Intermittent crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run, or, test_xhr_implicit_cancel.html

RESOLVED FIXED in Firefox 15

Status

()

Product:
Core
Component:
DOM
--
critical
RESOLVED FIXED
Reported:
6 years ago
Modified:
3 years ago

People

(Reporter: philor, Assigned: Ms2ger)

Tracking

({crash, intermittent-failure})

Version:
Trunk
Target:
mozilla17
x86
Windows XP
Keywords:
crash, intermittent-failure
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox15 fixed, firefox16 fixed)

Details

(Whiteboard: [test which aborts the suite][qa-], crash signature)

Attachments

(2 attachments)

stop running, stop crashing
780 bytes, patch
khuey
: review+
Details | Diff | Splinter Review
Null-check
1.61 KB, patch
Ben Turner (not reading bugmail, use the needinfo flag!)
: review+
lsblakk
: approval-mozilla-aurora+
lsblakk
: approval-mozilla-beta+
Details | Diff | Splinter Review
(Reporter)

Description

•
6 years ago 
Sneaky, putting your crash off until a test in an entirely different directory and component starts running.

https://tbpl.mozilla.org/php/getParsedLog.php?id=8559809&tree=Mozilla-Inbound
Rev3 WINNT 5.1 mozilla-inbound opt test mochitests-3/5 on 2012-01-14 21:49:54 PST for push https://tbpl.mozilla.org/?branch=mozilla-inbound&rev=b4195741db43

9719 INFO TEST-START | /tests/dom/workers/test/test_xhrAbort.html
readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent)
9720 INFO TEST-PASS | /tests/dom/workers/test/test_xhrAbort.html | Got different results! - readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent) should equal readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent)
9721 INFO TEST-END | /tests/dom/workers/test/test_xhrAbort.html | finished in 87ms
9722 INFO TEST-START | /tests/editor/composer/test/test_bug348497.html
TEST-UNEXPECTED-FAIL | /tests/editor/composer/test/test_bug348497.html | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:03:50.891000
INFO | automation.py | Reading PID log: c:\docume~1\cltbld\locals~1\temp\tmp9yvlpnpidlog
PROCESS-CRASH | /tests/editor/composer/test/test_bug348497.html | application crashed (minidump found)
Crash dump filename: c:\docume~1\cltbld\locals~1\temp\tmpgwpzdx\minidumps\749d831e-2bcd-4541-8f86-d36c708534cd.dmp
Operating system: Windows NT
                  5.1.2600 Service Pack 2
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x2c

