Closed Bug 549715 Opened 16 years ago Closed 16 years ago

Crash [@ nsTArray_base::Length()] during smil tests

Categories

(Core :: SVG, defect)

Product:
Core
Component:
SVG
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 554141

People

(Reporter: dholbert, Assigned: birtles)

References

(
URL
)

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test which aborts the suite])

Crash Data

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1267560694.1267564208.8840.gz OS X 10.5.2 mozilla-central debug test mochitests-5/5 on 2010/03/02 12:15:51 s: moz2-darwin9-slave16 { REFTEST INFO | Loading file:///builds/slave/mozilla-central-linux-debug-unittest-reftest/build/reftest/tests/layout/reftests/svg/smil/syncbase/sandwich-priority-6.svg --DOMWINDOW == 51 (0xa4ba3e8) [serial = 9387] [outer = 0x976f458] [url = file:///builds/slave/mozilla-central-linux-debug-unittest-reftest/build/reftest/tests/layout/reftests/svg/smil/syncbase/cycle-ok-1.svg] NEXT ERROR TEST-UNEXPECTED-FAIL | automation.py | Exited with code 11 during test run INFO | automation.py | Application ran for: 0:34:42.417026 INFO | automation.py | Reading PID log: /tmp/tmpA1zbzlpidlog PROCESS-CRASH | automation.py | application crashed (minidump found) Operating system: Linux 0.0.0 Linux 2.6.18-53.1.19.el5 #1 SMP Wed May 7 08:20:19 EDT 2008 i686 CPU: x86 GenuineIntel family 6 model 23 stepping 8 1 CPU Crash reason: SIGSEGV Crash address: 0x54 Thread 0 (crashed) 0 libxul.so!nsTArray_base::Length() const [nsTArray.h : 66 + 0x3] eip = 0x0119cce8 esp = 0xbf9a0968 ebp = 0xbf9a0968 ebx = 0x02c99858 esi = 0x08e51d58 edi = 0x00000000 eax = 0x00000054 ecx = 0x00000000 edx = 0x00000000 efl = 0x00210282 Found by: given as instruction pointer in context 1 libxul.so!int nsTArray<nsRefPtr<nsSMILInstanceTime> >::GreatestIndexLtEq<nsSMILInstanceTime*, nsSMILTimedElement::InstanceTimeComparator>(nsSMILInstanceTime* const&, nsSMILTimedElement::InstanceTimeComparator const&, unsigned int*) const [nsTArray.h : 564 + 0x11] eip = 0x01ecaf29 esp = 0xbf9a0970 ebp = 0xbf9a0998 Found by: previous frame's frame pointer 2 libxul.so!int nsTArray<nsRefPtr<nsSMILInstanceTime> >::RemoveElementSorted<nsSMILInstanceTime*, nsSMILTimedElement::InstanceTimeComparator>(nsSMILInstanceTime* const&, nsSMILTimedElement::InstanceTimeComparator const&) [nsTArray.h : 741 + 0x1f] eip = 0x01ecb106 esp = 0xbf9a09a0 ebp = 0xbf9a09c8 Found by: previous frame's frame pointer 3 libxul.so!nsSMILTimedElement::RemoveInstanceTime(nsSMILInstanceTime*, int) [nsSMILTimedElement.cpp:ed1612a1ffa8 : 331 + 0x18] eip = 0x01ec7b04 esp = 0xbf9a09d0 ebp = 0xbf9a0a08 Found by: previous frame's frame pointer 4 libxul.so!nsSMILTimeValueSpec::HandleDeletedInstanceTime(nsSMILInstanceTime&) [nsSMILTimeValueSpec.cpp:ed1612a1ffa8 : 225 + 0x21] eip = 0x01ecbe4e esp = 0xbf9a0a10 ebp = 0xbf9a0a28 Found by: previous frame's frame pointer 5 libxul.so!nsSMILInstanceTime::HandleDeletedInterval() [nsSMILInstanceTime.cpp:ed1612a1ffa8 : 161 + 0x14] eip = 0x01ebf86b esp = 0xbf9a0a30 ebp = 0xbf9a0a58 Found by: previous frame's frame pointer 6 libxul.so!nsSMILInterval::NotifyDeleting() [nsSMILInterval.cpp:ed1612a1ffa8 : 82 + 0x24] eip = 0x01ec002b esp = 0xbf9a0a60 ebp = 0xbf9a0a78 Found by: previous frame's frame pointer 7 libxul.so!nsSMILTimedElement::~nsSMILTimedElement() [nsSMILTimedElement.cpp:ed1612a1ffa8 : 152 + 0x15] eip = 0x01ec9b2e esp = 0xbf9a0a80 ebp = 0xbf9a0a98 Found by: previous frame's frame pointer 8 libxul.so!nsSVGAnimationElement::~nsSVGAnimationElement() [nsSVGAnimationElement.h:ed1612a1ffa8 : 57 + 0x3c] eip = 0x01eadb55 esp = 0xbf9a0aa0 ebp = 0xbf9a0aa8 Found by: previous frame's frame pointer 9 libxul.so!nsSVGAnimateElement::~nsSVGAnimateElement() [nsSVGAnimateElement.cpp:ed1612a1ffa8 : 46 + 0x58] eip = 0x01eadbf3 esp = 0xbf9a0ab0 ebp = 0xbf9a0ab8 Found by: previous frame's frame pointer 10 libxul.so!nsNodeUtils::LastRelease(nsINode*) [nsNodeUtils.cpp:ed1612a1ffa8 : 274 + 0x17] eip = 0x018a8992 esp = 0xbf9a0ac0 ebp = 0xbf9a0b18 Found by: previous frame's frame pointer 11 libxul.so!nsGenericElement::Release() [nsGenericElement.cpp:ed1612a1ffa8 : 4202 + 0x100] eip = 0x0188a40e esp = 0xbf9a0b20 ebp = 0xbf9a0b58 Found by: previous frame's frame pointer 12 libxul.so!nsSVGElement::Release() [nsSVGElement.cpp:ed1612a1ffa8 : 188 + 0xa] eip = 0x01e29127 esp = 0xbf9a0b60 ebp = 0xbf9a0b88 Found by: previous frame's frame pointer 13 libxul.so!nsSVGAnimationElement::Release() [nsSVGAnimationElement.cpp:ed1612a1ffa8 : 50 + 0xa] eip = 0x01eb0073 esp = 0xbf9a0b90 ebp = 0xbf9a0bb8 Found by: previous frame's frame pointer 14 libxul.so!nsSVGAnimateElement::Release() [nsSVGAnimateElement.cpp:ed1612a1ffa8 : 77 + 0xa] eip = 0x01eace97 esp = 0xbf9a0bc0 ebp = 0xbf9a0be8 Found by: previous frame's frame pointer 15 libxul.so!nsXPCOMCycleCollectionParticipant::Unroot(void*) [nsCycleCollectionParticipant.cpp : 74 + 0x11] eip = 0x024cd192 esp = 0xbf9a0bf0 ebp = 0xbf9a0c08 Found by: previous frame's frame pointer 16 libxul.so!nsCycleCollector::CollectWhite() [nsCycleCollector.cpp:ed1612a1ffa8 : 1868 + 0x20] eip = 0x0255016f esp = 0xbf9a0c10 ebp = 0xbf9a0c48 Found by: previous frame's frame pointer 17 libxul.so!nsCycleCollector::FinishCollection() [nsCycleCollector.cpp:ed1612a1ffa8 : 2716 + 0xa] eip = 0x025501cf esp = 0xbf9a0c50 ebp = 0xbf9a0c68 Found by: previous frame's frame pointer 18 libxul.so!nsCycleCollector_finishCollection() [nsCycleCollector.cpp:ed1612a1ffa8 : 3243 + 0x17] eip = 0x02550252 esp = 0xbf9a0c70 ebp = 0xbf9a0c88 Found by: previous frame's frame pointer 19 libxul.so!