686267 - Sporadic "ABORT: Trying to interpolate different types: 'aStartVal.mType == aEndVal.mType', file nsSMILCSSValueType.cpp, line 323" during cycle-collection in mochitest-5

Status: RESOLVED DUPLICATE of bug 675605

(Core :: SVG, defect)

Description

[Daniel Holbert [:dholbert]]

Just noticed a mysterious sporadic ABORT_IF_FALSE failure during mochitest-5:
{
3 INFO TEST-PASS | /tests/security/ssl/bugs/test_bug480509.html | Incorrect subject recognized - CN = www.bank1.com\00www.bad-guy.com
 should equal CN = www.bank1.com\00www.bad-guy.com

###!!! ABORT: Trying to interpolate different types: 'aStartVal.mType == aEndVal.mType', file /builds/slave/m-in-osx-dbg/build/content/smil/nsSMILCSSValueType.cpp, line 323
nsSMILCSSValueType::Interpolate [content/smil/nsSMILCSSValueType.cpp:324]
nsXPCOMCycleCollectionParticipant::CheckForRightISupports [obj-firefox/xpcom/build/nsCycleCollectionParticipant.cpp:104]
nsXPCWrappedJS::cycleCollection::Traverse [js/src/xpconnect/src/xpcwrappedjs.cpp:58]
GCGraphBuilder::Traverse [xpcom/base/nsCycleCollector.cpp:1619]
nsCycleCollector::MarkRoots [xpcom/base/nsCycleCollector.cpp:1874]
nsCycleCollector::BeginCollection [xpcom/base/nsCycleCollector.cpp:2790]
nsCycleCollectorRunner::Run [xpcom/base/nsCycleCollector.cpp:3492]
nsThread::ProcessNextEvent [xpcom/threads/nsThread.cpp:631]
NS_ProcessNextEvent_P [obj-firefox/xpcom/build/nsThreadUtils.cpp:245]
nsThread::ThreadFunc [xpcom/threads/nsThread.cpp:271]
_pt_root [nsprpub/pr/src/pthreads/ptthread.c:190]
libSystem.B.dylib + 0x32155
libSystem.B.dylib + 0x32012
###!!! ABORT: Trying to interpolate different types: 'aStartVal.mType == aEndVal.mType', file /builds/slave/m-in-osx-dbg/build/content/smil/nsSMILCSSValueType.cpp, line 323
TEST-UNEXPECTED-FAIL | /tests/security/ssl/bugs/test_bug480509.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:00:34.932580
INFO | automation.py | Reading PID log: /var/folders/Xr/Xr--yJnSEY0U11ET5NZuMU+++TM/-Tmp-/tmp3XY44Epidlog
PROCESS-CRASH | /tests/security/ssl/bugs/test_bug480509.html | application crashed (minidump found)
Crash dump filename: /var/folders/Xr/Xr--yJnSEY0U11ET5NZuMU+++TM/-Tmp-/tmpryQNWa/minidumps/5C1F3ACF-DF6E-4550-AD16-9EED364B6E49.dmp
Operating system: Mac OS X
                  10.5.8 9L31a
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash address: 0x0

Thread 2 (crashed)
 0  libmozalloc.dylib!TouchBadMemory [mozalloc_abort.cpp:cdf7e50630fc : 66 + 0x3]
    eip = 0x00014ef4   esp = 0xb01026b0   ebp = 0xb01026c8   ebx = 0x00014f16
    esi = 0x03a99774   edi = 0x00000000   eax = 0x00000000   ecx = 0x00014ee9
    edx = 0x00000000   efl = 0x00010282
    Found by: given as instruction pointer in context
 1  libmozalloc.dylib!mozalloc_abort [mozalloc_abort.cpp:cdf7e50630fc : 87 + 0x4]
    eip = 0x00014f4f   esp = 0xb01026d0   ebp = 0xb01026e8   ebx = 0x00014f16
    esi = 0x03a99774   edi = 0x00000000
    Found by: call frame info
 2  XUL!Abort [nsDebugImpl.cpp:cdf7e50630fc : 388 + 0xa]
    eip = 0x0424f4c1   esp = 0xb01026f0   ebp = 0xb0102708   ebx = 0x0424f7c3
    esi = 0x03a99774   edi = 0x00000000
    Found by: call frame info
 3  XUL!NS_DebugBreak_P [nsDebugImpl.cpp:cdf7e50630fc : 345 + 0xd]
    eip = 0x0424fa6a   esp = 0xb0102710   ebp = 0xb0102b38   ebx = 0x0424f7c3
    esi = 0x03a99774   edi = 0x00000000
    Found by: call frame info
 4  XUL!nsSMILCSSValueType::Interpolate [nsSMILCSSValueType.cpp:cdf7e50630fc : 322 + 0x41]
    eip = 0x03a36472   esp = 0xb0102b40   ebp = 0xb0102ba8   ebx = 0x03a36423
    esi = 0x03a99774   edi = 0x00000000
    Found by: call frame info
 5  XUL!nsXPCOMCycleCollectionParticipant::CheckForRightISupports [nsCycleCollectionParticipant.cpp:cdf7e50630fc : 103 + 0x1f]
    eip = 0x041cbd91   esp = 0xb0102bb0   ebp = 0xb0102bd8   ebx = 0x041cbd70
    esi = 0x03a99774   edi = 0x00000000
    Found by: call frame info
 6  XUL!nsXPCWrappedJS::cycleCollection::Traverse [xpcwrappedjs.cpp:cdf7e50630fc : 58 + 0x11]
    eip = 0x03a9979d   esp = 0xb0102be0   ebp = 0xb0102c78   ebx = 0x03a99784
    esi = 0x03a99774   edi = 0x00000000
    Found by: call frame info
 7  XUL!GCGraphBuilder::Traverse [nsCycleCollector.cpp:cdf7e50630fc : 1619 + 0x24]
    eip = 0x04258f61   esp = 0xb0102c80   ebp = 0xb0102ca8   ebx = 0x04258f05
    esi = 0x03a99774   edi = 0x00000000
    Found by: call frame info
 8  XUL!nsCycleCollector::MarkRoots [nsCycleCollector.cpp:cdf7e50630fc : 1873 + 0x11]
    eip = 0x04258fda   esp = 0xb0102cb0   ebp = 0xb0102ce8   ebx = 0x0425c690
    esi = 0x00000000   edi = 0x00000000
    Found by: call frame info
 9  XUL!nsCycleCollector::BeginCollection [nsCycleCollector.cpp:cdf7e50630fc : 2779 + 0x14]
    eip = 0x04259173   esp = 0xb0102cf0   ebp = 0xb0102d98   ebx = 0x0425c690
}

