571225 - Crash in [@ SendSyncMessageToParent]

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Mark Finkle (:mfinkle) (use needinfo?)]

Found this crash in Fennec:

#0  0xb7794832 in ?? () from /lib/ld-linux.so.2
#1  0xb5760a76 in nanosleep () from /lib/tls/i686/cmov/libc.so.6
#2  0xb5760891 in sleep () from /lib/tls/i686/cmov/libc.so.6
#3  0xb5b45dc9 in ah_crap_handler (signum=11) at /home/mfinkle/Source/mozilla-trunk/mozilla/toolkit/xre/nsSigHandlers.cpp:132
#4  0xb5b47e7e in nsProfileLock::FatalSignalHandler (signo=11, info=0xbffb3f8c, context=0xbffb400c) at nsProfileLock.cpp:221
#5  <signal handler called>
#6  0xb6187ff9 in SendSyncMessageToParent (aCallbackData=0x8988c80, aMessage=..., aJSON=..., aJSONRetVal=0xbffb43f0)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/base/src/nsInProcessTabChildGlobal.cpp:63
#7  0xb6185875 in nsFrameMessageManager::SendSyncMessage (this=0x8dfecf8)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/base/src/nsFrameMessageManager.cpp:213
#8  0xb6189c80 in nsInProcessTabChildGlobal::SendSyncMessage (this=0x8988c80)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/base/src/nsInProcessTabChildGlobal.h:73
#9  0xb6e31475 in NS_InvokeByIndex_P () at /home/mfinkle/Source/mozilla-trunk/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
#10 0xb6854d55 in CallMethodHelper::Invoke (this=0xbffb4534) at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2983
#11 0xb685303e in CallMethodHelper::Call (this=0xbffb4534) at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2308
#12 0xb684ef62 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2272
#13 0xb685ef94 in XPC_WN_CallMethod (cx=0x93db288, obj=0xac78cc80, argc=2, argv=0xb2b4b090, vp=0xb2b4b0dc)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1789
#14 0xb546589a in js_Invoke (cx=0x93db288, args=..., flags=2) at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/jsinterp.cpp:654
#15 0xb545386c in js_Interpret (cx=0x93db288) at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/jsops.cpp:2156
#16 0xb5465923 in js_Invoke (cx=0x93db288, args=..., flags=0) at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/jsinterp.cpp:664
#17 0xb6846db3 in nsXPCWrappedJSClass::CallMethod (this=0x88bde38, wrapper=0x91baf88, methodIndex=3, info=0x8877758, nativeParams=0xbffb5170)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1689
#18 0xb683dc4d in nsXPCWrappedJS::CallMethod (this=0x91baf88, methodIndex=3, info=0x8877758, params=0xbffb5170)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:570
#19 0xb6e316f3 in PrepareAndDispatch (methodIndex=3, self=0x962c3e8, args=0xbffb5244)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:95
#20 0xb61b012b in nsEventListenerManager::HandleEventSubType (this=0x8abf6b8, aListenerStruct=0x9141178, aListener=0x962c3e8, aDOMEvent=0x9ad9790, 
    aCurrentTarget=0x8988c80, aPhaseFlags=2, aPusher=0xbffb55e0)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/events/src/nsEventListenerManager.cpp:1094
#21 0xb61b050f in nsEventListenerManager::HandleEventInternal (this=0x8abf6b8, aPresContext=0x94d19e0, aEvent=0x95958d8, aDOMEvent=0xbffb55d0, 
    aCurrentTarget=0x8988c80, aFlags=2, aEventStatus=0xbffb55d4, aPusher=0xbffb55e0)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/events/src/nsEventListenerManager.cpp:1190
