IcedTea-Web Java plugin touches JS/XPConnect off the main thread

RESOLVED WORKSFORME

Status

Plugins Graveyard
Java (IcedTea)
--
critical
RESOLVED WORKSFORME
6 years ago
a year ago

People

(Reporter: alex_mayorga, Unassigned)

Tracking

(Blocks: 1 bug, {crash, topcrash})

x86_64
Linux
crash, topcrash
Dependency tree / graph

Details

(Whiteboard: [fixed in IcedTea-Web 1.2pre][workaround for previous versions in comment 18], crash signature, URL)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 575943 [details]
ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash.log

IcedTea-Web 1.1.3 (1.1.3-1ubuntu1.1)

Mozilla/5.0 (Ubuntu; X11; Linux x86_64; rv:11.0a1) Gecko/20111121
Firefox/11.0a1 ID:20111121035245

Linux VPCCW1FFXL 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011
x86_64 x86_64 x86_64 GNU/Linux

Loading Citrix XenApp on Firefox trunk causes a crash that's not logged on
about:crashes

Attached find the output of:
  ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash.log

Let me know if there's anything else you need me to provide.
(Reporter)

Updated

6 years ago
Summary: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp → IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp: Assertion failure: rt->onOwnerThread()
Assignee: nobody → general
Component: General → JavaScript Engine
Product: Firefox → Core
QA Contact: general → general
(Reporter)

Comment 1

6 years ago
Wandering around Ubuntu's bug tracker, found https://bugs.launchpad.net/ubuntu/+source/icedtea-web/+bug/858827 that has a public applet that crashes Nightly on queue for me (click carefully below)

http://www.dailyfx.com/charts/netdaniachart?symbol=USD/CAD
(Reporter)

Comment 2

6 years ago
Created attachment 575947 [details]
ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash2.log
Attachment #575943 - Attachment mime type: text/x-log → text/plain
Attachment #575947 - Attachment mime type: text/x-log → text/plain

Comment 3

6 years ago
This abort is caused by using a JSRuntime (via _getstringidentifier) from off the main thread and was added by bug 650411.  Incidentally, it looks like this was already an error (see the NS_IsMainThread check in http://mxr.mozilla.org/mozilla-central/source/dom/plugins/base/nsNPAPIPlugin.cpp#1407), it just wasn't causing failures.  With JSRuntime being made single-threaded (announced a few months ago: http://groups.google.com/group/mozilla.dev.tech.js-engine/msg/ae5f22f39e4fd150), this will definitely cause unsafe race-conditions.

The callstack for the crash is:

#3  JS_AbortIfWrongThread
#4  js_NewContext
#5  JS_NewContext
#6  XPCJSContextStack::GetSafeJSContext
#7  nsXPConnect::GetSafeJSContext
#8  mozilla::plugins::parent::_getstringidentifier
#9  PluginRequestProcessor::sendMember
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/IcedTeaPlugin.so
#10 queue_processor
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/IcedTeaPlugin.so
#11 start_thread

Looking at PluginRequestProcessor::sendMember in icedtea-web-1.1.4/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc, I see the comment:

 * This is a static function, called in another thread. Since certain data
 * can only be requested from the main thread in Mozilla, this function
 * does whatever it can seperately, and then makes an internal request that
 * causes _sendMember to do the rest of the work.

so perhaps the fix is to just move the get*identifier calls to the part that gets executed on the main thread.

Does anyone know who to contact about getting this fixed on the IcedTea side?  Thus far, IcedTea seems to be the only plugin/addon hitting this and only for some applets (I tested quite a few before landing), so I do not want to back out the whole single-threaded check for this one case.
The filer said on IRC that he first filed http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=820 "but IRC peeps on #openjdk say it's FF fault".

Comment 5

6 years ago
Update: I mentioned this on #openjdk; the icedtea bug has been reopened.

Comment 6

6 years ago
dupe of bug 640908 ?

Comment 7

6 years ago
(In reply to Bob Clary [:bc:] from comment #6)
> dupe of bug 640908 ?

Nope, it looks like that was early in the year, this still hits.  Also different (but similarly named) assert.
Luke, is this a JS engine bug, or is it a plugins bug?

