Last Comment Bug 704249 - IcedTea-Web Java plugin touches JS/XPConnect off the main thread
: IcedTea-Web Java plugin touches JS/XPConnect off the main thread
Status: RESOLVED WORKSFORME
[fixed in IcedTea-Web 1.2pre][workaro...
: crash, topcrash
Product: Plugins Graveyard
Classification: Graveyard
Component: Java (IcedTea) (show other bugs)
: 1.x
: x86_64 Linux
: -- critical
: ---
Assigned To: Nobody; OK to take it and work on it
:
Mentors:
http://icedtea.classpath.org/bugzilla...
: 678989 682426 725117 726302 (view as bug list)
Depends on: 715713
Blocks: 715757
  Show dependency treegraph
 
Reported: 2011-11-21 12:51 PST by alex_mayorga
Modified: 2016-04-28 09:08 PDT (History)
16 users (show)
See Also:
QA Whiteboard:
Iteration: ---
Points: ---


Attachments
ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash.log (104.42 KB, text/plain)
2011-11-21 12:51 PST, alex_mayorga
no flags Details
ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash2.log (42.99 KB, text/plain)
2011-11-21 13:09 PST, alex_mayorga
no flags Details

Description alex_mayorga 2011-11-21 12:51:16 PST
Created attachment 575943 [details]
ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash.log

IcedTea-Web 1.1.3 (1.1.3-1ubuntu1.1)

Mozilla/5.0 (Ubuntu; X11; Linux x86_64; rv:11.0a1) Gecko/20111121
Firefox/11.0a1 ID:20111121035245

Linux VPCCW1FFXL 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011
x86_64 x86_64 x86_64 GNU/Linux

Loading Citrix XenApp on Firefox trunk causes a crash that's not logged on
about:crashes

Attached find the output of:
  ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash.log

Let me know if there's anything else you need me to provide.
Comment 1 alex_mayorga 2011-11-21 13:02:43 PST
Wandering around Ubuntu's bug tracker, found https://bugs.launchpad.net/ubuntu/+source/icedtea-web/+bug/858827 that has a public applet that crashes Nightly on queue for me (click carefully below)

http://www.dailyfx.com/charts/netdaniachart?symbol=USD/CAD
Comment 2 alex_mayorga 2011-11-21 13:09:49 PST
Created attachment 575947 [details]
ICEDTEAPLUGIN_DEBUG=true firefox-trunk 2>&1 | tee crash2.log
Comment 3 Luke Wagner [:luke] 2011-11-21 16:28:23 PST
This abort is caused by using a JSRuntime (via _getstringidentifier) from off the main thread and was added by bug 650411.  Incidentally, it looks like this was already an error (see the NS_IsMainThread check in http://mxr.mozilla.org/mozilla-central/source/dom/plugins/base/nsNPAPIPlugin.cpp#1407), it just wasn't causing failures.  With JSRuntime being made single-threaded (announced a few months ago: http://groups.google.com/group/mozilla.dev.tech.js-engine/msg/ae5f22f39e4fd150), this will definitely cause unsafe race-conditions.

The callstack for the crash is:

#3  JS_AbortIfWrongThread
#4  js_NewContext
#5  JS_NewContext
#6  XPCJSContextStack::GetSafeJSContext
#7  nsXPConnect::GetSafeJSContext
#8  mozilla::plugins::parent::_getstringidentifier
#9  PluginRequestProcessor::sendMember
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/IcedTeaPlugin.so
#10 queue_processor
   from /usr/lib/jvm/java-6-openjdk/jre/lib/amd64/IcedTeaPlugin.so
#11 start_thread

Looking at PluginRequestProcessor::sendMember in icedtea-web-1.1.4/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc, I see the comment:

 * This is a static function, called in another thread. Since certain data
 * can only be requested from the main thread in Mozilla, this function
 * does whatever it can seperately, and then makes an internal request that
 * causes _sendMember to do the rest of the work.

so perhaps the fix is to just move the get*identifier calls to the part that gets executed on the main thread.

