Closed Bug 718260 Opened 9 years ago Closed 8 years ago

Intermittent crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run, or, test_xhr_implicit_cancel.html

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla17
Tracking Flags:
Tracking Status
firefox15 --- fixed
firefox16 --- fixed

People

(Reporter: philor, Assigned: Ms2ger)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test which aborts the suite][qa-])

Crash Data

Attachments

(2 files)

stop running, stop crashing
780 bytes, patch
khuey
: review+
Details | Diff | Splinter Review
Null-check
1.61 KB, patch
bent.mozilla
: review+
lsblakk
: approval-mozilla-aurora+
lsblakk
: approval-mozilla-beta+
Details | Diff | Splinter Review 
Sneaky, putting your crash off until a test in an entirely different directory and component starts running.

https://tbpl.mozilla.org/php/getParsedLog.php?id=8559809&tree=Mozilla-Inbound
Rev3 WINNT 5.1 mozilla-inbound opt test mochitests-3/5 on 2012-01-14 21:49:54 PST for push https://tbpl.mozilla.org/?branch=mozilla-inbound&rev=b4195741db43

9719 INFO TEST-START | /tests/dom/workers/test/test_xhrAbort.html
readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent)
9720 INFO TEST-PASS | /tests/dom/workers/test/test_xhrAbort.html | Got different results! - readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent) should equal readystatechange(1, '', [exception], ''),readystatechange(1, '', [exception], ''),readystatechange(2, '', 200, 'OK'),readystatechange(4, '', 200, 'OK'),abort(4, '', 200, 'OK', progressEvent)
9721 INFO TEST-END | /tests/dom/workers/test/test_xhrAbort.html | finished in 87ms
9722 INFO TEST-START | /tests/editor/composer/test/test_bug348497.html
TEST-UNEXPECTED-FAIL | /tests/editor/composer/test/test_bug348497.html | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:03:50.891000
INFO | automation.py | Reading PID log: c:\docume~1\cltbld\locals~1\temp\tmp9yvlpnpidlog
PROCESS-CRASH | /tests/editor/composer/test/test_bug348497.html | application crashed (minidump found)
Crash dump filename: c:\docume~1\cltbld\locals~1\temp\tmpgwpzdx\minidumps\749d831e-2bcd-4541-8f86-d36c708534cd.dmp
Operating system: Windows NT
                  5.1.2600 Service Pack 2
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x2c

Thread 34 (crashed)
 0  xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent(JSContext *,JSObject *,unsigned __int64,bool) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1922 + 0x0]
    eip = 0x0137aba7   esp = 0x154ff4c0   ebp = 0x154ff4ec   ebx = 0x00000000
    esi = 0x7fffffff   edi = 0x00000006   eax = 0x1430d370   ecx = 0x00000000
    edx = 0x0abe7960   efl = 0x00010246
    Found by: given as instruction pointer in context
 1  xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::MaybeDispatchPrematureAbortEvents(JSContext *) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1881 + 0x20]
    eip = 0x0137b178   esp = 0x154ff4f4   ebp = 0x154ff544   ebx = 0x00000000
    Found by: call frame info
 2  xul.dll!mozilla::dom::workers::xhr::XMLHttpRequestPrivate::Abort(JSContext *) [XMLHttpRequestPrivate.cpp:b4195741db43 : 1549 + 0x7]
    eip = 0x0137b1ee   esp = 0x154ff54c   ebp = 0x154ff558   ebx = 0x01379105
    Found by: call frame info
 3  xul.dll!`anonymous namespace'::XMLHttpRequest::Abort(JSContext *,unsigned int,JS::Value *) [XMLHttpRequest.cpp:b4195741db43 : 618 + 0x9]
    eip = 0x01379141   esp = 0x154ff560   ebp = 0x154ff56c
    Found by: call frame info
 4  mozjs.dll!js::InvokeKernel(JSContext *,js::CallArgs,js::MaybeConstruct) [jsinterp.cpp:b4195741db43 : 521 + 0xf]
    eip = 0x00e2c95e   esp = 0x154ff574   ebp = 0x154ffaf4
    Found by: call frame info
 5  mozjs.dll!js::Interpret(JSContext *,js::StackFrame *,js::InterpMode) [jsinterp.cpp:b4195741db43 : 3013 + 0x10]
    eip = 0x00e31208   esp = 0x154ff5b0   ebp = 0x154ffaf4   ebx = 0x01ee2660
    Found by: call frame info
 6  mozjs.dll!js::types::TypeMonitorCallSlow(JSContext *,JSObject *,js::CallArgs const &,bool) [jsinfer.cpp:b4195741db43 : 5012 + 0x26]
    eip = 0x00e298ad   esp = 0x154ffac8   ebp = 0x2a2ab9b0   ebx = 0x13f00040
    Found by: call frame info with scanning
 7  mozjs.dll!js::types::NestingPrologue(JSContext *,js::StackFrame *) [jsinfer.cpp:b4195741db43 : 5370 + 0x10]
    eip = 0x00e2405e   esp = 0x154ffaf4   ebp = 0x154ffb04   ebx = 0x00ea6ab2
    Found by: call frame info with scanning
 8  mozjs.dll!js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::Value *) [jsinterp.cpp:b4195741db43 : 571 + 0x12]
    eip = 0x00e2b8c3   esp = 0x154ffb58   ebp = 0x154ffc20   ebx = 0x00e2ca06
Looks like XMLHttpRequestPrivate's mProxy is null.
Assignee: nobody → bent.mozilla
I'm not actively working on this, anyone is free to jump in.
Assignee: bent.mozilla → nobody
OS: Mac OS X → Windows XP
Summary: Intermittent crash [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run → Intermittent WinXP crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run
Whiteboard: [orange] → [orange][test which aborts the suite]
https://hg.mozilla.org/integration/mozilla-inbound/rev/388edf50e323
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][Leave open after merge]
Disabled on mozilla-central for Fx12:
https://hg.mozilla.org/mozilla-central/rev/388edf50e323
Whiteboard: [orange][test which aborts the suite][Leave open after merge] → [orange][test which aborts the suite][Leave open after merge][disabled in Fx12]
Whiteboard: [orange][test which aborts the suite][Leave open after merge][disabled in Fx12] → [orange][test which aborts the suite][disabled in Fx12]
https://tbpl.mozilla.org/php/getParsedLog.php?id=9389239&tree=Mozilla-Inbound
Summary: Intermittent WinXP crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run → Intermittent crash in test_xhrAbort.html [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent] pretending to be test_bug348497.html | Exited with code -1073741819 during test run, or, test_xhr_implicit_cancel.html
Crash Signature: [@ mozilla::dom::workers::xhr::XMLHttpRequestPrivate::DispatchPrematureAbortEvent]
Keywords: crash
Severity: normal → critical
Attached patch Null-check — — Splinter Review 
As khuey said in comment 3, this needs a null check.
Attachment #645763 - Flags: review?(bent.mozilla)
Comment on attachment 645763 [details] [diff] [review]
Null-check