_ZL25XPCCycleCollectGCCallbackP9JSContext10JSGCStatus [nsXPConnect.cpp:ed1612a1ffa8 : 405 + 0x4] eip = 0x011e9669 esp = 0xbf9a0c90 ebp = 0xbf9a0cb8 Found by: previous frame's frame pointer 20 libmozjs.so!js_GC [jsgc.cpp:ed1612a1ffa8 : 3383 + 0x12] eip = 0x0031af0d esp = 0xbf9a0cc0 ebp = 0xbf9a0d88 Found by: previous frame's frame pointer 21 libmozjs.so!JS_GC [jsapi.cpp:ed1612a1ffa8 : 2288 + 0x12] eip = 0x002bbca3 esp = 0xbf9a0d90 ebp = 0xbf9a0da8 Found by: previous frame's frame pointer 22 libxul.so!nsXPConnect::Collect() [nsXPConnect.cpp:ed1612a1ffa8 : 479 + 0xa] eip = 0x011e8a1a esp = 0xbf9a0db0 ebp = 0xbf9a0e88 Found by: previous frame's frame pointer 23 libxul.so!nsCycleCollector::Collect(unsigned int) [nsCycleCollector.cpp:ed1612a1ffa8 : 2528 + 0x17] eip = 0x02550bbb esp = 0xbf9a0e90 ebp = 0xbf9a4d58 Found by: previous frame's frame pointer 24 libxul.so!nsCycleCollector_collect() [nsCycleCollector.cpp:ed1612a1ffa8 : 3225 + 0x1f] eip = 0x02550ca6 esp = 0xbf9a4d60 ebp = 0xbf9a4d78 Found by: previous frame's frame pointer 25 libxul.so!nsJSContext::CC() [nsJSEnvironment.cpp:ed1612a1ffa8 : 3549 + 0x4] eip = 0x01afc725 esp = 0xbf9a4d80 ebp = 0xbf9a4d98 Found by: previous frame's frame pointer 26 libxul.so!nsJSContext::IntervalCC() [nsJSEnvironment.cpp:ed1612a1ffa8 : 3637 + 0x4] eip = 0x01afc7bb esp = 0xbf9a4da0 ebp = 0xbf9a4dd8 Found by: previous frame's frame pointer 27 libxul.so!nsJSContext::CCIfUserInactive() [nsJSEnvironment.cpp:ed1612a1ffa8 : 3627 + 0x4] eip = 0x01afc90f esp = 0xbf9a4de0 ebp = 0xbf9a4de8 Found by: previous frame's frame pointer 28 libxul.so!nsJSContext::LoadEnd() [nsJSEnvironment.cpp:ed1612a1ffa8 : 3693 + 0x4] eip = 0x01afcaba esp = 0xbf9a4df0 ebp = 0xbf9a4df8 Found by: previous frame's frame pointer 29 libxul.so!DocumentViewerImpl::LoadComplete(unsigned int) [nsDocumentViewer.cpp:ed1612a1ffa8 : 1076 + 0x4] eip = 0x0155a416 esp = 0xbf9a4e00 ebp = 0xbf9a4e88 Found by: previous frame's frame pointer 30 libxul.so!nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, unsigned int) [nsDocShell.cpp:ed1612a1ffa8 : 5749 + 0x24] eip = 0x01f86bde esp = 0xbf9a4e90 ebp = 0xbf9a5138 Found by: previous frame's frame pointer 31 libxul.so!nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, unsigned int) [nsDocShell.cpp:ed1612a1ffa8 : 5627 + 0x32] eip = 0x01f7c059 esp = 0xbf9a5140 ebp = 0xbf9a51c8 Found by: previous frame's frame pointer 32 libxul.so!nsDocLoader::FireOnStateChange(nsIWebProgress*, nsIRequest*, int, unsigned int) [nsDocLoader.cpp:ed1612a1ffa8 : 1314 + 0x34] eip = 0x01fa95e1 esp = 0xbf9a51d0 ebp = 0xbf9a5268 Found by: previous frame's frame pointer 33 libxul.so!nsDocLoader::doStopDocumentLoad(nsIRequest*, unsigned int) [nsDocLoader.cpp:ed1612a1ffa8 : 926 + 0x2a] eip = 0x01faa0f1 esp = 0xbf9a5270 ebp = 0xbf9a52e8 Found by: previous frame's frame pointer 34 libxul.so!nsDocLoader::DocLoaderIsEmpty(int) [nsDocLoader.cpp:ed1612a1ffa8 : 802 + 0x20] eip = 0x01faa427 esp = 0xbf9a52f0 ebp = 0xbf9a5348 Found by: previous frame's frame pointer 35 