Does anyone know who to contact about getting this fixed on the IcedTea side?  Thus far, IcedTea seems to be the only plugin/addon hitting this and only for some applets (I tested quite a few before landing), so I do not want to back out the whole single-threaded check for this one case.
Comment 4 Steve Fink [:sfink] [:s:] 2011-11-21 16:32:08 PST
The filer said on IRC that he first filed http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=820 "but IRC peeps on #openjdk say it's FF fault".
Comment 5 Luke Wagner [:luke] 2011-11-23 14:34:13 PST
Update: I mentioned this on #openjdk; the icedtea bug has been reopened.
Comment 6 Bob Clary [:bc:] 2011-11-25 09:37:12 PST
dupe of bug 640908 ?
Comment 7 Luke Wagner [:luke] 2011-11-28 09:57:01 PST
(In reply to Bob Clary [:bc:] from comment #6)
> dupe of bug 640908 ?

Nope, it looks like that was early in the year, this still hits.  Also different (but similarly named) assert.
Comment 8 David Mandelin [:dmandelin] 2011-12-15 18:45:48 PST
Luke, is this a JS engine bug, or is it a plugins bug?
Comment 9 Luke Wagner [:luke] 2011-12-15 20:04:13 PST
It's a (pre-existing) icedtea bug.  It makes sense to keep a b.m.o bug open to track the issue; I'm not sure whether it is more useful to have it be in the JS engine component or plugin component.
Comment 10 Chris Coulson 2012-02-06 04:01:26 PST
This is number 5 top-crasher on Linux for 10.0 now :(

I've pretty much got a patch for this which I will submit to the icedtea tracker once I've verified a few more of the links in the crash comments
Comment 11 Luke Wagner [:luke] 2012-02-08 11:08:00 PST
*** Bug 725117 has been marked as a duplicate of this bug. ***
Comment 12 Luke Wagner [:luke] 2012-02-08 11:13:09 PST
XPConnect has added slightly earlier/more-extenstive main-thread-only asserts that are hitting the same issue.
Comment 13 Scoobidiver (away) 2012-02-11 09:05:13 PST
*** Bug 726302 has been marked as a duplicate of this bug. ***
Comment 14 Kyle Huey [:khuey] (Exited; not receiving bugmail, email if necessary) 2012-02-14 09:42:49 PST
Why doesn't the plugin code just bail out when this happens?  It already logs when it gets called on the wrong thread.
Comment 15 Luke Wagner [:luke] 2012-02-22 09:05:24 PST
*** Bug 678989 has been marked as a duplicate of this bug. ***
Comment 16 Scoobidiver (away) 2012-02-24 10:18:33 PST
It's #1 top crasher on Linux in 10.0.2.
Comment 17 alex_mayorga 2012-03-01 17:02:23 PST
This no longer crashes with the following configuration.

IcedTea-Web 1.2pre (1.2~pre2-1ubuntu3)

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:13.0) Gecko/20120229 Firefox/13.0a1 ID:20120229052709

Linux VPCCW1FFXL 3.2.0-17-generic #27-Ubuntu SMP Fri Feb 24 15:37:36 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
Comment 18 Martin Stránský 2012-03-02 00:10:25 PST
Set dom.ipc.plugins.java.enabled to true is a workaround here (https://bugzilla.redhat.com/show_bug.cgi?id=789959)
Comment 19 alex_mayorga 2012-08-17 11:37:16 PDT
*** Bug 682426 has been marked as a duplicate of this bug. ***
Comment 20 Launchpad 2012-08-23 09:53:13 PDT
Carl-Georg Madelung added the following comment to Launchpad bug report 927282:

It works now, thank you very mucho. I am so happy again that FireFox work
and still is way better than any other browser.
Greetings from

C-G. Madelung
Klostervej 29
8680 Ry
Sendt fra talephøn.
Den 22/08/2012 09.51 skrev "Alex Mayorga Adame" <927282@bugs.launchpad.net>:

