Crash @NS_NotifyPluginCall on tinderbox shortly after plugin tests run

RESOLVED FIXED

Status

()

Core
Plug-ins
RESOLVED FIXED
9 years ago
6 years ago

People

(Reporter: jimm, Assigned: karlt)

Tracking

({crash, fixed1.9.1, intermittent-failure})

Trunk
x86
All
crash, fixed1.9.1, intermittent-failure
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.9.1 ?

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
TEST-PASS | chrome://mochikit/content/browser/xpinstall/tests/browser_whitelist6.js | Install should have been triggered by the right uri

Browser Chrome Test Summary
	Pass: 2936
	Fail: 0
	Todo: 5

*** End BrowserChrome Test Results ***
NEXT ERROR TEST-UNEXPECTED-FAIL | (automation.py) | Exited with code 1 during test run
INFO | (automation.py) | Application ran for: 0:02:39.939859
TEST-UNEXPECTED-FAIL | (automation.py) | Browser crashed (minidump found)
Operating system: Linux
                  0.0.0 Linux 2.6.18-53.1.19.el5 #1 SMP Wed May 7 08:20:19 EDT 2008 i686 GNU/Linux
CPU: x86
     GenuineIntel family 13 model 23 stepping 8
     1 CPU

Crash reason:  SIGSEGV
Crash address: 0x408cc65a

Thread 0 (crashed)
 0  libxul.so!NS_NotifyPluginCall(unsigned int) [nsNPAPIPlugin.cpp:5134c1c002de : 238 + 0x6]
    eip = 0x408cc65a   esp = 0xbfe1b150   ebp = 0xbfe1b218   ebx = 0x40dc0ca0
    esi = 0x000003e8   edi = 0x00000000   eax = 0x40c98309   ecx = 0xbfe1b18c
    edx = 0x00000000   efl = 0x00210282
 1  libxul.so!nsNPAPIPlugin::Shutdown() [nsNPAPIPlugin.cpp:5134c1c002de : 743 + 0x12]
    eip = 0x408cc719   esp = 0xbfe1b220   ebp = 0xbfe1b248
 2  libxul.so!nsPluginTag::TryUnloadPlugin(int) [nsPluginHostImpl.cpp:5134c1c002de : 1087 + 0x8]
    eip = 0x408d178c   esp = 0xbfe1b250   ebp = 0xbfe1b268
 3  libxul.so!nsPluginTag::~nsPluginTag() [nsPluginHostImpl.cpp:5134c1c002de : 862 + 0x7]
    eip = 0x408d7885   esp = 0xbfe1b270   ebp = 0xbfe1b298
 4  libxul.so!nsPluginTag::Release() [nsPluginHostImpl.cpp:5134c1c002de : 887 + 0xa]
    eip = 0x408d79b2   esp = 0xbfe1b2a0   ebp = 0xbfe1b2c8
 5  libxul.so!XPCJSRuntime::GCCallback(JSContext*, JSGCStatus) [xpcjsruntime.cpp:5134c1c002de : 780 + 0x7]
    eip = 0x401df104   esp = 0xbfe1b2d0   ebp = 0xbfe1b318
 6  libxul.so!DOMGCCallback(JSContext*, JSGCStatus) [nsJSEnvironment.cpp:5134c1c002de : 3631 + 0x11]
    eip = 0x4060ddd8   esp = 0xbfe1b320   ebp = 0xbfe1b348
 7  libxul.so!XPCCycleCollectGCCallback(JSContext*, JSGCStatus) [nsXPConnect.cpp:5134c1c002de : 411 + 0x16]
    eip = 0x401ca86e   esp = 0xbfe1b350   ebp = 0xbfe1b378
 8  libmozjs.so!js_GC [jsgc.cpp:5134c1c002de : 3788 + 0x8]
    eip = 0x40e34fea   esp = 0xbfe1b380   ebp = 0xbfe1b448
 9  libmozjs.so!JS_GC [jsapi.cpp:5134c1c002de : 2462 + 0x9]
    eip = 0x40e0fb6b   esp = 0xbfe1b450   ebp = 0xbfe1b468
10  libxul.so!nsXPConnect::Collect() [nsXPConnect.cpp:5134c1c002de : 477 + 0x4]
    eip = 0x401c7f25   esp = 0xbfe1b470   ebp = 0xbfe1b528
11  libxul.so!nsCycleCollector::Collect(unsigned int) [nsCycleCollector.cpp:5134c1c002de : 2340 + 0x8]
    eip = 0x40a912e0   esp = 0xbfe1b530   ebp = 0xbfe1f3e8
12  libxul.so!nsCycleCollector_shutdown() [nsCycleCollector.cpp:5134c1c002de : 2559 + 0x9]
    eip = 0x40a913ec   esp = 0xbfe1f3f0   ebp = 0xbfe1f408
13  libxul.so!NS_ShutdownXPCOM_P [nsXPComInit.cpp:5134c1c002de : 824 + 0x4]
    eip = 0x40a5661e   esp = 0xbfe1f410   ebp = 0xbfe1f448
14  libxul.so!ScopedXPCOMStartup::~ScopedXPCOMStartup() [nsAppRunner.cpp:5134c1c002de : 951 + 0x7]
    eip = 0x401b1d25   esp = 0xbfe1f450   ebp = 0xbfe1f488
15  libxul.so!XRE_main [nsAppRunner.cpp:5134c1c002de : 3341 + 0xb]
    eip = 0x401b4e30   esp = 0xbfe1f490   ebp = 0xbfe1faa8
16  firefox-bin!main [nsBrowserApp.cpp:5134c1c002de : 156 + 0xe]
    eip = 0x080495b1   esp = 0xbfe1fab0   ebp = 0xbfe1fb08
17  libc-2.5.so + 0x15deb
    eip = 0x00aa6dec   esp = 0xbfe1fb10   ebp = 0xbfe1fb78