Review of attachment 645763 [details] [diff] [review]:
-----------------------------------------------------------------

I think this is ok. It's a little unclear how we end up in this situation, but I think what happens is that we're crashing in the second (or third) call to DispatchPrematureAbortEvents because the first call's event code ran a WorkerControlRunnable that started shutting down the worker.

It would probably be more correct to continue asserting mProxy in DispatchPrematureAbortEvents and then bailing out early if mProxy goes null in MaybeDispatchPrematureAbortEvents after the first (or second) call to DispatchPrematureAbortEvents. But this is less code and will probably work just as well.
Attachment #645763 - Flags: review?(bent.mozilla) → review+
https://hg.mozilla.org/mozilla-central/rev/ed387f7259d8
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Bent, would this be ok to backport to aurora/beta? :-)
Comment on attachment 645763 [details] [diff] [review]
Null-check

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Unknown
User impact if declined: Higher rates of [orange], possible crashes.
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): Low (null-check)
String or UUID changes made by this patch: None
Attachment #645763 - Flags: approval-mozilla-beta?
Attachment #645763 - Flags: approval-mozilla-aurora?
Comment on attachment 645763 [details] [diff] [review]
Null-check

null-check, low risk. approving for branches.
Attachment #645763 - Flags: approval-mozilla-beta?
Attachment #645763 - Flags: approval-mozilla-beta+
Attachment #645763 - Flags: approval-mozilla-aurora?
Attachment #645763 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/ad729a04c4fc
Assignee: nobody → Ms2ger
status-firefox16: affected → fixed
Whiteboard: [orange][test which aborts the suite][disabled in Fx12] → [orange][test which aborts the suite]
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][qa-]
Ioana, please can you exclude all bugs that have [orange] in their whiteboard, from QA triage. I mentioned this in another bug a while back, but presume the QA saved searches were not updated. Thanks! :-)
(In reply to Ed Morley (27th Aug is UK public holiday, back 28th) [:edmorley] from comment #233)
> Ioana, please can you exclude all bugs that have [orange] in their
> whiteboard, from QA triage. I mentioned this in another bug a while back,
> but presume the QA saved searches were not updated. Thanks! :-)

Thanks for the reminder Ed. You are right, not all searches were updated. I'll make sure to send an email and let everyone know they should update them.
(In reply to Ioana Budnar [QA] from comment #234)
> Thanks for the reminder Ed. You are right, not all searches were updated.
> I'll make sure to send an email and let everyone know they should update
> them.

Thank you :-D
Whiteboard: [orange][test which aborts the suite][qa-] → [test which aborts the suite][qa-]
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.