libxul.so!nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) [nsDocLoader.cpp:ed1612a1ffa8 : 697 + 0x12] eip = 0x01faab97 esp = 0xbf9a5350 ebp = 0xbf9a5428 Found by: previous frame's frame pointer 36 libxul.so!nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, unsigned int) [nsLoadGroup.cpp:ed1612a1ffa8 : 680 + 0x2d] eip = 0x012fb899 esp = 0xbf9a5430 ebp = 0xbf9a54d8 Found by: previous frame's frame pointer 37 libxul.so!nsDocument::DoUnblockOnload() [nsDocument.cpp:ed1612a1ffa8 : 7089 + 0x3c] eip = 0x01843b4b esp = 0xbf9a54e0 ebp = 0xbf9a5518 Found by: previous frame's frame pointer 38 libxul.so!nsDocument::UnblockOnload(int) [nsDocument.cpp:ed1612a1ffa8 : 7036 + 0xa] eip = 0x01845f0a esp = 0xbf9a5520 ebp = 0xbf9a5548 Found by: previous frame's frame pointer 39 libxul.so!nsDocument::DispatchContentLoadedEvents() [nsDocument.cpp:ed1612a1ffa8 : 4018 + 0x1b] eip = 0x018524d5 esp = 0xbf9a5550 ebp = 0xbf9a55f8 Found by: previous frame's frame pointer 40 libxul.so!nsRunnableMethod<nsDocument, void>::Run() [nsThreadUtils.h : 282 + 0x4e] eip = 0x01861ae6 esp = 0xbf9a5600 ebp = 0xbf9a5618 Found by: previous frame's frame pointer 41 libxul.so!nsThread::ProcessNextEvent(int, int*) [nsThread.cpp:ed1612a1ffa8 : 527 + 0x18] eip = 0x02537c69 esp = 0xbf9a5620 ebp = 0xbf9a5688 Found by: previous frame's frame pointer 42 libxul.so!NS_ProcessNextEvent_P(nsIThread*, int) [nsThreadUtils.cpp : 250 + 0x1f] eip = 0x024cc87c esp = 0xbf9a5690 ebp = 0xbf9a56c8 Found by: previous frame's frame pointer 43 libxul.so!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [MessagePump.cpp:ed1612a1ffa8 : 118 + 0x15] eip = 0x0242f142 esp = 0xbf9a56d0 ebp = 0xbf9a5718 Found by: previous frame's frame pointer 44 libxul.so!MessageLoop::RunInternal() [message_loop.cc:ed1612a1ffa8 : 216 + 0x22] eip = 0x025ae149 esp = 0xbf9a5720 ebp = 0xbf9a5748 Found by: previous frame's frame pointer 45 libxul.so!MessageLoop::RunHandler() [message_loop.cc:ed1612a1ffa8 : 199 + 0xa] eip = 0x025ae16d esp = 0xbf9a5750 ebp = 0xbf9a5758 Found by: previous frame's frame pointer 46 libxul.so!MessageLoop::Run() [message_loop.cc:ed1612a1ffa8 : 173 + 0xa] eip = 0x025ae1f1 esp = 0xbf9a5760 ebp = 0xbf9a5788 Found by: previous frame's frame pointer 47 libxul.so!nsBaseAppShell::Run() [nsBaseAppShell.cpp:ed1612a1ffa8 : 174 + 0xc] eip = 0x022ea244 esp = 0xbf9a5790 ebp = 0xbf9a57c8 Found by: previous frame's frame pointer 48 libxul.so!nsAppStartup::Run() [nsAppStartup.cpp:ed1612a1ffa8 : 183 + 0x1b] eip = 0x0205fa4d esp = 0xbf9a57d0 ebp = 0xbf9a5808 Found by: previous frame's frame pointer 49 libxul.so!XRE_main [nsAppRunner.cpp:ed1612a1ffa8 : 3494 + 0x1b] eip = 0x011b4abc esp = 0xbf9a5810 ebp = 0xbf9a5dc8 Found by: previous frame's frame pointer 50 firefox-bin!main [nsBrowserApp.cpp:ed1612a1ffa8 : 158 + 0x1d] eip = 0x08048e32 esp = 0xbf9a5dd0 ebp = 0xbf9a5e38 Found by: previous frame's frame pointer 51 libc-2.5.so + 0x15deb eip = 0x004c5dec esp = 0xbf9a5e40 ebp = 0xbf9a5ea8 Found by: previous frame's frame pointer 52 firefox-bin + 0x9e0 eip = 0x080489e1 esp = 0xbf9a5eb0 ebp = 0x00000000 Found by: previous frame's frame pointer 53 firefox-bin!