> *** Bug 682426 has been marked as a duplicate of this bug. ***
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (987668).
> https://bugs.launchpad.net/bugs/927282
>
> Title:
>   Java crash with icedtea plugin and Firefox 10+
>
> Status in The Mozilla Firefox Browser:
>   Invalid
> Status in Iced Tea:
>   Fix Released
> Status in “icedtea-web” package in Ubuntu:
>   Fix Released
> Status in “openjdk-6” package in Ubuntu:
>   Invalid
> Status in “icedtea-web” source package in Lucid:
>   Fix Released
> Status in “openjdk-6” source package in Lucid:
>   Won't Fix
> Status in “icedtea-web” source package in Maverick:
>   Invalid
> Status in “openjdk-6” source package in Maverick:
>   Won't Fix
> Status in “icedtea-web” source package in Natty:
>   Fix Released
> Status in “openjdk-6” source package in Natty:
>   Invalid
> Status in “icedtea-web” source package in Oneiric:
>   Fix Released
> Status in “openjdk-6” source package in Oneiric:
>   Invalid
> Status in “icedtea-web” source package in Precise:
>   Fix Released
> Status in “openjdk-6” source package in Precise:
>   Invalid
>
> Bug description:
>   When I try to view http://www.highways.gov.uk/traffic/traffic.aspx and
>   then click on Southampton on the righthand graphic Mozilla quits after
>   a few seconds.
>
>   ProblemType: Bug
>   DistroRelease: Ubuntu 11.10
>   Package: firefox 10.0+build1-0ubuntu0.11.10.1
>   ProcVersionSignature: Ubuntu 3.0.0-15.26-generic 3.0.13
>   Uname: Linux 3.0.0-15-generic i686
>   AddonCompatCheckDisabled: False
>   AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
>   ApportVersion: 1.23-0ubuntu4
>   Architecture: i386
>   ArecordDevices:
>    **** List of CAPTURE Hardware Devices ****
>    card 0: Intel [HDA Intel], device 0: AD198x Analog [AD198x Analog]
>      Subdevices: 1/1
>      Subdevice #0: subdevice #0
>   AudioDevicesInUse:
>    USER        PID ACCESS COMMAND
>    /dev/snd/controlC0:  james      1759 F.... pulseaudio
>   BuildID: 20120129141551
>   CRDA: Error: [Errno 2] No such file or directory
>   Card0.Amixer.info:
>    Card hw:0 'Intel'/'HDA Intel at 0xff63c000 irq 43'
>      Mixer name : 'Analog Devices AD1986A'
>      Components : 'HDA:11d41986,1179ff40,00100500
> HDA:11c11040,11790001,00100200'
>      Controls      : 37
>      Simple ctrls  : 21
>   Channel: release
>   Date: Sun Feb  5 19:38:08 2012
>   ForcedLayersAccel: False
>   IfupdownConfig:
>    auto lo
>    iface lo inet loopback
>   InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release i386
> (20111012)
>   IpRoute:
>    default via 192.168.1.1 dev eth0  proto static
>    169.254.0.0/16 dev eth0  scope link  metric 1000
>    192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.101
>  metric 1
>   ProcEnviron:
>    LANGUAGE=en_GB:en
>    PATH=(custom, no user)
>    LANG=en_GB.UTF-8
>    SHELL=/bin/bash
>   Profiles: Profile0 (Default) - LastVersion=10.0/20120129141551 (Running)
>   RfKill:
>    0: phy0: Wireless LAN
>         Soft blocked: no
>         Hard blocked: no
>   RunningIncompatibleAddons: False
>   SourcePackage: firefox
>   UpgradeStatus: No upgrade log present (probably fresh install)
>   dmi.bios.date: 06/23/2007
>   dmi.bios.vendor: American Megatrends Inc.
>   dmi.bios.version: V2.10
>   dmi.board.asset.tag: To Be Filled By O.E.M.
>   dmi.board.name: Equium L40
>   dmi.board.vendor: TOSHIBA
>   dmi.board.version: 1.0
>   dmi.chassis.type: 10
>   dmi.chassis.vendor: TOSHIBA
>   dmi.modalias:
> dmi:bvnAmericanMegatrendsInc.:bvrV2.10:bd06/23/2007:svnTOSHIBA:pnEquiumL40:pvrPSL41E-004004AV:rvnTOSHIBA:rnEquiumL40:rvr1.0:cvnTOSHIBA:ct10:cvr:
>   dmi.product.name: Equium L40
>   dmi.product.version: PSL41E-004004AV
>   dmi.sys.vendor: TOSHIBA
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/firefox/+bug/927282/+subscriptions
>


-- 
http://launchpad.net/bugs/927282

Note You need to log in before you can comment on or make changes to this bug.