704249 - IcedTea-Web Java plugin touches JS/XPConnect off the main thread

Status: RESOLVED WORKSFORME

(Plugins Graveyard :: Java (IcedTea), defect)

Description

[alex_mayorga]

Attachment: ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash.log

IcedTea-Web 1.1.3 (1.1.3-1ubuntu1.1)

Mozilla/5.0 (Ubuntu; X11; Linux x86_64; rv:11.0a1) Gecko/20111121
Firefox/11.0a1 ID:20111121035245

Linux VPCCW1FFXL 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011
x86_64 x86_64 x86_64 GNU/Linux

Loading Citrix XenApp on Firefox trunk causes a crash that's not logged on
about:crashes

Attached find the output of:
  ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash.log

Let me know if there's anything else you need me to provide.

Comment 1

[alex_mayorga]

Wandering around Ubuntu's bug tracker, found https://bugs.launchpad.net/ubuntu/+source/icedtea-web/+bug/858827 that has a public applet that crashes Nightly on queue for me (click carefully below)

http://www.dailyfx.com/charts/netdaniachart?symbol=USD/CAD

Comment 2

[alex_mayorga]

Attachment: ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash2.log

Comment 3

[Luke Wagner [:luke]]

This abort is caused by using a JSRuntime (via _getstringidentifier) from off the main thread and was added by bug 650411.  Incidentally, it looks like this was already an error (see the NS_IsMainThread check in http://mxr.mozilla.org/mozilla-central/source/dom/plugins/base/nsNPAPIPlugin.cpp#1407), it just wasn't causing failures.  With JSRuntime being made single-threaded (announced a few months ago: http://groups.google.com/group/mozilla.dev.tech.js-engine/msg/ae5f22f39e4fd150), this will definitely cause unsafe race-conditions.

The callstack for the crash is:

#3  JS_AbortIfWrongThread
#4  js_NewContext
#5  JS_NewContext
#6  XPCJSContextStack::GetSafeJSContext
#7  nsXPConnect::GetSafeJSContext
#8  mozilla::plugins::parent::_getstringidentifier
#9  PluginRequestProcessor::sendMember
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/IcedTeaPlugin.so
#10 queue_processor
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/IcedTeaPlugin.so
#11 start_thread

Looking at PluginRequestProcessor::sendMember in icedtea-web-1.1.4/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc, I see the comment:

 * This is a static function, called in another thread. Since certain data
 * can only be requested from the main thread in Mozilla, this function
 * does whatever it can seperately, and then makes an internal request that
 * causes _sendMember to do the rest of the work.

so perhaps the fix is to just move the get*identifier calls to the part that gets executed on the main thread.

Does anyone know who to contact about getting this fixed on the IcedTea side?  Thus far, IcedTea seems to be the only plugin/addon hitting this and only for some applets (I tested quite a few before landing), so I do not want to back out the whole single-threaded check for this one case.

Comment 4

[Steve Fink [:sfink] [:s:]]

The filer said on IRC that he first filed http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=820 "but IRC peeps on #openjdk say it's FF fault".

Comment 5

[Luke Wagner [:luke]]

Update: I mentioned this on #openjdk; the icedtea bug has been reopened.

Comment 6

[Bob Clary [:bc] (inactive)]

dupe of bug 640908 ?

Comment 7

[Luke Wagner [:luke]]

(In reply to Bob Clary [:bc:] from comment #6)
> dupe of bug 640908 ?

Nope, it looks like that was early in the year, this still hits.  Also different (but similarly named) assert.

Comment 8

[David Mandelin [:dmandelin]]

Luke, is this a JS engine bug, or is it a plugins bug?

Comment 9

[Luke Wagner [:luke]]

It's a (pre-existing) icedtea bug.  It makes sense to keep a b.m.o bug open to track the issue; I'm not sure whether it is more useful to have it be in the JS engine component or plugin component.

Comment 10

[Chris Coulson]

This is number 5 top-crasher on Linux for 10.0 now :(

I've pretty much got a patch for this which I will submit to the icedtea tracker once I've verified a few more of the links in the crash comments

Comment 12

[Luke Wagner [:luke]]

XPConnect has added slightly earlier/more-extenstive main-thread-only asserts that are hitting the same issue.

Comment 14

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Why doesn't the plugin code just bail out when this happens?  It already logs when it gets called on the wrong thread.

Comment 16

[Scoobidiver (away)]

It's #1 top crasher on Linux in 10.0.2.

Comment 17

[alex_mayorga]

This no longer crashes with the following configuration.

