677273 - Firefox 8/9 Crash in mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Marcia Knous [:marcia]]

Seen while looking at trunk crash stats. All are Windows crashes and crashes started showing up using the 2011080300 build - https://crash-stats.mozilla.com/report/list?signature=mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer%28JSContext*%29

One comments mentions installing Adblock Plus.

Possible pushlog regression range: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a43c3080f472&tochange=3735fb1cd5ef



Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer 	dom/workers/WorkerPrivate.cpp:3040
1 	xul.dll 	mozilla::dom::workers::WorkerPrivate::RunExpiredTimeouts 	dom/workers/WorkerPrivate.cpp:3020
2 	nspr4.dll 	MD_CURRENT_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:308
3 	nspr4.dll 	MD_CURRENT_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:308
4 	xul.dll 	mozilla::dom::workers::WorkerRunnable::Run 	dom/workers/WorkerPrivate.cpp:1243
5 	xul.dll 	JSAutoRequest::JSAutoRequest 	obj-firefox/dist/include/jsapi.h:801
6 	xul.dll 	mozilla::dom::workers::WorkerPrivate::DoRunLoop 	dom/workers/WorkerPrivate.cpp:2052
7 	xul.dll 	`anonymous namespace'::WorkerThreadRunnable::Run 	dom/workers/RuntimeService.cpp:384
8 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
9 	xul.dll 	nsThreadStartupEvent::`scalar deleting destructor' 	
10 	xul.dll 	nsThread::ThreadFunc 	xpcom/threads/nsThread.cpp:272
11 	nspr4.dll 	PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
12 	mozcrt19.dll 	getptd_noexit 	obj-firefox/memory/jemalloc/crtsrc/tidtable.c:614
13 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
14 	mozcrt19.dll 	_callthreadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:348
15 	mozcrt19.dll 	_threadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:326
16 	kernel32.dll 	BaseThreadInitThunk 	
17 	ntdll.dll 	RtlUserThreadStart 	
18 	kernel32.dll 	BasepReportFault 	
19 	kernel32.dll 	BasepReportFault

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Looks like WorkerPrivate::mTimer is null here?

Comment 2

[Robert Kaiser]

This is reporting in with 30-50 crashes every day on trunk, which currently makes it the #3 topcrash there.

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Craziness. Who knew workers were used this much?

Anyone have any idea if this is crashing on particular sites?

Comment 4

[Marcia Knous [:marcia]]

I will run a URL report now and try to get some URLs for this signature.

Comment 5

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Thanks Marcia!

Comment 6

[Marcia Knous [:marcia]]

Here are some URLs I pulled from the month of August - not very much concentration in any one site.

     13 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) \N
      5 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) 
      4 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) about:blank
      3 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) jar:file:///C:/Program%20Files/Nightly/omni.jar!/chrome/browser/content/browser/aboutHome.xhtml
      2 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) "javascript:"""""
2 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) https://spe.service-now.com/home.do
      2 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) https://lastpass.com/upgrade.php?ver=1.75.0&type=ff&upgrade=true
      2 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://my.iwon.com/
1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) wyciwyg://3/https://store.hollywoodbes.com/index.php
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) wyciwyg://33/http://www.foxnews.com/slideshow/entertainment/2010/12/15/wardrobe-mishaps/
1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) jar:file:///C:/Program%20Files/Nightly/omni.jar!/chrome/toolkit/content/global/config.xul
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) jar:file:///C:/Program%20Files/Minefield/omni.jar!/chrome/toolkit/content/global/config.xul
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://yahoo.com/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.ys-fashion.com/shop_gks2/1440/Products_List.aspx?fslid=136734&shbid=14156
1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.wd4ixd.com/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.war-riders.de/?lang=de&uni=104&page=compare&type=player&compare0=Silerra&compare1=Bassist2210%20&compare2=Link
1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.tiffinrvnetwork.com/forum/viewtopic.php
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.thatsracin.com/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.superleech.com/files/superleech.com_TrainSignal-Access2010-Disc2.part07.rar
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.smarty.net/docsv2/en/api.assign
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.reddit.com/r/videos/comments/jdgvi/air_swimmer_awesome_flying_rc_shark/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.radio1045.com/pages/promo/summer-block-parties.html
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.ppomppu.co.kr/index.php

