625560 - crash in [@ js_XDRFunctionObject] when calling callMessage on registered receiver

Status: RESOLVED DUPLICATE of bug 660905

(Core :: JavaScript Engine, defect)

Description

[Myk Melez [:myk] [@mykmelez]]

Attachment: patch that exposes the crash

When I change Add-on SDK to pass an unwrapped function to registerReceiver instead of wrapping it with the error module's "catchAndLog" wrapper, and then I run tests with e10s enabled, I get this crash in js_XDRFunctionObject:

http://crash-stats.mozilla.com/report/index/013217a6-4304-473a-ae5b-341bc2110113

The crash is accompanied by the following console messages:

  ###!!! [Child][RPCChannel] Error: Channel error: cannot send/recv
  ###!!! [Child][AsyncChannel] Error: Channel error: cannot send/recv

So far I haven't been able to reduce the test case further.

Steps to Reproduce:

1. Install and activate the SDK.
2. Apply the attached patch.
3. Change to the packages/api-utils/ directory.
4. Do |cfx test -f test-timer.js --e10s|.

Comment 1

[timeless]

Signature	js_XDRFunctionObject
UUID	013217a6-4304-473a-ae5b-341bc2110113
Time 	2011-01-13 10:48:07.339355
Uptime	2
Last Crash	35 seconds before submission
Install Age	91596 seconds (1.1 days) since version was first installed.
Product	Firefox
Version	4.0b10pre
Build ID	20110112033217
Branch	2.0
OS	Linux
OS Version	0.0.0 Linux 2.6.31-22-generic #70-Ubuntu SMP Wed Dec 1 23:51:13 UTC 2010 i686
CPU	x86
CPU Info	GenuineIntel family 6 model 37 stepping 5
Crash Reason	SIGSEGV
Crash Address	0x3a
User Comments	
Processor Notes 	
EMCheckCompatibility	False
Bugzilla - Report this Crash
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	js_XDRFunctionObject 	jsfun.cpp:1839
1 	libxul.so 	js_XDRScript 	jsscript.cpp:701
2 	libxul.so 	JS_XDRScript 	jsxdrapi.cpp:671
3 	libxul.so 	js_CloneScript 	jsscript.cpp:1986
4 	libxul.so 	js_CloneFunctionObject 	jsfun.cpp:2740
5 	libxul.so 	CloneFunctionObject 	jsfun.h:464
6 	libxul.so 	js::Interpret 	jsinterp.cpp:5606
7 	libxul.so 	js::Invoke 	jsinterp.cpp:657
8 	libxul.so 	js_fun_apply 	jsfun.cpp:2181
9 	libxul.so 	js::Interpret 	jscntxtinlines.h:692
10 	libxul.so 	js::Invoke 	jsinterp.cpp:657
11 	libxul.so 	js::ExternalInvoke 	jsinterp.cpp:858
12 	libxul.so 	JS_CallFunctionValue 	jsinterp.h:961
13 	libxul.so 	mozilla::jetpack::JetpackActorCommon::RecvMessage 	JetpackActorCommon.cpp:474
14 	libxul.so 	mozilla::jetpack::JetpackParent::AnswerCallMessage 	JetpackParent.cpp:242

Comment 2

[Andreas Gal :gal]

Looks like a bug in the engine potentially. Why was this not triaged? Thanks for the stack timeless.

Comment 3

[Andreas Gal :gal]

This doesn't apply to jetpack trunk for me (code looks very different).

Comment 4

[Andreas Gal :gal]

Ugh, I was using jetpack-sdk. Looks like trunk moved to projects/addon-sdk. Trying that.

Comment 5

[Andreas Gal :gal]

With my patch in bug 624366 I get a shutdown leak, but no crash. I will try to see if I still crash without the patch.

Comment 6

[Andreas Gal :gal]

Actually I can't get this to crash without the patch either. I am going to need a little help here.

Comment 7

[Andreas Gal :gal]

Ok, I got the crash to happen now. The patch in bug 624366 indeed makes a difference. There I just get this (no crash):

info: An exception occurred in the child Jetpack process.
error: An exception occurred.
Traceback (most recent call last):
  File "/home/gal/workspace/addon-sdk/packages/api-utils/data/bootstrap-remote-process.js", line 140, in null

I asked Myk to confirm that the patch works for him as well.

The crash is real, so we should block on this, but I think we will be able to dup this.

Comment 8

[Andreas Gal :gal]

We are not shipping js/jetpack with FF4, so not blocking on this. Bug 629197 will disable js/jetpack.