Comment 9

6 years ago
It's a (pre-existing) icedtea bug.  It makes sense to keep a b.m.o bug open to track the issue; I'm not sure whether it is more useful to have it be in the JS engine component or plugin component.

Updated

5 years ago

Comment 10

5 years ago
This is number 5 top-crasher on Linux for 10.0 now :(

I've pretty much got a patch for this which I will submit to the icedtea tracker once I've verified a few more of the links in the crash comments

Updated

5 years ago
Duplicate of this bug: 725117

Comment 12

5 years ago
XPConnect has added slightly earlier/more-extenstive main-thread-only asserts that are hitting the same issue.
Summary: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp: Assertion failure: rt->onOwnerThread() → IcedTea-Web Java plugin touches JS/XPConnect off the main thread

Updated

5 years ago
Blocks: 715757
Severity: normal → critical
Keywords: crash

Updated

5 years ago
Crash Signature: [@ CrashInJS]

Updated

5 years ago
Duplicate of this bug: 726302
Why doesn't the plugin code just bail out when this happens?  It already logs when it gets called on the wrong thread.

Updated

5 years ago
Duplicate of this bug: 678989

Updated

5 years ago
Crash Signature: [@ CrashInJS] → [@ CrashInJS] [@ CrashInJS | JS_AbortIfWrongThread]
Depends on: 715713

Comment 16

5 years ago
It's #1 top crasher on Linux in 10.0.2.
Keywords: topcrash

Updated

5 years ago
Crash Signature: [@ CrashInJS] [@ CrashInJS | JS_AbortIfWrongThread] → [@ CrashInJS] [@ CrashInJS | JS_AbortIfWrongThread ]
(Reporter)

Comment 17

5 years ago
This no longer crashes with the following configuration.

IcedTea-Web 1.2pre (1.2~pre2-1ubuntu3)

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:13.0) Gecko/20120229 Firefox/13.0a1 ID:20120229052709

Linux VPCCW1FFXL 3.2.0-17-generic #27-Ubuntu SMP Fri Feb 24 15:37:36 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → WORKSFORME

Updated

5 years ago
Assignee: general → nobody
Component: JavaScript Engine → Java (IcedTea)
Product: Core → Plugins
QA Contact: general → icedtea-java
Whiteboard: [fixed in IcedTea-Web 1.2pre]
Version: Trunk → 1.x

Comment 18

5 years ago
Set dom.ipc.plugins.java.enabled to true is a workaround here (https://bugzilla.redhat.com/show_bug.cgi?id=789959)

Updated

5 years ago
Whiteboard: [fixed in IcedTea-Web 1.2pre] → [fixed in IcedTea-Web 1.2pre][workaround for previous versions in comment 18]

Updated

5 years ago
Crash Signature: [@ CrashInJS] [@ CrashInJS | JS_AbortIfWrongThread ] → [@ CrashInJS] [@ CrashInJS | JS_AbortIfWrongThread ] [@ libpthread-2.13.so@0xee6d]
(Reporter)

Updated

5 years ago
Duplicate of this bug: 682426

Comment 20

5 years ago
Carl-Georg Madelung added the following comment to Launchpad bug report 927282:

It works now, thank you very mucho. I am so happy again that FireFox work
and still is way better than any other browser.
Greetings from

C-G. Madelung
Klostervej 29
8680 Ry
Sendt fra talephøn.
Den 22/08/2012 09.51 skrev "Alex Mayorga Adame" <927282@bugs.launchpad.net>:

