716490 - nsiWebNavigation->LoadURI crashes in embedded Firefox 10

Status: RESOLVED INVALID

(Core :: Graphics: ImageLib, defect)

Description

[tmax]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7

Steps to reproduce:

embed Firefox in my Application (did that already since ersion 1.8 without a problem) and call nsiWebNavigation->LoadURI
The loadURI is triggered using JNI since my controller Application is Java.

mWebNav->LoadURI(mCurrentURI.get(), nsIWebNavigation::LOAD_FLAGS_IS_LINK, NULL, NULL, NULL);

The Strange thing is that the crash only occurs on a Firefox Release Build. A Firefox Debug Build is not crashing at this point, but code which is called afterwards is also not executed.

Does anybody have an idea on this behaviour ?


Actual results:

Firefox crashed with the following :


#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00000000, pid=13761, tid=2789759856
#
# JRE version: 6.0_18-b07
# Java VM: Java HotSpot(TM) Client VM (16.0-b13 mixed mode linux-x86 )
# Problematic frame:
# C  0x00000000
#
# An error report file with more information is saved as:
# /home/tmax/crypt/prj/install/qftest/latest/bin/hs_err_pid13761.log
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#



Expected results:

Page should load as expected.

Comment 1

[Scoobidiver (away)]

It's Java that crashes, not Firefox.
Please update to the latest Java version: 6.0_30.

Comment 2

[tmax]

Doesn't depend on the Java Version. Even when updated to 6.0_30 the crash occurs.

Comment 3

[tmax]

(In reply to Scoobidiver from comment #1)
> It's Java that crashes, not Firefox.
> Please update to the latest Java version: 6.0_30.

Doesn't depend on the Java Version. Even when updated to 6.0_30 the crash occurs.

Comment 4

[Scoobidiver (away)]

(In reply to tmax from comment #3)
> Doesn't depend on the Java Version. Even when updated to 6.0_30 the crash
> occurs.
That could mean it's not fixed in the latest Java version.

Which version of Firefox are you using?

Provide the crash ID from about:crashes or, if it's not possible, provide a stack trace with WinDbg: https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

Comment 5

[tmax]

(In reply to Scoobidiver from comment #4)
> (In reply to tmax from comment #3)
> > Doesn't depend on the Java Version. Even when updated to 6.0_30 the crash
> > occurs.
> That could mean it's not fixed in the latest Java version.
> 
> Which version of Firefox are you using?

Firefox 10 Beta 3

> 
> Provide the crash ID from about:crashes or, if it's not possible, provide a
> stack trace with WinDbg:
> https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

The crash only occurs under linux. 
There is another strange thing. It only crashes using Firefox 10 Beta 3 release build. If I try the same with a debug build it's loading the page.

Comment 6

[Scoobidiver (away)]

(In reply to tmax from comment #5)
> The crash only occurs under linux.
My bad! I gave you the wrong link:
https://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report#Linux

Comment 7

[tmax]

Thanks, I'll give it a try.

Comment 8

[tmax]

I just found out that is somehow connected to je_malloc_usable_size_in_advance.
This is exactly the point were it is crashing using FF10 release build.
The FF10 releasebuild contains  je_malloc_usable_size_in_advance in the firefox binary and a weak link to it in libxul.so.
FF10 Debug build doesn't contain je_malloc_usable_size_in_advance either in firefox binary or libxul.so.
As I wrote already : When using debug build the url is loaded but I get the following when I'm closing the embedded browser window :


###!!! ASSERTION: nsGlobalWindow not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file ../../../dom/base/nsGlobalWindow.cpp, line 1394
###!!! ABORT: imgCacheEntry release isn't thread-safe!: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file ../../../image/src/imgLoader.h, line 86
UNKNOWN [/home/tmax/ff_build/ff10dbg/libxul.so +0x003FA2BB]
UNKNOWN [/home/tmax/ff_build/ff10dbg/libxul.so +0x003FC563]
UNKNOWN [/home/tmax/ff_build/ff10dbg/libxul.so +0x0109790C]
UNKNOWN [/lib/i386-linux-gnu/libc.so.6 +0x0002FA6F]
UNKNOWN [/lib/i386-linux-gnu/libc.so.6 +0x0002FACF]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x00389BA4]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065EEF4]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065E791]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065D735]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065D941]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x0065DCA1]
UNKNOWN [/usr/lib/jvm/java-6-openjdk/jre/lib/i386/server/libjvm.so +0x00520B11]
UNKNOWN [/lib/i386-linux-gnu/libpthread.so.0 +0x00005E99]
###!!! ABORT: imgCacheEntry release isn't thread-safe!: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file ../../../image/src/imgLoader.h, line 86
----- ff_test:stdout -----
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x005b0dd0, pid=16036, tid=2755779440
#
# JRE version: 6.0_22-b22
# Java VM: OpenJDK Server VM (20.0-b11 mixed mode linux-x86 )
# Derivative: IcedTea6 1.10.4
# Distribution: Ubuntu 11.04, package 6b22-1.10.4-0ubuntu1~11.04.1
# Problematic frame:
# C  [libmozalloc.so+0xdd0]  mozalloc_abort(char const*)+0x2d
#
# An error report file with more information is saved as:
# /home/tmax/hs_err_pid16036.log
#
# If you would like to submit a bug report, please include
# instructions how to reproduce the bug and visit:
#   https://bugs.launchpad.net/ubuntu/+source/openjdk-6/
#
++DOCSHELL 0x93e67a8 == 1
++DOMWINDOW == 1 (0xb725d28) [serial = 1] [outer = (nil)]
++DOMWINDOW == 2 (0xb1db740) [serial = 2] [outer = 0xb725ce0]
++DOMWINDOW == 3 (0xb0b78c8) [serial = 3] [outer = 0xb725ce0]
--DOMWINDOW == 2 (0xb1db740) [serial = 2] [outer = 0xb725ce0] [url = about:blank]
--DOCSHELL 0x93e67a8 == 0

Comment 9

[Boris Zbarsky [:bzbarsky]]

Those asserts indicate that you're poking things that aren't threadsafe from random threads.  That could cause all sorts of issues.

Just to make sure, you compiled your JNI stuff against the same version you're running against?

Comment 10

[Joe Drew (not getting mail)]

Quitting from off the main thread would cause that crash. (Bug 529949)

Comment 11

[tmax]

(In reply to Boris Zbarsky (:bz) from comment #9)
> Those asserts indicate that you're poking things that aren't threadsafe from
> random threads.  That could cause all sorts of issues.
> 
> Just to make sure, you compiled your JNI stuff against the same version
> you're running against?

Yes i did my own firefox build and the used the headers and libs of that build to embed firefox in my app. This was working nicely up to Firefox 9. Were there any critical changes which might cause the crash.
As I said already : Using FF-release build cause already a crash at startup
because  je_malloc_usable_size_in_advance seems to be not valid or not accessible.

Comment 12

[tmax]

I found a solution on that now :
I'm linking the jemalloc.o in my lib and everything is working as expected.