1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.msnbc.msn.com/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.mrtech.com/extensions/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.mozilla.org/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.mignews.com/news/society/world/090811_194108_24961.html
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.mesaaz.gov/DevSustain
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.m4carbine.net/showthread.php?t=6969
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.kadaza.br.com/s/gacq
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.investors.com/Default.aspx
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.hoga.pl/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.guardian.co.uk/books/2011/aug/07/albert-camus-killed-by-kgb
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.google.com/search?q=framing+a+60x20&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:unofficial&client=firefox-a
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.google.com.au/
1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.fantasticvent.com/contact_us/contact_us.html
1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.deviantart.com/download/205523103/static_2_0_by_snipes2-d3ed2n3.zip
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.dailyrotation.com/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.cam4.com/tulipink
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.bankonet.pl
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.azcentral.com/offbeat/articles/2011/08/05/20110805oklahoma-woman-strips-naked-at-charity-golf-event.html
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.android-sync.com/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://www.3dsitelinks.com/
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://whois.arin.net/ui/query.do
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://wh40k.lexicanum.com/wiki/Categories

1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://uni110.tr.ogame.org/game/index.php
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://uni104.ogame.de/game/index.php
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://tech.wp.pl/kat,1009779,title,Windows-8-tuz-za-rogiem-Co-sie-zmieni,wid,13653239,wiadomosc.html
      1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) http://style.lifegoesstrong.com/too-old-dress-so-young

1 mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer(JSContext*) https://movies.netflix.com/WiPlayer?movieid=70177146

Comment 7

[Marcia Knous [:marcia]]

[@ mozilla::dom::workers::WorkerPrivate::RescheduleTimeoutTimer ] seems to be the Mac and Linux version of this signature which is present on Aurora and the trunk - https://crash-stats.mozilla.com/report/index/e9533523-b226-437e-a512-5a0922110819 is a sample report.

Comment 8

[Robert Kaiser]

This is quite visible on trunk and aurora, can we get some traction here?

Comment 9

[Sheila Mooney]

This is a regression on the trunk that doesn't seem to be making great progress. It's our top crash on 8.0a2 so far. We need to track this for 8.0.

Comment 10

[Marcia Knous [:marcia]]

I will spend some time in the lab trying to reproduce this on Win 7.

Comment 11

[Ben Turner (not reading bugmail, use the needinfo flag!)]

(In reply to Marcia Knous [:marcia] from comment #10)
> I will spend some time in the lab trying to reproduce this on Win 7.

Marcia, this is a race condition involving timers, I wouldn't worry about trying to find STR since it likely won't work on another machine. I'll stare at the code some and see what I can figure out.

Comment 12

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, v1

Found it! This should fix us up. Test included.

Comment 13

[Ben Turner (not reading bugmail, use the needinfo flag!)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/ca029820f740

Comment 14

[Marco Bonardo [:mak]]

http://hg.mozilla.org/mozilla-central/rev/ca029820f740

Comment 15

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 555664 [details] [diff] [review]
Patch, v1

We need this on aurora, it's a topcrash fix. Only changes worker code.

Comment 17

[Marcia Knous [:marcia]]

Fix looks good on trunk - no crashes in both of these stacks after 20110825030823 build.

Comment 18

[Ben Turner (not reading bugmail, use the needinfo flag!)]

http://hg.mozilla.org/releases/mozilla-aurora/rev/96d8e56860f0

Comment 19

[u279076]

QA tracking this bug; need to check crashstats to verify this is fixed.

Comment 20

[Ioana (away)]

I checked the crashstats and no builds containing the pushes crashed (Fx8 builds newer than 30-08-2011, Fx9 builds newer than 25-08-2011).

http://bit.ly/po7fLT
http://bit.ly/ntIIvk