> *** Bug 682426 has been marked as a duplicate of this bug. ***
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (987668).
> https://bugs.launchpad.net/bugs/927282
>
> Title:
>   Java crash with icedtea plugin and Firefox 10+
>
> Status in The Mozilla Firefox Browser:
>   Invalid
> Status in Iced Tea:
>   Fix Released
> Status in “icedtea-web” package in Ubuntu:
>   Fix Released
> Status in “openjdk-6” package in Ubuntu:
>   Invalid
> Status in “icedtea-web” source package in Lucid:
>   Fix Released
> Status in “openjdk-6” source package in Lucid:
>   Won't Fix
> Status in “icedtea-web” source package in Maverick:
>   Invalid
> Status in “openjdk-6” source package in Maverick:
>   Won't Fix
> Status in “icedtea-web” source package in Natty:
>   Fix Released
> Status in “openjdk-6” source package in Natty:
>   Invalid
> Status in “icedtea-web” source package in Oneiric:
>   Fix Released
> Status in “openjdk-6” source package in Oneiric:
>   Invalid
> Status in “icedtea-web” source package in Precise:
>   Fix Released
> Status in “openjdk-6” source package in Precise:
>   Invalid
>
> Bug description:
>   When I try to view http://www.highways.gov.uk/traffic/traffic.aspx and
>   then click on Southampton on the righthand graphic Mozilla quits after
>   a few seconds.
>
>   ProblemType: Bug
>   DistroRelease: Ubuntu 11.10
>   Package: firefox 10.0+build1-0ubuntu0.11.10.1
>   ProcVersionSignature: Ubuntu 3.0.0-15.26-generic 3.0.13
>   Uname: Linux 3.0.0-15-generic i686
>   AddonCompatCheckDisabled: False
>   AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
>   ApportVersion: 1.23-0ubuntu4
>   Architecture: i386
>   ArecordDevices:
>    **** List of CAPTURE Hardware Devices ****
>    card 0: Intel [HDA Intel], device 0: AD198x Analog [AD198x Analog]
>      Subdevices: 1/1
>      Subdevice #0: subdevice #0
>   AudioDevicesInUse:
>    USER        PID ACCESS COMMAND
>    /dev/snd/controlC0:  james      1759 F.... pulseaudio
>   BuildID: 20120129141551
>   CRDA: Error: [Errno 2] No such file or directory
>   Card0.Amixer.info:
>    Card hw:0 'Intel'/'HDA Intel at 0xff63c000 irq 43'
>      Mixer name : 'Analog Devices AD1986A'
>      Components : 'HDA:11d41986,1179ff40,00100500
> HDA:11c11040,11790001,00100200'
>      Controls      : 37
>      Simple ctrls  : 21
>   Channel: release
>   Date: Sun Feb  5 19:38:08 2012
>   ForcedLayersAccel: False
>   IfupdownConfig:
>    auto lo
>    iface lo inet loopback
>   InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release i386
> (20111012)
>   IpRoute:
>    default via 192.168.1.1 dev eth0  proto static
>    169.254.0.0/16 dev eth0  scope link  metric 1000
>    192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.101
>  metric 1
>   ProcEnviron:
>    LANGUAGE=en_GB:en
>    PATH=(custom, no user)
>    LANG=en_GB.UTF-8
>    SHELL=/bin/bash
>   Profiles: Profile0 (Default) - LastVersion=10.0/20120129141551 (Running)
>   RfKill:
>    0: phy0: Wireless LAN
>         Soft blocked: no
>         Hard blocked: no
>   RunningIncompatibleAddons: False
>   SourcePackage: firefox
>   UpgradeStatus: No upgrade log present (probably fresh install)
>   dmi.bios.date: 06/23/2007
>   dmi.bios.vendor: American Megatrends Inc.
>   dmi.bios.version: V2.10
>   dmi.board.asset.tag: To Be Filled By O.E.M.
>   dmi.board.name: Equium L40
>   dmi.board.vendor: TOSHIBA
>   dmi.board.version: 1.0
>   dmi.chassis.type: 10
>   dmi.chassis.vendor: TOSHIBA
>   dmi.modalias:
> dmi:bvnAmericanMegatrendsInc.:bvrV2.10:bd06/23/2007:svnTOSHIBA:pnEquiumL40:pvrPSL41E-004004AV:rvnTOSHIBA:rnEquiumL40:rvr1.0:cvnTOSHIBA:ct10:cvr:
>   dmi.product.name: Equium L40
>   dmi.product.version: PSL41E-004004AV
>   dmi.sys.vendor: TOSHIBA
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/firefox/+bug/927282/+subscriptions
>


-- 
http://launchpad.net/bugs/927282
(Assignee)

Updated

a year ago
Product: Plugins → Plugins Graveyard
You need to log in before you can comment on or make changes to this bug.