611810 - Intermittent crash [@ JS_XDRString] in test_csp_redirects.html

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Marco Bonardo [:mak]]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1289594186.1289594376.22954.gz
Rev3 Fedora 12x64 mozilla-central opt test mochitests-1/5 on 2010/11/12 12:36:26

TEST-UNEXPECTED-FAIL | /tests/content/base/test/test_csp_redirects.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:01:19.724904
INFO | automation.py | Reading PID log: /tmp/tmpwaQDO6pidlog
==> process 2019 launched child process 2069
INFO | automation.py | Checking for orphan process with PID: 2069
PROCESS-CRASH | /tests/content/base/test/test_csp_redirects.html | application crashed (minidump found)
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGSEGV
Crash address: 0x7f9828300000

Thread 0 (crashed)
 0  libxul.so!JS_XDRString [jsxdrapi.cpp:83ef401a4f25 : 435 + 0x0]
    rbx = 0x827c1d90   r12 = 0x1f88a3d0   r13 = 0x27c1d8d0   r14 = 0x00000000
    r15 = 0x71d2af90   rip = 0x4911a7a5   rsp = 0x71d2af10   rbp = 0x04f83b20
    Found by: given as instruction pointer in context
 1  libxul.so!js_XDRRegExpObject [jsregexp.cpp:83ef401a4f25 : 492 + 0xc]
    rbx = 0x00000000   r12 = 0x1f88a3d0   r13 = 0x2068b260   r14 = 0x00000000
    r15 = 0x28cbe400   rip = 0x490d590a   rsp = 0x71d2af60   rbp = 0x1f88a3d0
    Found by: call frame info
 2  libxul.so!js_XDRScript [jsscript.cpp:83ef401a4f25 : 412 + 0x17]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x2068b260   r14 = 0x00000000
    r15 = 0x28cbe400   rip = 0x490ebb0f   rsp = 0x71d2afe0   rbp = 0x1f88a3d0
    Found by: call frame info
 3  libxul.so!JS_XDRScript [jsxdrapi.cpp:83ef401a4f25 : 672 + 0x4]
    rbx = 0x1f88a3d0   r12 = 0x49cec3e0   r13 = 0x28cbe400   r14 = 0x25e8cd00
    r15 = 0x489d18fc   rip = 0x49119fe0   rsp = 0x71d2b0f0   rbp = 0x71d2b118
    Found by: call frame info
 4  libxul.so!js_CloneScript [jsscript.cpp:83ef401a4f25 : 1689 + 0x13]
    rbx = 0x1f88a3d0   r12 = 0x49cec3e0   r13 = 0x28cbe400   r14 = 0x25e8cd00
    r15 = 0x489d18fc   rip = 0x490ebf3f   rsp = 0x71d2b110   rbp = 0x29329f60
    Found by: call frame info
 5  libxul.so!js_CloneFunctionObject [jsfun.cpp:83ef401a4f25 : 2873 + 0x7]
    rbx = 0x27c58a80   r12 = 0x28cbe400   r13 = 0x49d04900   r14 = 0x25e8cd00
    r15 = 0x27c58a80   rip = 0x49050d38   rsp = 0x71d2b170   rbp = 0x29329f60
    Found by: call frame info
 6  libxul.so!JS_CloneFunctionObject [jsfun.h:83ef401a4f25 : 517 + 0x12]
    rbx = 0x25e8cd00   r12 = 0x00000000   r13 = 0x28cbe400   r14 = 0x27c4b108
    r15 = 0x28230b00   rip = 0x48ff94ff   rsp = 0x71d2b1c0   rbp = 0x2978d7e0
    Found by: call frame info
 7  libxul.so!nsXBLProtoImplProperty::InstallMember [nsXBLProtoImplProperty.cpp:83ef401a4f25 : 185 + 0xf]
    rbx = 0x8007000e   r12 = 0x28cbe400   r13 = 0x29870190   r14 = 0x27c4b108
    r15 = 0x28230b00   rip = 0x488ca0b8   rsp = 0x71d2b220   rbp = 0x2978d7e0
    Found by: call frame info
 8  libxul.so!nsXBLProtoImpl::InstallImplementation [nsXBLProtoImpl.cpp:83ef401a4f25 : 90 + 0x1c]
    rbx = 0x29870190   r12 = 0x28cbe400   r13 = 0x000000b9   r14 = 0x270b8400
    r15 = 0x28230b00   rip = 0x488cbd72   rsp = 0x71d2b290   rbp = 0x2986d240
    Found by: call frame info
 9  libxul.so!nsXBLService::LoadBindings [nsXBLService.cpp:83ef401a4f25 : 647 + 0xc]
    rbx = 0x298bd580   r12 = 0x00000000   r13 = 0x270b8400   r14 = 0x27021820
    r15 = 0x28230b00   rip = 0x488d14d1   rsp = 0x71d2b2f0   rbp = 0x00000000
    Found by: call frame info
10  libxul.so!nsElementSH::PostCreate [nsDOMClassInfo.cpp:83ef401a4f25 : 7845 + 0x27]
    rbx = 0x80040111   r12 = 0x00000000   r13 = 0x270b8408   r14 = 0x46617a50
    r15 = 0x2d5d90d0   rip = 0x48921e94   rsp = 0x71d2b510   rbp = 0x270b8400
    Found by: call frame info
11  libxul.so!FinishCreate [xpcwrappednative.cpp:83ef401a4f25 : 672 + 0x15]
    rbx = 0x71d2c250   r12 = 0x00000000   r13 = 0x270b8408   r14 = 0x46617a50
    r15 = 0x2d5d90d0   rip = 0x48b8e64d   rsp = 0x71d2b590   rbp = 0x3afd0460
    Found by: call frame info
12  libxul.so!XPCWrappedNative::GetNewOrUsed [xpcwrappednative.cpp:83ef401a4f25 : 602 + 0x21]
    rbx = 0x3afd0460   r12 = 0x71d2c250   r13 = 0x71d2b890   r14 = 0x270b8400
    r15 = 0x36b78800   rip = 0x48b904d2   rsp = 0x71d2b5f0   rbp = 0x29886ac0
    Found by: call frame info
13  libxul.so!XPCConvert::NativeInterface2JSObject [xpcconvert.cpp:83ef401a4f25 : 1290 + 0x21]
    rbx = 0x71d2c250   r12 = 0x71d2bbf0   r13 = 0x00000000   r14 = 0x28cbe400
    r15 = 0x71d2b890   rip = 0x48b78acb   rsp = 0x71d2b790   rbp = 0x270b8408
    Found by: call frame info
14  libxul.so!XPCConvert::NativeData2JS [xpcconvert.cpp:83ef401a4f25 : 490 + 0x3b]
    rbx = 0x71d2b890   r12 = 0x71d2c138   r13 = 0x28cbe400   r14 = 0x71d2be70
    r15 = 0x71d2be90   rip = 0x48b7a998   rsp = 0x71d2b850   rbp = 0x71d2bbf0
    Found by: call frame info
15  libxul.so!XPCWrappedNative::CallMethod [xpcprivate.h:83ef401a4f25 : 3248 + 0x8]
    rbx = 0x00000000   r12 = 0x00000003   r13 = 0x00000000   r14 = 0x71d2ba12
    r15 = 0x00000018   rip = 0x48b8d509   rsp = 0x71d2b920   rbp = 0x00000003
    Found by: call frame info
16  libxul.so!XPC_WN_CallMethod [xpcwrappednativejsops.cpp:83ef401a4f25 : 1589 + 0x9]
    rbx = 0x71d2c250   r12 = 0x29767318   r13 = 0x3b0fd130   r14 = 0x27c55f00
    r15 = 0x00000003   rip = 0x48b95800   rsp = 0x71d2c230   rbp = 0x28cbe400
    Found by: call frame info
17  libxul.so!CallCompiler::generateNativeStub [jscntxtinlines.h:83ef401a4f25 : 684 + 0xa]
    rbx = 0x71d2c9a0   r12 = 0x27c55f00   r13 = 0x27c55f00   r14 = 0xffffffff
    r15 = 0x27c55f00   rip = 0x491d6ab7   rsp = 0x71d2c390   rbp = 0x71d2c950
    Found by: call frame info
18  libxul.so!js::mjit::ic::NativeCall [MonoIC.cpp:83ef401a4f25 : 851 + 0x4]
    rbx = 0x71d2c9a0   r12 = 0x27c55f00   r13 = 0x00000000   r14 = 0xffffffff
    r15 = 0x27c55f00   rip = 0x491d2ae6   rsp = 0x71d2c950   rbp = 0x29890570
    Found by: call frame info
19  0x7f9828379363
    rbx = 0x3b0fd0b8   r12 = 0x27c55f00   r13 = 0x00000000   r14 = 0xffffffff
    r15 = 0x27c55f00   rip = 0x28379364   rsp = 0x71d2c9a0   rbp = 0x71d2ca20
    Found by: call frame info