_ZL6OutputPKcz [nsBrowserApp.cpp:ed1612a1ffa8 : 77 + 0x5] eip = 0x08048b32 esp = 0xbf9a5eb4 ebp = 0x00000000 Found by: stack scanning 54 firefox-bin!nsGetterAddRefs<nsIServiceManager>::~nsGetterAddRefs() [nsCOMPtr.h:ed1612a1ffa8 : 1335 + 0x1f] eip = 0x0804a5c0 esp = 0xbf9a5ec0 ebp = 0x00000000 Found by: stack scanning 55 firefox-bin!nsGetterAddRefs<nsIServiceManager>::~nsGetterAddRefs() [nsCOMPtr.h:ed1612a1ffa8 : 1335 + 0xf] eip = 0x0804a5b0 esp = 0xbf9a5ec4 ebp = 0x00000000 Found by: stack scanning 56 ld-2.5.so + 0xe2cf eip = 0x00a7d2d0 esp = 0xbf9a5ec8 ebp = 0x00000000 Found by: stack scanning 57 ld-2.5.so + 0x1688a eip = 0x00a8588b esp = 0xbf9a5ed0 ebp = 0x00000000 Found by: stack scanning }
Looks like regression from bug 537361 (which landed yesterday) -- crash is inside of nsSMILInterval::NotifyDeleting, which was added in that bug's patch.
Blocks: 537361
Summary: Crash @ [nsTArray_base::Length()] during smil/syncbase/sandwich-priority-6.svg → Crash [@ nsTArray_base::Length()] during smil/syncbase/sandwich-priority-6.svg
Here's a pruned version of the stack: >Crash reason: SIGSEGV >Crash address: 0x0 > >Thread 0 (crashed) > 0 libxul.so!nsTArray_base::Length() const [nsTArray.h : 66 + 0x5] > 1 libxul.so!int nsTArray<nsRefPtr<nsSMILInstanceTime> >::GreatestIndexLtEq > 2 libxul.so!int nsTArray<nsRefPtr<nsSMILInstanceTime> >::RemoveElementSorted > 3 libxul.so!nsSMILTimedElement::RemoveInstanceTime(nsSMILInstanceTime*, int) [nsSMILTimedElement.cpp:f8dd7b5b02ef : 331 + 0x18] > 4 libxul.so!nsSMILTimeValueSpec::HandleDeletedInstanceTime(nsSMILInstanceTime&) [nsSMILTimeValueSpec.cpp:f8dd7b5b02ef : 225 + 0x21] > 5 libxul.so!nsSMILInstanceTime::HandleDeletedInterval() [nsSMILInstanceTime.cpp:f8dd7b5b02ef : 161 + 0x14] > 6 libxul.so!nsSMILInterval::NotifyDeleting() [nsSMILInterval.cpp:f8dd7b5b02ef : 82 + 0x24] > 7 libxul.so!nsSMILTimedElement::~nsSMILTimedElement() [nsSMILTimedElement.cpp:f8dd7b5b02ef : 152 + 0x15] If I understand correctly, it looks like nsTArray::mHdr is a null pointer. I'm not exactly sure how that happens... Here's the setup: (a) We enter nsSMILTimedElement::~nsSMILTimedElement() (b) Early on in that destructor, we call Clear() on the two member-nsTArrays, which ends up indirectly setting their mHdr->mLength values to 0 and then calling ShrinkCapacity() to just point mHdr to be sEmptyHdr. (c) Later, the destructor calls NotifyDeleting, which makes us come back around to remove instance-times (if they're present) from nsSMILTimedElement's nsTArrays. (d) Then we try to look up the array-lengths, and we have a null mHdr pointer somehow.