Thread 34 (crashed)
 0  xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent(JSContext *,JSObject *,unsigned __int64,bool) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1922 + 0x0]
    eip = 0x0137aba7   esp = 0x154ff4c0   ebp = 0x154ff4ec   ebx = 0x00000000
    esi = 0x7fffffff   edi = 0x00000006   eax = 0x1430d370   ecx = 0x00000000
    edx = 0x0abe7960   efl = 0x00010246
    Found by: given as instruction pointer in context
 1  xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::MaybeDispatchPrematureAbortEvents(JSContext *) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1881 + 0x20]
    eip = 0x0137b178   esp = 0x154ff4f4   ebp = 0x154ff544   ebx = 0x00000000
    Found by: call frame info
 2  xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::Abort(JSContext *) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1549 + 0x7]
    eip = 0x0137b1ee   esp = 0x154ff54c   ebp = 0x154ff558   ebx = 0x01379105
    Found by: call frame info
 3  xul.dll!`anonymous namespace'::XMLHttpRequest::Abort(JSContext *,unsigned int,JS::Value *) [XMLHttpRequest.cpp:b4195741db43 : 618 + 0x9]
    eip = 0x01379141   esp = 0x154ff560   ebp = 0x154ff56c
    Found by: call frame info
 4  mozjs.dll!js::InvokeKernel(JSContext *,js::CallArgs,js::MaybeConstruct) [jsinterp.cpp:b4195741db43 : 521 + 0xf]
    eip = 0x00e2c95e   esp = 0x154ff574   ebp = 0x154ffaf4
    Found by: call frame info
 5  mozjs.dll!js::Interpret(JSContext *,js::StackFrame *,js::InterpMode) [jsinterp.cpp:b4195741db43 : 3013 + 0x10]
    eip = 0x00e31208   esp = 0x154ff5b0   ebp = 0x154ffaf4   ebx = 0x01ee2660
    Found by: call frame info
 6  mozjs.dll!js::types::TypeMonitorCallSlow(JSContext *,JSObject *,js::CallArgs const &,bool) [jsinfer.cpp:b4195741db43 : 5012 + 0x26]
    eip = 0x00e298ad   esp = 0x154ffac8   ebp = 0x2a2ab9b0   ebx = 0x13f00040
    Found by: call frame info with scanning
 7  mozjs.dll!js::types::NestingPrologue(JSContext *,js::StackFrame *) [jsinfer.cpp:b4195741db43 : 5370 + 0x10]
    eip = 0x00e2405e   esp = 0x154ffaf4   ebp = 0x154ffb04   ebx = 0x00ea6ab2
    Found by: call frame info with scanning
 8  mozjs.dll!js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::Value *) [jsinterp.cpp:b4195741db43 : 571 + 0x12]
    eip = 0x00e2b8c3   esp = 0x154ffb58   ebp = 0x154ffc20   ebx = 0x00e2ca06
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)

Comment 3

•
6 years ago 
Looks like XMLHttpRequestPrivate's mProxy is null.
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Assignee: nobody → bent.mozilla

Comment 52

•
6 years ago 
I'm not actively working on this, anyone is free to jump in.
Assignee: bent.mozilla → nobody
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
(Reporter)

Comment 55

•
6 years ago 
Created attachment 590972 [details] [diff] [review]
stop running, stop crashing

https://tbpl.mozilla.org/?tree=Try&rev=c8074027180e
Attachment #590972 - Flags: review?(khuey)
 (Reporter)

Updated

•
6 years ago
OS: Mac OS X → Windows XP
Summary: Intermittent crash [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run → Intermittent WinXP crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run
Whiteboard: [orange] → [orange][test which aborts the suite]
Comment hidden (Treeherder Robot)
Attachment #590972 - Flags: review?(khuey) → review+
 (Reporter)

Comment 57

•
6 years ago 
https://hg.mozilla.org/integration/mozilla-inbound/rev/388edf50e323
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][Leave open after merge]
Comment hidden (Treeherder Robot)

Comment 59

•
6 years ago 
Disabled on mozilla-central for Fx12:
https://hg.mozilla.org/mozilla-central/rev/388edf50e323
Whiteboard: [orange][test which aborts the suite][Leave open after merge] → [orange][test which aborts the suite][Leave open after merge][disabled in Fx12]
 (Reporter)

Updated

•
6 years ago
Whiteboard: [orange][test which aborts the suite][Leave open after merge][disabled in Fx12] → [orange][test which aborts the suite][disabled in Fx12]
Comment hidden (Treeherder Robot)
(Reporter)

Comment 61

•
5 years ago 
https://tbpl.mozilla.org/php/getParsedLog.php?id=9389239&tree=Mozilla-Inbound
Summary: Intermittent WinXP crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run → Intermittent crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run, or, test_xhr_implicit_cancel.html
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Blocks: 739037
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)

Updated

•
5 years ago
Crash Signature: [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent]
Keywords: crash
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)

Comment 88

•
5 years ago 
https://tbpl.mozilla.org/php/getParsedLog.php?id=12523208&tree=Mozilla-Inbound
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)

Updated

•
5 years ago
Severity: normal → critical
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
(Assignee)

