If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

nsiWebNavigation->LoadURI crashes in embedded Firefox 10

RESOLVED INVALID

Status

()

Core
ImageLib
--
critical
RESOLVED INVALID
6 years ago
6 years ago

People

(Reporter: tmax, Unassigned)

Tracking

({crash})

10 Branch
x86_64
Linux
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7

Steps to reproduce:

embed Firefox in my Application (did that already since ersion 1.8 without a problem) and call nsiWebNavigation->LoadURI
The loadURI is triggered using JNI since my controller Application is Java.

mWebNav->LoadURI(mCurrentURI.get(), nsIWebNavigation::LOAD_FLAGS_IS_LINK, NULL, NULL, NULL);

The Strange thing is that the crash only occurs on a Firefox Release Build. A Firefox Debug Build is not crashing at this point, but code which is called afterwards is also not executed.

Does anybody have an idea on this behaviour ?


Actual results:

Firefox crashed with the following :


#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00000000, pid=13761, tid=2789759856
#
# JRE version: 6.0_18-b07
# Java VM: Java HotSpot(TM) Client VM (16.0-b13 mixed mode linux-x86 )
# Problematic frame:
# C  0x00000000
#
# An error report file with more information is saved as:
# /home/tmax/crypt/prj/install/qftest/latest/bin/hs_err_pid13761.log
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#



Expected results:

Page should load as expected.

Comment 1

6 years ago
It's Java that crashes, not Firefox.
Please update to the latest Java version: 6.0_30.
(Reporter)

Comment 2

6 years ago
Doesn't depend on the Java Version. Even when updated to 6.0_30 the crash occurs.
OS: Windows 7 → Linux
(Reporter)

Comment 3

6 years ago
(In reply to Scoobidiver from comment #1)
> It's Java that crashes, not Firefox.
> Please update to the latest Java version: 6.0_30.

Doesn't depend on the Java Version. Even when updated to 6.0_30 the crash occurs.

Comment 4

6 years ago
(In reply to tmax from comment #3)
> Doesn't depend on the Java Version. Even when updated to 6.0_30 the crash
> occurs.
That could mean it's not fixed in the latest Java version.

Which version of Firefox are you using?

Provide the crash ID from about:crashes or, if it's not possible, provide a stack trace with WinDbg: https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg
(Reporter)

Comment 5

6 years ago
(In reply to Scoobidiver from comment #4)
> (In reply to tmax from comment #3)
> > Doesn't depend on the Java Version. Even when updated to 6.0_30 the crash
> > occurs.
> That could mean it's not fixed in the latest Java version.
> 
> Which version of Firefox are you using?

Firefox 10 Beta 3

> 
> Provide the crash ID from about:crashes or, if it's not possible, provide a
> stack trace with WinDbg:
> https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

The crash only occurs under linux. 
There is another strange thing. It only crashes using Firefox 10 Beta 3 release build. If I try the same with a debug build it's loading the page.

Comment 6

6 years ago
(In reply to tmax from comment #5)
> The crash only occurs under linux.
My bad! I gave you the wrong link:
https://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report#Linux
(Reporter)

Comment 7

6 years ago
Thanks, I'll give it a try.
(Reporter)

Comment 8

6 years ago
I just found out that is somehow connected to je_malloc_usable_size_in_advance.
This is exactly the point were it is crashing using FF10 release build.
The FF10 releasebuild contains  je_malloc_usable_size_in_advance in the firefox binary and a weak link to it in libxul.so.
FF10 Debug build doesn't contain je_malloc_usable_size_in_advance either in firefox binary or libxul.so.
As I wrote already : When using debug build the url is loaded but I get the following when I'm closing the embedded browser window :


###!!! ASSERTION: nsGlobalWindow not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file ../../../dom/base/nsGlobalWindow.cpp, line 1394
###!!! ABORT: imgCacheEntry release isn't thread-safe!: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file ../../../image/src/imgLoader.h, line 86
UNKNOWN [/home/tmax/ff_build/ff10dbg/libxul.so +0x003FA2BB]
UNKNOWN [/home/tmax/ff_build/ff10dbg/libxul.so +0x003FC563]
UNKNOWN [/home/tmax/ff_build/ff10dbg/libxul.so +0x0109790C]
UNKNOWN [/lib/i386-linux-gnu/libc.so.6 +0x0002FA6F]
UNKNOWN [/lib/i386-linux-gnu/libc.so.6 +0x0002FACF]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x00389BA4]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065EEF4]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065E791]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065D735]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065D941]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065DCA1]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x00520B11]
UNKNOWN [/lib/i386-linux-gnu/libpthread.so.0 +0x00005E99]
###!!! ABORT: imgCacheEntry release isn't thread-safe!: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file ../../../image/src/imgLoader.h, line 86
----- ff_test:stdout -----
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x005b0dd0, pid=16036, tid=2755779440
#
# JRE version: 6.0_22-b22
# Java VM: OpenJDK Server VM (20.0-b11 mixed mode linux-x86 )
# Derivative: IcedTea6 1.10.4
# Distribution: Ubuntu 11.04, package 6b22-1.10.4-0ubuntu1~11.04.1
# Problematic frame:
# C  [libmozalloc.so+0xdd0]  mozalloc_abort(char const*)+0x2d
#
# An error report file with more information is saved as:
# /home/tmax/hs_err_pid16036.log
#
# If you would like to submit a bug report, please include
# instructions how to reproduce the bug and visit:
#   https://bugs.launchpad.net/ubuntu/+source/openjdk-6/
#
++DOCSHELL 0x93e67a8 == 1
++DOMWINDOW == 1 (0xb725d28) [serial = 1] [outer = (nil)]
++DOMWINDOW == 2 (0xb1db740) [serial = 2] [outer = 0xb725ce0]
++DOMWINDOW == 3 (0xb0b78c8) [serial = 3] [outer = 0xb725ce0]
--DOMWINDOW == 2 (0xb1db740) [serial = 2] [outer = 0xb725ce0] [url = about:blank]
--DOCSHELL 0x93e67a8 == 0

Updated

6 years ago
Severity: normal → critical
Component: Untriaged → ImageLib
Keywords: crash
Product: Firefox → Core
QA Contact: untriaged → imagelib
Those asserts indicate that you're poking things that aren't threadsafe from random threads.  That could cause all sorts of issues.

Just to make sure, you compiled your JNI stuff against the same version you're running against?
Quitting from off the main thread would cause that crash. (Bug 529949)
(Reporter)

Comment 11

6 years ago
(In reply to Boris Zbarsky (:bz) from comment #9)
> Those asserts indicate that you're poking things that aren't threadsafe from
> random threads.  That could cause all sorts of issues.
> 
> Just to make sure, you compiled your JNI stuff against the same version
> you're running against?

Yes i did my own firefox build and the used the headers and libs of that build to embed firefox in my app. This was working nicely up to Firefox 9. Were there any critical changes which might cause the crash.
As I said already : Using FF-release build cause already a crash at startup
because  je_malloc_usable_size_in_advance seems to be not valid or not accessible.
(Reporter)

Comment 12

6 years ago
I found a solution on that now :
I'm linking the jemalloc.o in my lib and everything is working as expected.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.