList (crashed)
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -   0  XUL!__cxa_pure_virtual [pure_virtual.c:e60dd9e1cdb74f950f392a3e69f88bb5875cca7b : 25 + 0x0]
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -        x0 = 0x0000000118839600     x1 = 0x0000000000000000
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -        x2 = 0x000000016fe16db8     x3 = 0x0000000000000000
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -        x4 = 0x00000000000062dc     x5 = 0x0000000000000032
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -        x6 = 0x000000000000006f     x7 = 0x0000000000000000
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -        x8 = 0x0000000000000000     x9 = 0x0000000000000019
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -       x10 = 0x0000000000000154    x11 = 0x0000000000000001
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -       x12 = 0x0000000000000003    x13 = 0x0000000122e81fa0
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -       x14 = 0x0000000000000000    x15 = 0x0000000202925628
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -       x16 = 0x00000001986aebe4    x17 = 0x00000001022828e8
[task 2023-09-01T13:08:03.869Z] 13:08:03     INFO -       x18 = 0x0000000000000000    x19 = 0x000000016fe16d88
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -       x20 = 0x0000000118839600    x21 = 0x000000010a40b660
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -       x22 = 0x0000000000000000    x23 = 0x0000000102709700
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -       x24 = 0x0000000000000000    x25 = 0x0000000000000000
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -       x26 = 0x0000000000000000    x27 = 0x0000000000000000
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -       x28 = 0x0000000000000000     fp = 0x000000016fe16d10
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -        lr = 0x00000001030fae4c     sp = 0x000000016fe16d10
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -        pc = 0x000000010542039c
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -      Found by: given as instruction pointer in context
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -   1  XUL!gfxPlatformFontList::GetDefaultFontLocked(nsPresContext*, gfxFontStyle const*) [gfxPlatformFontList.cpp:e60dd9e1cdb74f950f392a3e69f88bb5875cca7b : 2443 + 0x1c]
[task 2023-09-01T13:08:03.870Z] 13:08:03     INFO -       x19 = 0x000000016fe16d88    x20 = 0x0000000118839600

Comment 1

[Andrew McCreight [:mccr8]]

This looks like a crash in font code, though I don't know why the test devtools/shared/tests/xpcshell/test_console_filtering.js would cause that.

Comment 2

[Narcis Beleuzu [:NarcisB]]

We did a few retriggers & backfills and the failure seem to have crashed along with Bug 1816925.
Randell, can you please take a look?

Comment 3

[Donal Meehan [:dmeehan]]

:lsalzman pinging as triage owner, could you triage and prioritize this?
Fx119 nightly soft code freeze freeze starts next week

Comment 4

[Lee Salzman [:lsalzman]]

Jonathan, this seems like it's crashing inside gfxPlatformFontList::GetDefaultFontLocked, where in the __cxa_pure_virtual signature is triggered. Ideas?

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

I don't see how WebTransport SendOrder support could possibly be involved here (and it doesn't run in CI except for WPT tests that haven't landed yet; and there's no WebTransport use in CI at all outside of WebTransport WPTs and a few xpcshell tests.

Comment 6

[Jonathan Kew [:jfkthame]]

I suspect what may be happening here is that these tests launch and then terminate a Gecko session rather quickly, and shutdown is happening (and destroying the gfxPlatformFontList object) before the InitFontList thread has had a chance to run. So when InitFontListCallback tries to call in to the gfxPlatformFontList that was passed to it, that object's destructor has already run and the vtable is gone.

Probably we should check for the existence of a font-list-init thread in gfxPlatformFontList::Shutdown(), before destroying the font-list singleton. Doing it in the ~gfxPlatformFontList destructor may not be enough, as the subclass destructor will already have run before we have a chance to block there, and so the object probably isn't safely usable.

(The connection to the WebTransport SendOrder support bug, if any, might just be that it affected thread timings in some subtle way, and we were previously getting lucky?)

I'll send a possible patch to tryserver and see how it looks.

Comment 7

[Jonathan Kew [:jfkthame]]

Central-as-beta try run looks OK: https://treeherder.mozilla.org/jobs?repo=try&revision=80d6195fc501960da900e5d1af635ca975f026d9

Comment 8

[Jonathan Kew [:jfkthame]]

Attachment: Bug 1851192 - Ensure gfxPlatformFontList shutdown waits for the InitFontList thread to terminate. r=#gfx-reviewers

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4454521caad4
Ensure gfxPlatformFontList shutdown waits for the InitFontList thread to terminate. r=gfx-reviewers,lsalzman,aosmond

Comment 10

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/4454521caad4

Comment 11

[Narcis Beleuzu [:NarcisB]]

Verified fixed in today's central as beta sim