IcedTea-Web 1.2pre (1.2~pre2-1ubuntu3)

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:13.0) Gecko/20120229 Firefox/13.0a1 ID:20120229052709

Linux VPCCW1FFXL 3.2.0-17-generic #27-Ubuntu SMP Fri Feb 24 15:37:36 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

Comment 18

[Martin Stránský [:stransky] (ni? me)]

Set dom.ipc.plugins.java.enabled to true is a workaround here (https://bugzilla.redhat.com/show_bug.cgi?id=789959)

Comment 20

[Launchpad]

Carl-Georg Madelung added the following comment to Launchpad bug report 927282:

It works now, thank you very mucho. I am so happy again that FireFox work
and still is way better than any other browser.
Greetings from

C-G. Madelung
Klostervej 29
8680 Ry
Sendt fra talephøn.
Den 22/08/2012 09.51 skrev "Alex Mayorga Adame" <[e-mail]>:

> *** Bug 682426 has been marked as a duplicate of this bug. ***
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (987668).
> https://bugs.launchpad.net/bugs/927282
>
> Title:
>   Java crash with icedtea plugin and Firefox 10+
>
> Status in The Mozilla Firefox Browser:
>   Invalid
> Status in Iced Tea:
>   Fix Released
> Status in “icedtea-web” package in Ubuntu:
>   Fix Released
> Status in “openjdk-6” package in Ubuntu:
>   Invalid
> Status in “icedtea-web” source package in Lucid:
>   Fix Released
> Status in “openjdk-6” source package in Lucid:
>   Won't Fix
> Status in “icedtea-web” source package in Maverick:
>   Invalid
> Status in “openjdk-6” source package in Maverick:
>   Won't Fix
> Status in “icedtea-web” source package in Natty:
>   Fix Released
> Status in “openjdk-6” source package in Natty:
>   Invalid
> Status in “icedtea-web” source package in Oneiric:
>   Fix Released
> Status in “openjdk-6” source package in Oneiric:
>   Invalid
> Status in “icedtea-web” source package in Precise:
>   Fix Released
> Status in “openjdk-6” source package in Precise:
>   Invalid
>
> Bug description:
>   When I try to view http://www.highways.gov.uk/traffic/traffic.aspx and
>   then click on Southampton on the righthand graphic Mozilla quits after
>   a few seconds.
>
>   ProblemType: Bug
>   DistroRelease: Ubuntu 11.10
>   Package: firefox 10.0+build1-0ubuntu0.11.10.1
>   ProcVersionSignature: Ubuntu 3.0.0-15.26-generic 3.0.13
>   Uname: Linux 3.0.0-15-generic i686
>   AddonCompatCheckDisabled: False
>   AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
>   ApportVersion: 1.23-0ubuntu4
>   Architecture: i386
>   ArecordDevices:
>    **** List of CAPTURE Hardware Devices ****
>    card 0: Intel [HDA Intel], device 0: AD198x Analog [AD198x Analog]
>      Subdevices: 1/1
>      Subdevice #0: subdevice #0
>   AudioDevicesInUse:
>    USER        PID ACCESS COMMAND
>    /dev/snd/controlC0:  james      1759 F.... pulseaudio
>   BuildID: 20120129141551
>   CRDA: Error: [Errno 2] No such file or directory
>   Card0.Amixer.info:
>    Card hw:0 'Intel'/'HDA Intel at 0xff63c000 irq 43'
>      Mixer name : 'Analog Devices AD1986A'
>      Components : 'HDA:11d41986,1179ff40,00100500
> HDA:11c11040,11790001,00100200'
>      Controls      : 37
>      Simple ctrls  : 21
>   Channel: release
>   Date: Sun Feb  5 19:38:08 2012
>   ForcedLayersAccel: False
>   IfupdownConfig:
>    auto lo
>    iface lo inet loopback
>   InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release i386
> (20111012)
>   IpRoute:
>    default via 192.168.1.1 dev eth0  proto static
>    169.254.0.0/16 dev eth0  scope link  metric 1000
>    192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.101
>  metric 1
>   ProcEnviron:
>    LANGUAGE=en_GB:en
>    PATH=(custom, no user)
>    LANG=en_GB.UTF-8
>    SHELL=/bin/bash
>   Profiles: Profile0 (Default) - LastVersion=10.0/20120129141551 (Running)
>   RfKill:
>    0: phy0: Wireless LAN
>         Soft blocked: no
>         Hard blocked: no
>   RunningIncompatibleAddons: False
>   SourcePackage: firefox
>   UpgradeStatus: No upgrade log present (probably fresh install)
>   dmi.bios.date: 06/23/2007
>   dmi.bios.vendor: American Megatrends Inc.
>   dmi.bios.version: V2.10
>   dmi.board.asset.tag: To Be Filled By O.E.M.
>   dmi.board.name: Equium L40
>   dmi.board.vendor: TOSHIBA
>   dmi.board.version: 1.0
>   dmi.chassis.type: 10
>   dmi.chassis.vendor: TOSHIBA
>   dmi.modalias:
> dmi:bvnAmericanMegatrendsInc.:bvrV2.10:bd06/23/2007:svnTOSHIBA:pnEquiumL40:pvrPSL41E-004004AV:rvnTOSHIBA:rnEquiumL40:rvr1.0:cvnTOSHIBA:ct10:cvr:
>   dmi.product.name: Equium L40
>   dmi.product.version: PSL41E-004004AV
>   dmi.sys.vendor: TOSHIBA
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/firefox/+bug/927282/+subscriptions
>


-- 
http://launchpad.net/bugs/927282