Closed Bug 635480 Opened 9 years ago Closed 7 years ago

intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js or browser_updatessl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports][@nsXPCWrappedJS::cycleCollection::Traverse]

Categories

(Core :: XPCOM, defect)

x86
All
defect
Not set

Tracking

()

RESOLVED WORKSFORME
Tracking Status
status2.0 --- ?

People

(Reporter: mak, Unassigned)

References

Details

(Keywords: intermittent-failure)

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1298105028.1298108002.21186.gz

Rev3 MacOSX Leopard 10.5.8 mozilla-central debug test mochitest-other on 2011/02/19 00:43:48

on changeset http://hg.mozilla.org/mozilla-central/rev/657c2a92ee2b

Thread 2 (crashed)
 0  XUL!nsSVGMarkerElement::SetOrientToAngle [nsSVGMarkerElement.cpp:657c2a92ee2b : 223 + 0x8]
    eip = 0x0368278b   esp = 0xb0102b30   ebp = 0xb0102b78   ebx = 0x03682770
    esi = 0x03809432   edi = 0x00000000   eax = 0xc61eac24   ecx = 0x2fc3e6a8
    edx = 0x0368275a   efl = 0x00010286
    Found by: given as instruction pointer in context
 1  XUL!nsXPCOMCycleCollectionParticipant::CheckForRightISupports [nsCycleCollectionParticipant.cpp : 101 + 0x1f]
    eip = 0x03f91a7f   esp = 0xb0102b80   ebp = 0xb0102ba8   ebx = 0x03f91a5e
    esi = 0x03809432   edi = 0x00000000
    Found by: call frame info
 2  XUL!nsXPCWrappedJS::cycleCollection::Traverse [xpcwrappedjs.cpp:657c2a92ee2b : 58 + 0x11]
    eip = 0x0380945b   esp = 0xb0102bb0   ebp = 0xb0102c48   ebx = 0x03809442
    esi = 0x03809432   edi = 0x00000000
    Found by: call frame info
 3  XUL!GCGraphBuilder::Traverse [nsCycleCollector.cpp:657c2a92ee2b : 1523 + 0x24]
    eip = 0x0402577e   esp = 0xb0102c50   ebp = 0xb0102c78   ebx = 0x0402572b
    esi = 0x03809432   edi = 0x00000000
    Found by: call frame info
 4  XUL!nsCycleCollector::MarkRoots [nsCycleCollector.cpp:657c2a92ee2b : 1764 + 0x11]
    eip = 0x0402581c   esp = 0xb0102c80   ebp = 0xb0102cb8   ebx = 0x04028bc3
    esi = 0x00000000   edi = 0x00000000
    Found by: call frame info
 5  XUL!nsCycleCollector::BeginCollection [nsCycleCollector.cpp:657c2a92ee2b : 2633 + 0x14]
    eip = 0x040259c3   esp = 0xb0102cc0   ebp = 0xb0102d88   ebx = 0x04028bc3
    esi = 0x00000000   edi = 0x00000000
    Found by: call frame info
 6  XUL!nsCycleCollectorRunner::Run [nsCycleCollector.cpp:657c2a92ee2b : 3318 + 0x1f]
    eip = 0x04028ccb   esp = 0xb0102d90   ebp = 0xb0102dd8   ebx = 0x04028bc3
    esi = 0x00000000   edi = 0x00000000
    Found by: call frame info
 7  XUL!nsThread::ProcessNextEvent [nsThread.cpp:657c2a92ee2b : 633 + 0x18]
    eip = 0x0400acfe   esp = 0xb0102de0   ebp = 0xb0102e88   ebx = 0x0400a980
    esi = 0x00000000   edi = 0x00000000
    Found by: call frame info
 8  XUL!NS_ProcessNextEvent_P [nsThreadUtils.cpp : 250 + 0x1f]
    eip = 0x03f91108   esp = 0xb0102e90   ebp = 0xb0102ed8   ebx = 0x03f91092
    esi = 0x00000000   edi = 0x00000000
    Found by: call frame info
 9  XUL!nsThread::ThreadFunc [nsThread.cpp:657c2a92ee2b : 278 + 0x12]
    eip = 0x0400b825   esp = 0xb0102ee0   ebp = 0xb0102f48   ebx = 0x0400b72b
    esi = 0x00000000   edi = 0x00000000
    Found by: call frame info
10  libnspr4.dylib!_pt_root [ptthread.c:657c2a92ee2b : 187 + 0x10]
    eip = 0x0006ec19   esp = 0xb0102f50   ebp = 0xb0102f78   ebx = 0x0006eb03
    esi = 0xb0103000   edi = 0x00000000
    Found by: call frame info
11  libSystem.B.dylib + 0x32154
    eip = 0x927d2155   esp = 0xb0102f80   ebp = 0xb0102fc8   ebx = 0x927d2028
    esi = 0xb0103000   edi = 0x00000000
    Found by: call frame info
12  libSystem.B.dylib + 0x32011
    eip = 0x927d2012   esp = 0xb0102fd0   ebp = 0xb0102fec
    Found by: previous frame's frame pointer
Summary: intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js [@nsSVGMarkerElement::SetOrientToAngle] → intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports]
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1298594074.1298597942.2073.gz&fulltext=1
Rev3 WINNT 6.1 mozilla-central debug test mochitest-other on 2011/02/24 16:34:34
s: talos-r3-w7-012

TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/mozapps/extensions/test/browser/browser_updatessl.js | Exited with code -1073741819 during test run
PROCESS-CRASH | chrome://mochitests/content/browser/toolkit/mozapps/extensions/test/browser/browser_updatessl.js | application crashed (minidump found)
Summary: intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports] → intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js or browser_updatessl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports]
comment 8 is:

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x8
Assertion: Unknown assertion type 0x00000000

Thread 0 (crashed)
 0  mozjs.dll!js::ctypes::ConvertToJS(JSContext *,JSObject *,JSObject *,void *,bool,bool,jsval_layout *) [typedefs.h:e8facc64c88e : 107 + 0x3]
    eip = 0x6d9397fc   esp = 0x00238a88   ebp = 0x00238c80   ebx = 0x00000001
    esi = 0x005b8aa0   edi = 0x00000000   eax = 0x00000004   ecx = 0x00000008
    edx = 0x00000004   efl = 0x00010283
    Found by: given as instruction pointer in context
 1  mozjs.dll!js::ctypes::PointerType::ContentsGetter [CTypes.cpp:e8facc64c88e : 3393 + 0x1a]
    eip = 0x6d94107f   esp = 0x00238c88   ebp = 0x00238cb8
    Found by: call frame info
 2  mozjs.dll!js::CallJSPropertyOp(JSContext *,int (*)(JSContext *,JSObject *,jsid,js::Value *),JSObject *,jsid,js::Value *) [jscntxtinlines.h:e8facc64c88e : 750 + 0x12]
    eip = 0x6d73ac95   esp = 0x00238cc0   ebp = 0x00238cd4
    Found by: call frame info
 3  mozjs.dll!js::Shape::get(JSContext *,JSObject *,JSObject *,JSObject *,js::Value *) [jsscopeinlines.h:e8facc64c88e : 263 + 0x50]
    eip = 0x6d742dc8   esp = 0x00238cdc   ebp = 0x00238d04
    Found by: call frame info
 4  mozjs.dll!js_NativeGetInline [jsobj.cpp:e8facc64c88e : 5251 + 0x1b]
    eip = 0x6d742aff   esp = 0x00238d0c   ebp = 0x00238d60
    Found by: call frame info
 5  mozjs.dll!js_GetPropertyHelperWithShapeInline [jsobj.cpp:e8facc64c88e : 5436 + 0x20]
    eip = 0x6d743725   esp = 0x00238d68   ebp = 0x00238db8
    Found by: call frame info
 6  mozjs.dll!js_GetPropertyHelperInline [jsobj.cpp:e8facc64c88e : 5457 + 0x24]
    eip = 0x6d7438bb   esp = 0x00238dc0   ebp = 0x00238de8
    Found by: call frame info
 7  mozjs.dll!js_GetPropertyHelper(JSContext *,JSObject *,jsid,unsigned int,js::Value *) [jsobj.cpp:e8facc64c88e : 5463 + 0x1c]
    eip = 0x6d743880   esp = 0x00238df0   ebp = 0x00238e08
    Found by: call frame info
...
Summary: intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js or browser_updatessl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports] → intermittent crash in toolkit/mozapps/extensions/test/browser/browser_installssl.js or browser_updatessl.js [@nsSVGMarkerElement::SetOrientToAngle][@nsXPCOMCycleCollectionParticipant::CheckForRightISupports][@nsXPCWrappedJS::cycleCollection::Traverse]
Don't believe that this is an add-ons manager issue. It might be SVG or cycle collection based on the stacks. I would guess at it being triggered by collection of the SVG mask that gets used for disabled add-on icons in the add-ons manager which would have been opened shortly before these two tests both of which run for a fair time.
OS: Mac OS X → All
Version: unspecified → Trunk
I ran this directory of tests under valgrind, with DEBUG_TRACEMALLOC_PRESARENA, and didn't get anything useful here (although I did file bug 645938 and bug 645943).
Looks like this has gone away?
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WORKSFORME
Not entirely.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Depends on: 684711
All these crashes are in SVG code, I don't think the add-ons manager should be able to crash it just because it uses an SVG filter.
Component: Add-ons Manager → SVG
Product: Toolkit → Core
QA Contact: add-ons.manager → general
A cycle collector problem is more likely, because there's no reason the cycle collector should be calling a random SVG code.
Component: SVG → XPCOM
QA Contact: general → xpcom
Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that:
* Haven't changed in > 6months
* Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb}
* Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive.

I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases).

Sorry for the spam! Filter on: #FFA500
Status: REOPENED → RESOLVED
Closed: 9 years ago7 years ago
Resolution: --- → WORKSFORME
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.