http://tinderbox.mozilla.org/showlog.cgi?tree=Firefox3.5&errorparser=unittest&logfile=1242846711.1242852233.28942.gz&buildtime=1242846711&buildname=Linux%20mozilla-1.9.1%20unit%20test&fulltext=1
(Reporter)

Updated

9 years ago
Whiteboard: [orange]
(Reporter)

Comment 1

9 years ago
we had three of these in a row and then they cleared up.
(Assignee)

Updated

9 years ago
Keywords: crash
(Assignee)

Updated

9 years ago
Blocks: 438871
(Assignee)

Comment 6

9 years ago
I wonder:

Why is the plugin not unloaded (or cycles collected) before NS_ShutdownXPCOM_P is called?

For how long (after NS_ShutdownXPCOM_P is called) will do_GetService("@mozilla.org/observer-service;1") return non-NULL?
(Assignee)

Comment 7

9 years ago
Could doing less GC on shutdown have triggered a latent bug here?

I don't know why this would be only happening on 1.9.1 though.
Blocks: 490592
(Assignee)

Updated

9 years ago
Summary: Crash on tinderbox shortly after plugin tests run → Crash @NS_NotifyPluginCall on tinderbox shortly after plugin tests run
(Assignee)

Comment 8

9 years ago
Similar crash reports with Firefox 3.6a1pre on Windows.
Timing seems close to trunk landing of bug 490592.

bp-792571ce-33e7-4167-bc30-f29532090519
bp-f4c67901-dc36-4f37-96f3-181ca2090516
bp-edb6a467-32a1-4189-8ad2-d91e42090515
Version: 1.9.1 Branch → Trunk
(Assignee)

Updated

9 years ago
OS: Linux → All
(Assignee)

Updated

9 years ago
Flags: wanted1.9.1?
(Assignee)

Comment 9

9 years ago
Created attachment 379084 [details] [diff] [review]
null check do_GetService("@mozilla.org/observer-service;1")

This is the simple fix, provided there aren't other assumptions elsewhere about do_GetService() succeeding during NS_ShutdownXPCOM_P().
Assignee: nobody → mozbugz
Attachment #379084 - Flags: review?(jst)
Attachment #379084 - Flags: approval1.9.1?
(In reply to comment #7)
> Could doing less GC on shutdown have triggered a latent bug here?

Could be (but there's probably other ways to trigger this bug).

> I don't know why this would be only happening on 1.9.1 though.

Cycles might be different, we might be collecting sooner due to patches that haven't been ported, ...
There are a bunch of these on 3.0.x too.
Flags: wanted1.9.0.x?
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1243015194.1243022422.25301.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 10:59:54
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1243019550.1243024546.30447.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 12:12:30

These two logs from earlier this morning also look related, though the crash is at a slightly different place:
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242982693.1242987423.15260.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 01:58:13
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1242983451.1242988175.16386.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 02:10:51

Updated

9 years ago
Attachment #379084 - Flags: superreview+
Attachment #379084 - Flags: review?(jst)
Attachment #379084 - Flags: review+
Attachment #379084 - Flags: approval1.9.1?
Attachment #379084 - Flags: approval1.9.1+
Comment on attachment 379084 [details] [diff] [review]
null check do_GetService("@mozilla.org/observer-service;1")

I'd be fine with taking this for 1.9.1, simple null check.
(Assignee)

Updated

9 years ago
Keywords: checkin-needed
Whiteboard: [orange] → [orange][needs landing trunk and 191]
Fixed on trunk and branch.

http://hg.mozilla.org/mozilla-central/rev/87f97a1a89eb
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d657c16d21e5
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Keywords: fixed1.9.1
Resolution: --- → FIXED
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox3.5/1243030385.1243034979.18583.gz
Linux mozilla-1.9.1 unit test on 2009/05/22 15:13:05

(note this was in a build that started before the fix landed in comment 14)
(Assignee)

Updated

9 years ago
Keywords: checkin-needed
Whiteboard: [orange][needs landing trunk and 191] → [orange]
Keywords: intermittent-failure
Whiteboard: [orange]
Flags: wanted1.9.0.x?
You need to log in before you can comment on or make changes to this bug.