Comment 211

•
5 years ago 
Created attachment 645763 [details] [diff] [review]
Null-check

As khuey said in comment 3, this needs a null check.
Attachment #645763 - Flags: review?(bent.mozilla)
Comment hidden (Treeherder Robot)

Comment 213

•
5 years ago 
Comment on attachment 645763 [details] [diff] [review]
Null-check

Review of attachment 645763 [details] [diff] [review]:
-----------------------------------------------------------------

I think this is ok. It's a little unclear how we end up in this situation, but I think what happens is that we're crashing in the second (or third) call to DispatchPrematureAbortEvents because the first call's event code ran a WorkerControlRunnable that started shutting down the worker.

It would probably be more correct to continue asserting mProxy in DispatchPrematureAbortEvents and then bailing out early if mProxy goes null in MaybeDispatchPrematureAbortEvents after the first (or second) call to DispatchPrematureAbortEvents. But this is less code and will probably work just as well.
Attachment #645763 - Flags: review?(bent.mozilla) → review+
Comment hidden (Treeherder Robot)
(Assignee)

Comment 215

•
5 years ago 
https://hg.mozilla.org/integration/mozilla-inbound/rev/ed387f7259d8
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)

Comment 219

•
5 years ago 
https://hg.mozilla.org/mozilla-central/rev/ed387f7259d8
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)

Updated

•
5 years ago
status-firefox15: --- → affected
status-firefox16: --- → affected

Comment 225

•
5 years ago 
Bent, would this be ok to backport to aurora/beta? :-)
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)

Comment 228

•
5 years ago 
Comment on attachment 645763 [details] [diff] [review]
Null-check

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Unknown
User impact if declined: Higher rates of [orange], possible crashes.
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): Low (null-check)
String or UUID changes made by this patch: None
Attachment #645763 - Flags: approval-mozilla-beta?
Attachment #645763 - Flags: approval-mozilla-aurora?
Comment hidden (Treeherder Robot)

Comment 230

•
5 years ago 
Comment on attachment 645763 [details] [diff] [review]
Null-check

null-check, low risk. approving for branches.
Attachment #645763 - Flags: approval-mozilla-beta?
Attachment #645763 - Flags: approval-mozilla-beta+
Attachment #645763 - Flags: approval-mozilla-aurora?
Attachment #645763 - Flags: approval-mozilla-aurora+

Comment 231

•
5 years ago 
https://hg.mozilla.org/releases/mozilla-beta/rev/a310ea157435
status-firefox15: affected → fixed

Comment 232

•
5 years ago 
https://hg.mozilla.org/releases/mozilla-aurora/rev/ad729a04c4fc
Assignee: nobody → Ms2ger
status-firefox16: affected → fixed
Whiteboard: [orange][test which aborts the suite][disabled in Fx12] → [orange][test which aborts the suite]

Updated

•
5 years ago
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][qa-]

Comment 233

•
5 years ago 
Ioana, please can you exclude all bugs that have [orange] in their whiteboard, from QA triage. I mentioned this in another bug a while back, but presume the QA saved searches were not updated. Thanks! :-)

Comment 234

•
5 years ago 
(In reply to Ed Morley (27th Aug is UK public holiday, back 28th) [:edmorley] from comment #233)
> Ioana, please can you exclude all bugs that have [orange] in their
> whiteboard, from QA triage. I mentioned this in another bug a while back,
> but presume the QA saved searches were not updated. Thanks! :-)

Thanks for the reminder Ed. You are right, not all searches were updated. I'll make sure to send an email and let everyone know they should update them.

Comment 235

•
5 years ago 
(In reply to Ioana Budnar [QA] from comment #234)
> Thanks for the reminder Ed. You are right, not all searches were updated.
> I'll make sure to send an email and let everyone know they should update
> them.

Thank you :-D
Keywords: intermittent-failure
Whiteboard: [orange][test which aborts the suite][qa-] → [test which aborts the suite][qa-]
You need to log in before you can comment on or make changes to this bug.