In anim-discrete-replace-sum-1.svg: http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268186591.1268190796.15259.gz Linux mozilla-central debug test reftest on 2010/03/09 18:03:11 s: moz2-linux-slave08
Summary: Crash [@ nsTArray_base::Length()] during smil/syncbase/sandwich-priority-6.svg → Crash [@ nsTArray_base::Length()] during smil/syncbase/sandwich-priority-6.svg, anim-discrete-replace-sum-1.svg
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268253727.1268256352.17924.gz Linux mozilla-central debug test mochitests-1/5 on 2010/03/10 12:42:07 s: moz2-linux-slave05 This one was during mochitest "test_smilTextZoom.xhtml". I'm going to try to catch this in VM record+replay...
Assignee: nobody → dholbert
Summary: Crash [@ nsTArray_base::Length()] during smil/syncbase/sandwich-priority-6.svg, anim-discrete-replace-sum-1.svg → Crash [@ nsTArray_base::Length()] during smil reftests
Summary: Crash [@ nsTArray_base::Length()] during smil reftests → Crash [@ nsTArray_base::Length()] during smil tests
see also bug 551549, which looks like the same bug except in an optimized build. It places the crash in nsSMILTimedElement::RemoveInstanceTime.
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268492220.1268494573.9795.gz Linux mozilla-central debug test mochitests-1/5 on 2010/03/13 06:57:00 s: moz2-linux-slave24 49338 INFO Running /tests/content/smil/test/test_smilTimingZeroIntervals.xhtml...
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268468462.1268470109.24320.gz Linux mozilla-central debug test mochitests-1/5 on 2010/03/13 00:21:02 s: moz2-linux-slave06 49453 INFO Running /tests/content/smil/test/test_smilUpdatedInterval.xhtml...
I tried recording this in vmware, but the tests ran 500+ times without failing.
Thanks bent! (for the record, that was with mochitests, since vmware record+replay works better with those) I've also been running layout/reftests/svg/smil/reftest.list in an infinite loop on on my (non-VM) machine for the last ~18 hours, trying to catch a crash in a debugger... nothing yet. I'm gonna leave it going for a few days and see what happens.
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268959914.1268962628.5024.gz Linux mozilla-central debug test reftest on 2010/03/18 17:51:54 Crash happened after loading (but before passing) sandwich-priority-1.svg -- we apparently trigger a GC, get rid of the DOMWINDOW for changed-interval-resolved-2.svg, and die. In other news, no crashes yet on my infinite-loop SMIL reftests run (noted in previous comment)... I've got 2 reftest processes running, and they've had a combined total of 300 cycles through reftests/svg/smil so far, with no crashes.
FWIW, the last DOMWindow to be GC'd right before the crash on the other logs reported here so far were (in order of log-posting, I think): reftests/svg/smil/syncbase/cycle-ok-1.svg tests/content/smil/test/test_smilGetStartTime.xhtml reftests/svg/smil/syncbase/cycle-self-ref-3.svg tests/content/smil/test/test_smilKeySplines.xhtml tests/content/smil/test/test_smilKeySplines.xhtml tests/content/smil/test/test_smilReset.xhtml] For reftests, in all three cases the last test-file to be GC'd was a syncbase-timing-specific test. (not so for mochitests, though)
Depends on: 554141
Bug 554141 has something of a testcase, and crashes with a similar stack. Let's fix that and see if this orange goes away.
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1270167418.1270169228.16510.gz Linux mozilla-central debug test reftest on 2010/04/01 17:16:58 s: moz2-linux-slave18
I wonder if this and the related crashes are threading bugs. We should really do large scale automated race detection on Fx in the same way we do large scale automated memory-error detection.
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1270604743.1270607305.1722.gz Linux mozilla-central debug test reftest on 2010/04/06 18:45:43 s: moz2-linux-slave12
(In reply to comment #15) > I wonder if this and the related crashes are threading bugs. > We should really do large scale automated race detection on Fx in > the same way we do large scale automated memory-error detection. If you file a bug for that (and I think you probably should), please cc me; I'm curious to know what that would look like.
(In reply to comment #17) > If you file a bug for that (and I think you probably should), please cc me; I'm > curious to know what that would look like. I did already and have been working through what I'm finding. It's bug 551155. Still a way to go though -- I don't even have a complete triage of all the races reported for "start browser, wait for blank page, quit browser".
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1270715422.1270717897.6183.gz Linux mozilla-central debug test reftest on 2010/04/08 01:30:22 s: moz2-linux-slave13
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1270775525.1270776828.24005.gz OS X 10.5.2 mozilla-central debug test reftest on 2010/04/08 18:12:05 s: bm-xserve09
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1270938802.1270941174.12876.gz Linux mozilla-central debug test reftest on 2010/04/10 15:33:22 s: moz2-linux-slave14
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1271017138.1271018274.15459.gz Linux mozilla-central debug test reftest on 2010/04/11 13:18:58 s: mv-moz2-linux-ix-slave09
(In reply to comment #13) > Bug 554141 has something of a testcase, and crashes with a similar stack. > Let's fix that and see if this orange goes away. Seconded. I'm pretty sure bug 554141 and bug 557187 are the same as this one, but 554141 is the best lead.
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1271600779.1271602890.7014.gz Linux mozilla-central debug test reftest on 2010/04/18 07:26:19 s: moz2-linux-slave10
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1271931201.1271942149.28765.gz Rev3 MacOSX Leopard 10.5.8 mozilla-central debug test reftest on 2010/04/22 03:13:21 s: talos-r3-leopard-035
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1272834469.1272835611.13749.gz Linux mozilla-central debug test reftest on 2010/05/02 14:07:49 s: mv-moz2-linux-ix-slave04
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1272843501.1272845316.2989.gz Rev3 MacOSX Leopard 10.5.8 mozilla-central debug test reftest on 2010/05/02 16:38:21 s: talos-r3-leopard-006
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1272947981.1272949864.4226.gz Rev3 MacOSX Leopard 10.5.8 mozilla-central debug test reftest on 2010/05/03 21:39:41 s: talos-r3-leopard-007
Assignee: dholbert → birtles
dveditz: bug 554141 comment 1 has a test case.
Can someone cc me on bug 554141 please?
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1273078392.1273079584.31025.gz Linux mozilla-central debug test reftest on 2010/05/05 09:53:12 s: mv-moz2-linux-ix-slave02
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1273167473.1273169188.30072.gz Linux mozilla-central debug test reftest on 2010/05/06 10:37:53 s: moz2-linux-slave16
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1273188428.1273190932.1702.gz Linux mozilla-central debug test reftest on 2010/05/06 16:27:08 s: moz2-linux-slave10
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1274175581.1274177286.10623.gz Linux mozilla-central debug test reftest on 2010/05/18 02:39:41 s: moz2-linux-slave26
This may be fixed by check in for bug 554141 (http://hg.mozilla.org/mozilla-central/rev/39b66ca816a3). If there aren't any more instances of this in the next couple of weeks (not including the next couple of hours) then I'll mark this as a dupe of bug 554141.
Status: NEW → ASSIGNED
This was happening pretty consistently before the check in for bug 554141 and hasn't happened again since so I'm pretty confident it's fixed.
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ nsTArray_base::Length()]
Whiteboard: [orange][test which aborts the suite] → [test which aborts the suite]
You need to log in before you can comment on or make changes to this bug.