#22 0xb61dc972 in nsEventListenerManager::HandleEvent (this=0x8abf6b8, aPresContext=0x94d19e0, aEvent=0x95958d8, aDOMEvent=0xbffb55d0, 
    aCurrentTarget=0x8988c80, aFlags=2, aEventStatus=0xbffb55d4, aPusher=0xbffb55e0)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/events/src/nsEventListenerManager.h:146
#23 0xb61dce34 in nsEventTargetChainItem::HandleEvent (this=0x8aa2e80, aVisitor=..., aFlags=2, aMayHaveNewListenerManagers=0, aPusher=0xbffb55e0)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/events/src/nsEventDispatcher.cpp:212
#24 0xb61dadaa in nsEventTargetChainItem::HandleEventTargetChain (this=0x8aa2e00, aVisitor=..., aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=0, 
    aPusher=0xbffb55e0) at /home/mfinkle/Source/mozilla-trunk/mozilla/content/events/src/nsEventDispatcher.cpp:364
#25 0xb61db930 in nsEventDispatcher::Dispatch (aTarget=0x96242e0, aPresContext=0x94d19e0, aEvent=0x95958d8, aDOMEvent=0x9ad9790, aEventStatus=0xbffb5704, 
    aCallback=0x0, aTargets=0x0) at /home/mfinkle/Source/mozilla-trunk/mozilla/content/events/src/nsEventDispatcher.cpp:628
#26 0xb61dbce8 in nsEventDispatcher::DispatchDOMEvent (aTarget=0x96242e0, aEvent=0x0, aDOMEvent=0x9ad9790, aPresContext=0x94d19e0, aEventStatus=0xbffb5704)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/events/src/nsEventDispatcher.cpp:691
#27 0xb60e6343 in nsDocument::DispatchEvent (this=0x96242e0, aEvent=0x9ad9790, _retval=0xbffb5750)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/base/src/nsDocument.cpp:5974
#28 0xb609ea25 in nsContentUtils::DispatchTrustedEvent (aDoc=0x96242e0, aTarget=0x96242e0, aEventName=..., aCanBubble=1, aCancelable=1, aDefaultAction=0x0)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/content/base/src/nsContentUtils.cpp:3193
#29 0xb60debb9 in nsDocument::DispatchContentLoadedEvents (this=0x96242e0) at /home/mfinkle/Source/mozilla-trunk/mozilla/content/base/src/nsDocument.cpp:3816
#30 0xb60f84a4 in nsRunnableMethodImpl<void (nsDocument::*)(), true>::Run (this=0x985cd38) at ../../../dist/include/nsThreadUtils.h:347
#31 0xb6e148fe in nsThread::ProcessNextEvent (this=0x8645bc8, mayWait=1, result=0xbffb590c)
    at /home/mfinkle/Source/mozilla-trunk/mozilla/xpcom/threads/nsThread.cpp:547
#32 0xb6da90d1 in NS_ProcessNextEvent_P (thread=0x8645bc8, mayWait=1) at nsThreadUtils.cpp:250
#33 0xb6c6ea5e in nsBaseAppShell::Run (this=0x8ba9b70) at /home/mfinkle/Source/mozilla-trunk/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:178
#34 0xb69fcdd9 in nsAppStartup::Run (this=0x85ec9b0) at /home/mfinkle/Source/mozilla-trunk/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:192
#35 0xb5b386b9 in XRE_main (argc=2, argv=0xbffb5fa4, aAppData=0x85d7da8) at /home/mfinkle/Source/mozilla-trunk/mozilla/toolkit/xre/nsAppRunner.cpp:3626
#36 0x08048d3c in main (argc=2, argv=0xbffb5fa4) at /home/mfinkle/Source/mozilla-trunk/mozilla/mobile/app/nsBrowserApp.cpp:146

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

Does this help?

Comment 2

[Mark Finkle (:mfinkle) (use needinfo?)]

(In reply to comment #1)
> Created an attachment (id=450357) [details]
> patch
> 
> Does this help?

Yes it does. No crashes with manual testing and all browser-chrome unit tests are green.

Comment 3

[Mark Finkle (:mfinkle) (use needinfo?)]

Who should review this? It looks fine to me

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/6ea935d3c365