Comment 1

[Phil Ringnalda (:philor)]

Missed its mark and wound up in bug 561449:

surkov.alexander%gmail.com
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1289590144.1289590336.4871.gz
Rev3 Fedora 12x64 mozilla-central opt test mochitests-1/5 on 2010/11/12
11:29:04

s: talos-r3-fed64-006
TEST-UNEXPECTED-FAIL | /tests/content/base/test/test_csp_redirects.html |
Exited with code 1 during test run
PROCESS-CRASH | /tests/content/base/test/test_csp_redirects.html | application
crashed (minidump found)
Thread 0 (crashed)

Comment 2

[Legacy TBPL/Treeherder Robot]

dao%mozilla.com
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1289649999.1289650169.2373.gz
Rev3 Fedora 12x64 mozilla-central opt test mochitests-1/5 on 2010/11/13 04:06:39

s: talos-r3-fed64-036
TEST-UNEXPECTED-FAIL | /tests/content/base/test/test_csp_redirects.html | Exited with code 1 during test run
PROCESS-CRASH | /tests/content/base/test/test_csp_redirects.html | application crashed (minidump found)
Thread 0 (crashed)

Comment 3

[Legacy TBPL/Treeherder Robot]

blassey%mozilla.com
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1295395851.1295396520.25148.gz
Rev3 MacOSX Leopard 10.5.8 mozilla-central debug test mochitests-1/5 on 2011/01/18 16:10:51

s: talos-r3-leopard-024
TEST-UNEXPECTED-FAIL | /tests/content/base/test/test_csp_redirects.html | Exited with code 1 during test run
PROCESS-CRASH | /tests/content/base/test/test_csp_redirects.html | application crashed (minidump found)
Thread 0 (crashed)
TEST-UNEXPECTED-FAIL | automationutils.processLeakLog() | missing output line for total leaks!

Comment 4

[Phil Ringnalda (:philor)]

comment 3 wasn't this, it was a regression, since fixed.

Comment 5

[Ed Morley [:emorley]]

Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that:
* Haven't changed in > 6months
* Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb}
* Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive.

I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases).

Sorry for the spam! Filter on: #FFA500