I don't understand the jump from stack-level 5 to level 4 (CheckForRightISupports to nsSMILCSSValueType::Interpolate)...  Something is very busted.
https://tbpl.mozilla.org/php/getParsedLog.php?id=6373362
Rev3 MacOSX Leopard 10.5.8 mozilla-inbound debug test mochitests-5/5 on 2011-09-11 21:12:08 PDT for push cdf7e50630fc
slave: talos-r3-leopard-011

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: gzipped full log

Here's the gzipped full log, for reference.

Comment 2

[Phil Ringnalda (:philor)]

You'll actually find quite a few of these in bug 675605. Cycle collector crashes seem to both be a bit varied and weird in their stacks, and to quite often have what appear to be random bits of SVG stuck in them, dunno what that means.

Comment 3

[Andrew McCreight [:mccr8]]

Another intermittent crash with the cycle collector heading off into nonsense in CheckForRightIsupports is bug 635480.

Comment 4

[Daniel Holbert [:dholbert]]

So I'd initially assumed that the SVG in the backtrace meant that this was happening shortly after some SVG tests were run [and those SVG tests were getting cycle collected, and triggering something evil].

But in this case, the SSL test "test_bug480509.html" is actually the *only* mochitest that's been run.  (I hadn't noticed until now.)  No SVG tests have been run.  So I doubt any SMIL animation has actually happened.

To illustrate that -- this is the leadup to the abort:
============
0 INFO Running tests in tests/security/ssl/bugs, [...dholbert truncating this long line...]
1 INFO SimpleTest START
2 INFO TEST-START | /tests/security/ssl/bugs/test_bug480509.html
++DOMWINDOW == 13 (0x2549cc18) [serial = 15] [outer = 0xc606f00]
++DOCSHELL 0x9aae00 == 7
++DOMWINDOW == 14 (0x254d1f08) [serial = 16] [outer = 0x0]
++DOMWINDOW == 15 (0x254ec528) [serial = 17] [outer = 0x254d1ec0]
++DOMWINDOW == 16 (0x23243a38) [serial = 18] [outer = 0x254d1ec0]
3 INFO TEST-PASS | /tests/security/ssl/bugs/test_bug480509.html | Incorrect subject recognized - CN = www.bank1.com\00www.bad-guy.com
 should equal CN = www.bank1.com\00www.bad-guy.com

###!!! ABORT: Trying to interpolate different types: 'aStartVal.mType == aEndVal.mType', file /builds/slave/m-in-osx-dbg/build/content/smil/nsSMILCSSValueType.cpp, line 323
============

So that sways me more in the direction of "something's seriously busted that's triggering a jump into random code" -- and sways me away from my initial impression of "SMIL interpolation code must be broken".

Duping to bug 675605, since that's the same sort of thing in the same test.

Comment 6

[Daniel Holbert [:dholbert]]

(In reply to Andrew McCreight [:mccr8] from comment #3)
> Another intermittent crash with the cycle collector heading off into
> nonsense in CheckForRightIsupports is bug 635480.

In both cases, we're running an SSL testcase.  I wonder if there's something busted in our SSL implementation that the cycle-collector tickles.