Closed Bug 718260 Opened 13 years ago Closed 13 years ago

Intermittent crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run, or, test_xhr_implicit_cancel.html

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla17
Tracking Flags:
Tracking Status
firefox15 --- fixed
firefox16 --- fixed

People

(Reporter: philor, Assigned: Ms2ger)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test which aborts the suite][qa-])

Crash Data

Attachments

(2 files)

stop running, stop crashing
780 bytes, patch
khuey
: review+
Details | Diff | Splinter Review
Null-check
1.61 KB, patch
bent.mozilla
: review+
lsblakk
: approval-mozilla-aurora+
lsblakk
: approval-mozilla-beta+
Details | Diff | Splinter Review
Sneaky, putting your crash off until a test in an entirely different directory and component starts running. https://tbpl.mozilla.org/php/getParsedLog.php?id=8559809&tree=Mozilla-Inbound Rev3 WINNT 5.1 mozilla-inbound opt test mochitests-3/5 on 2012-01-14 21:49:54 PST for push https://tbpl.mozilla.org/?branch=mozilla-inbound&rev=b4195741db43 9719 INFO TEST-START | /tests/dom/workers/test/test_xhrAbort.html readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent) 9720 INFO TEST-PASS | /tests/dom/workers/test/test_xhrAbort.html | Got different results! - readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent) should equal readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent) 9721 INFO TEST-END | /tests/dom/workers/test/test_xhrAbort.html | finished in 87ms 9722 INFO TEST-START | /tests/editor/composer/test/test_bug348497.html TEST-UNEXPECTED-FAIL | /tests/editor/composer/test/test_bug348497.html | Exited with code -1073741819 during test run INFO | automation.py | Application ran for: 0:03:50.891000 INFO | automation.py | Reading PID log: c:\docume~1\cltbld\locals~1\temp\tmp9yvlpnpidlog PROCESS-CRASH | /tests/editor/composer/test/test_bug348497.html | application crashed (minidump found) Crash dump filename: c:\docume~1\cltbld\locals~1\temp\tmpgwpzdx\minidumps\749d831e-2bcd-4541-8f86-d36c708534cd.dmp Operating system: Windows NT 5.1.2600 Service Pack 2 CPU: x86 GenuineIntel family 6 model 23 stepping 10 2 CPUs Crash reason: EXCEPTION_ACCESS_VIOLATION_READ Crash address: 0x2c Thread 34 (crashed) 0 xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent(JSContext *,JSObject *,unsigned __int64,bool) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1922 + 0x0] eip = 0x0137aba7 esp = 0x154ff4c0 ebp = 0x154ff4ec ebx = 0x00000000 esi = 0x7fffffff edi = 0x00000006 eax = 0x1430d370 ecx = 0x00000000 edx = 0x0abe7960 efl = 0x00010246 Found by: given as instruction pointer in context 1 xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::MaybeDispatchPrematureAbortEvents(JSContext *) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1881 + 0x20] eip = 0x0137b178 esp = 0x154ff4f4 ebp = 0x154ff544 ebx = 0x00000000 Found by: call frame info 2 xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::Abort(JSContext *) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1549 + 0x7] eip = 0x0137b1ee esp = 0x154ff54c ebp = 0x154ff558 ebx = 0x01379105 Found by: call frame info 3 xul.dll!`anonymous namespace'::XMLHttpRequest::Abort(JSContext *,unsigned int,JS::Value *) [XMLHttpRequest.cpp:b4195741db43 : 618 + 0x9] eip = 0x01379141 esp = 0x154ff560 ebp = 0x154ff56c Found by: call frame info 4 mozjs.dll!js::InvokeKernel(JSContext *,js::CallArgs,js::MaybeConstruct) [jsinterp.cpp:b4195741db43 : 521 + 0xf] eip = 0x00e2c95e esp = 0x154ff574 ebp = 0x154ffaf4 Found by: call frame info 5 mozjs.dll!js::Interpret(JSContext *,js::StackFrame *,js::InterpMode) [jsinterp.cpp:b4195741db43 : 3013 + 0x10] eip = 0x00e31208 esp = 0x154ff5b0 ebp = 0x154ffaf4 ebx = 0x01ee2660 Found by: call frame info 6 mozjs.dll!js::types::TypeMonitorCallSlow(JSContext *,JSObject *,js::CallArgs const &,bool) [jsinfer.cpp:b4195741db43 : 5012 + 0x26] eip = 0x00e298ad esp = 0x154ffac8 ebp = 0x2a2ab9b0 ebx = 0x13f00040 Found by: call frame info with scanning 7 mozjs.dll!js::types::NestingPrologue(JSContext *,js::StackFrame *) [jsinfer.cpp:b4195741db43 : 5370 + 0x10] eip = 0x00e2405e esp = 0x154ffaf4 ebp = 0x154ffb04 ebx = 0x00ea6ab2 Found by: call frame info with scanning 8 mozjs.dll!js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::Value *) [jsinterp.cpp:b4195741db43 : 571 + 0x12] eip = 0x00e2b8c3 esp = 0x154ffb58 ebp = 0x154ffc20 ebx = 0x00e2ca06
Looks like XMLHttpRequestPrivate's mProxy is null.
Assignee: nobody → bent.mozilla
