Closed Bug 635480 Opened 15 years ago Closed 13 years ago

intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js or browser_updatessl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports][@nsXPCWrappedJS::cycleCollection::Traverse]

Categories

(Core :: XPCOM, defect)

Product:
Core
Component:
XPCOM
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
status2.0 --- ?

People

(Reporter: mak, Unassigned)

References

Details

(Keywords: intermittent-failure)

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1298105028.1298108002.21186.gz Rev3 MacOSX Leopard 10.5.8 mozilla-central debug test mochitest-other on 2011/02/19 00:43:48 on changeset http://hg.mozilla.org/mozilla-central/rev/657c2a92ee2b Thread 2 (crashed) 0 XUL!nsSVGMarkerElement::SetOrientToAngle [nsSVGMarkerElement.cpp:657c2a92ee2b : 223 + 0x8] eip = 0x0368278b esp = 0xb0102b30 ebp = 0xb0102b78 ebx = 0x03682770 esi = 0x03809432 edi = 0x00000000 eax = 0xc61eac24 ecx = 0x2fc3e6a8 edx = 0x0368275a efl = 0x00010286 Found by: given as instruction pointer in context 1 XUL!nsXPCOMCycleCollectionParticipant::CheckForRightISupports [nsCycleCollectionParticipant.cpp : 101 + 0x1f] eip = 0x03f91a7f esp = 0xb0102b80 ebp = 0xb0102ba8 ebx = 0x03f91a5e esi = 0x03809432 edi = 0x00000000 Found by: call frame info 2 XUL!nsXPCWrappedJS::cycleCollection::Traverse [xpcwrappedjs.cpp:657c2a92ee2b : 58 + 0x11] eip = 0x0380945b esp = 0xb0102bb0 ebp = 0xb0102c48 ebx = 0x03809442 esi = 0x03809432 edi = 0x00000000 Found by: call frame info 3 XUL!GCGraphBuilder::Traverse [nsCycleCollector.cpp:657c2a92ee2b : 1523 + 0x24] eip = 0x0402577e esp = 0xb0102c50 ebp = 0xb0102c78 ebx = 0x0402572b esi = 0x03809432 edi = 0x00000000 Found by: call frame info 4 XUL!nsCycleCollector::MarkRoots [nsCycleCollector.cpp:657c2a92ee2b : 1764 + 0x11] eip = 0x0402581c esp = 0xb0102c80 ebp = 0xb0102cb8 ebx = 0x04028bc3 esi = 0x00000000 edi = 0x00000000 Found by: call frame info 5 XUL!nsCycleCollector::BeginCollection [nsCycleCollector.cpp:657c2a92ee2b : 2633 + 0x14] eip = 0x040259c3 esp = 0xb0102cc0 ebp = 0xb0102d88 ebx = 0x04028bc3 esi = 0x00000000 edi = 0x00000000 Found by: call frame info 6 XUL!nsCycleCollectorRunner::Run [nsCycleCollector.cpp:657c2a92ee2b : 3318 + 0x1f] eip = 0x04028ccb esp = 0xb0102d90 ebp = 0xb0102dd8 ebx = 0x04028bc3 esi = 0x00000000 edi = 0x00000000 Found by: call frame info 7 XUL!nsThread::ProcessNextEvent [nsThread.cpp:657c2a92ee2b : 633 + 0x18] eip = 0x0400acfe esp = 0xb0102de0 ebp = 0xb0102e88 ebx = 0x0400a980 esi = 0x00000000 edi = 0x00000000 Found by: call frame info 8 XUL!NS_ProcessNextEvent_P [nsThreadUtils.cpp : 250 + 0x1f] eip = 0x03f91108 esp = 0xb0102e90 ebp = 0xb0102ed8 ebx = 0x03f91092 esi = 0x00000000 edi = 0x00000000 Found by: call frame info 9 XUL!nsThread::ThreadFunc [nsThread.cpp:657c2a92ee2b : 278 + 0x12] eip = 0x0400b825 esp = 0xb0102ee0 ebp = 0xb0102f48 ebx = 0x0400b72b esi = 0x00000000 edi = 0x00000000 Found by: call frame info 10 libnspr4.dylib!_pt_root [ptthread.c:657c2a92ee2b : 187 + 0x10] eip = 0x0006ec19 esp = 0xb0102f50 ebp = 0xb0102f78 ebx = 0x0006eb03 esi = 0xb0103000 edi = 0x00000000 Found by: call frame info 11 libSystem.B.dylib + 0x32154 eip = 0x927d2155 esp = 0xb0102f80 ebp = 0xb0102fc8 ebx = 0x927d2028 esi = 0xb0103000 edi = 0x00000000 Found by: call frame info 12 libSystem.B.dylib + 0x32011 eip = 0x927d2012 esp = 0xb0102fd0 ebp = 0xb0102fec Found by: previous frame's frame pointer
Summary: intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js [@nsSVGMarkerElement::SetOrientToAngle] → intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports]
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1298594074.1298597942.2073.gz&fulltext=1 Rev3 WINNT 6.1 mozilla-central debug test mochitest-other on 2011/02/24 16:34:34 s: talos-r3-w7-012 TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/mozapps/extensions/test/browser/browser_updatessl.js | Exited with code -1073741819 during test run PROCESS-CRASH | chrome://mochitests/content/browser/toolkit/mozapps/extensions/test/browser/browser_updatessl.js | application crashed (minidump found)
Summary: intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports] → intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js or browser_updatessl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports]
comment 8 is: Crash reason: EXCEPTION_ACCESS_VIOLATION_READ Crash address: 0x8 Assertion: Unknown assertion type 0x00000000 Thread 0 (crashed) 0 mozjs.dll!js::ctypes::ConvertToJS(JSContext *,JSObject *,JSObject *,void *,bool,bool,jsval_layout *) [typedefs.h:e8facc64c88e : 107 + 0x3] eip = 0x6d9397fc esp = 0x00238a88 ebp = 0x00238c80 ebx = 0x00000001 esi = 0x005b8aa0 edi = 0x00000000 eax = 0x00000004 ecx = 0x00000008 edx = 0x00000004 efl = 0x00010283 Found by: given as instruction pointer in context 1 mozjs.dll!js::ctypes::PointerType::ContentsGetter [CTypes.cpp:e8facc64c88e : 3393 + 0x1a] eip = 0x6d94107f esp = 0x00238c88 ebp = 0x00238cb8 Found by: call frame info 2 mozjs.dll!js::CallJSPropertyOp(JSContext *,int (*)(JSContext *,JSObject *,jsid,js::Value *),JSObject *,jsid,js::Value *) [jscntxtinlines.h:e8facc64c88e : 750 + 0x12] eip = 0x6d73ac95 esp = 0x00238cc0 ebp = 0x00238cd4 Found by: call frame info 3 mozjs.dll!js::Shape::get(JSContext *,JSObject *,JSObject *,JSObject *,js::Value *) [jsscopeinlines.h:e8facc64c88e : 263 + 0x50] eip = 0x6d742dc8 esp = 0x00238cdc ebp = 0x00238d04 Found by: call frame info 4 mozjs.dll!js_NativeGetInline [jsobj.cpp:e8facc64c88e : 5251 + 0x1b] eip = 0x6d742aff esp = 0x00238d0c ebp = 0x00238d60 Found by: call frame info 5 mozjs.dll!js_GetPropertyHelperWithShapeInline [jsobj.cpp:e8facc64c88e : 5436 + 0x20] eip = 0x6d743725 esp = 0x00238d68 ebp = 0x00238db8 Found by: call frame info 6 mozjs.dll!js_GetPropertyHelperInline [jsobj.cpp:e8facc64c88e : 5457 + 0x24] eip = 0x6d7438bb esp = 0x00238dc0 ebp = 0x00238de8 Found by: call frame info 7 mozjs.dll!js_GetPropertyHelper(JSContext *,JSObject *,jsid,unsigned int,js::Value *) [jsobj.cpp:e8facc64c88e : 5463 + 0x1c] eip = 0x6d743880 esp = 0x00238df0 ebp = 0x00238e08 Found by: call frame info ...
Summary: intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js or browser_updatessl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports] → intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js or browser_updatessl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports][@nsXPCWrappedJS::cycleCollection::Traverse]
Don't believe that this is an add-ons manager issue. It might be SVG or cycle collection based on the stacks. I would guess at it being triggered by collection of the SVG mask that gets used for disabled add-on icons in the add-ons manager which would have been opened shortly before these two tests both of which run for a fair time.
OS: Mac OS X → All
Version: unspecified → Trunk
I ran this directory of tests under valgrind, with DEBUG_TRACEMALLOC_PRESARENA, and didn't get anything useful here (although I did file bug 645938 and bug 645943).
Looks like this has gone away?
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
Not entirely.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Depends on: 684711
All these crashes are in SVG code, I don't think the add-ons manager should be able to crash it just because it uses an SVG filter.
Component: Add-ons Manager → SVG
Product: Toolkit → Core
QA Contact: add-ons.manager → general
A cycle collector problem is more likely, because there's no reason the cycle collector should be calling a random SVG code.
Component: SVG → XPCOM
QA Contact: general → xpcom
Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that: * Haven't changed in > 6months * Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb} * Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive. I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases). Sorry for the spam! Filter on: #FFA500
Status: REOPENED → RESOLVED
Closed: 14 years ago → 13 years ago
Resolution: --- → WORKSFORME
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.