I'm not actively working on this, anyone is free to jump in.
Assignee: bent.mozilla → nobody
OS: Mac OS X → Windows XP
Summary: Intermittent crash [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run → Intermittent WinXP crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run
Whiteboard: [orange] → [orange][test which aborts the suite]
https://hg.mozilla.org/integration/mozilla-inbound/rev/388edf50e323
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][Leave open after merge]
Disabled on mozilla-central for Fx12: https://hg.mozilla.org/mozilla-central/rev/388edf50e323
Whiteboard: [orange][test which aborts the suite][Leave open after merge] → [orange][test which aborts the suite][Leave open after merge][disabled in Fx12]
Whiteboard: [orange][test which aborts the suite][Leave open after merge][disabled in Fx12] → [orange][test which aborts the suite][disabled in Fx12]
https://tbpl.mozilla.org/php/getParsedLog.php?id=9389239&tree=Mozilla-Inbound
Summary: Intermittent WinXP crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run → Intermittent crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run, or, test_xhr_implicit_cancel.html
Crash Signature: [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent]
Keywords: crash
Severity: normal → critical
Attached patch Null-check — — Splinter Review
As khuey said in comment 3, this needs a null check.
Attachment #645763 - Flags: review?(bent.mozilla)
Comment on attachment 645763 [details] [diff] [review] Null-check Review of attachment 645763 [details] [diff] [review]: ----------------------------------------------------------------- I think this is ok. It's a little unclear how we end up in this situation, but I think what happens is that we're crashing in the second (or third) call to DispatchPrematureAbortEvents because the first call's event code ran a WorkerControlRunnable that started shutting down the worker. It would probably be more correct to continue asserting mProxy in DispatchPrematureAbortEvents and then bailing out early if mProxy goes null in MaybeDispatchPrematureAbortEvents after the first (or second) call to DispatchPrematureAbortEvents. But this is less code and will probably work just as well.
Attachment #645763 - Flags: review?(bent.mozilla) → review+
https://hg.mozilla.org/mozilla-central/rev/ed387f7259d8
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Bent, would this be ok to backport to aurora/beta? :-)
Comment on attachment 645763 [details] [diff] [review] Null-check [Approval Request Comment] Bug caused by (feature/regressing bug #): Unknown User impact if declined: Higher rates of [orange], possible crashes. Testing completed (on m-c, etc.): m-c Risk to taking this patch (and alternatives if risky): Low (null-check) String or UUID changes made by this patch: None
Attachment #645763 - Flags: approval-mozilla-beta?
Attachment #645763 - Flags: approval-mozilla-aurora?
Comment on attachment 645763 [details] [diff] [review] Null-check null-check, low risk. approving for branches.
Attachment #645763 - Flags: approval-mozilla-beta?
Attachment #645763 - Flags: approval-mozilla-beta+
Attachment #645763 - Flags: approval-mozilla-aurora?
Attachment #645763 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/ad729a04c4fc
Assignee: nobody → Ms2ger
status-firefox16: affected → fixed
Whiteboard: [orange][test which aborts the suite][disabled in Fx12] → [orange][test which aborts the suite]
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][qa-]
Ioana, please can you exclude all bugs that have [orange] in their whiteboard, from QA triage. I mentioned this in another bug a while back, but presume the QA saved searches were not updated. Thanks! :-)
(In reply to Ed Morley (27th Aug is UK public holiday, back 28th) [:edmorley] from comment #233) > Ioana, please can you exclude all bugs that have [orange] in their > whiteboard, from QA triage. I mentioned this in another bug a while back, > but presume the QA saved searches were not updated. Thanks! :-) Thanks for the reminder Ed. You are right, not all searches were updated. I'll make sure to send an email and let everyone know they should update them.
(In reply to Ioana Budnar [QA] from comment #234) > Thanks for the reminder Ed. You are right, not all searches were updated. > I'll make sure to send an email and let everyone know they should update > them. Thank you :-D
Whiteboard: [orange][test which aborts the suite][qa-] → [test which aborts the suite][qa-]
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: