Closed Bug 742455 Opened 13 years ago Closed 6 years ago

Intermittent crashtest content/xul/templates/src/crashtests/397148-1.xul, 330010-1.xul, 330012-1.xul | Exited with code -1073741819 during test run [@ RDFContentSinkImpl::HandleEndElement]

Categories

(Core :: XUL, defect, P3)

Product:
Core
Component:
XUL
Version:
14 Branch
Platform:
x86
Windows 7
Type:
defect

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: mbrubeck, Unassigned)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test which aborts the suite][test disabled on windows])

Crash Data

Attachments

(2 files, 1 obsolete file)

log with refcount tracing
31.06 KB, application/bzip2
Details
add a lock
6.73 KB, patch
bzbarsky
: feedback-
Details | Diff | Splinter Review
https://tbpl.mozilla.org/php/getParsedLog.php?id=10634436&tree=Mozilla-Inbound Rev3 WINNT 6.1 mozilla-inbound debug test crashtest on 2012-04-04 06:38:39 PDT for push ba7f8495dd57 REFTEST TEST-START | http://localhost:4444/1333546904765/1/330010-1.xul | 391 / 2040 (19%) ++DOMWINDOW == 64 (04EA3680) [serial = 885] [outer = 053E5138] Security Error: Content at file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/329884-1.xul may not load data from file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/1.rdf. JavaScript error: http://localhost:4444/1333546904765/1/330010-1.xul, line 14: generatedShape is undefined REFTEST TEST-PASS | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330010-1.xul | (LOAD ONLY) REFTEST INFO | Loading a blank page ++DOMWINDOW == 65 (086A3EB0) [serial = 886] [outer = 053E5138] REFTEST TEST-START | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | 392 / 2040 (19%) ++DOMWINDOW == 66 (087B5430) [serial = 887] [outer = 053E5138] --DOMWINDOW == 65 (0B0B1E20) [serial = 850] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/content/xul/content/crashtests/431906-1-inner.xul] --DOMWINDOW == 64 (086A73D8) [serial = 828] [outer = 00000000] [url = data:text/html,] --DOMWINDOW == 63 (08E754E0) [serial = 840] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/content/xul/content/crashtests/384877-1-inner.xul] --DOMWINDOW == 62 (04EA2AB0) [serial = 864] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/content/xul/document/crashtests/386914-1-inner.xul] WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8738 WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8738 WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8738 WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8738 REFTEST TEST-PASS | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | (LOAD ONLY) REFTEST INFO | Loading a blank page ++DOMWINDOW == 63 (0B23ECC0) [serial = 888] [outer = 053E5138] TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | Exited with code -1073741819 during test run INFO | automation.py | Application ran for: 0:02:33.300000 INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmpywaaonpidlog Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-debug/1333539620/firefox-14.0a1.en-US.win32.crashreporter-symbols.zip PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | application crashed (minidump found) Crash dump filename: c:\users\cltbld\appdata\local\temp\tmphepii8\minidumps\7a0646fb-008d-46b9-afdd-14a9f5230ad4.dmp Operating system: Windows NT 6.1.7600 CPU: x86 GenuineIntel family 6 model 23 stepping 10 2 CPUs Crash reason: EXCEPTION_ACCESS_VIOLATION_READ Crash address: 0xffffffffccccccc5 Thread 0 (crashed) 0 xul.dll!PL_DHashTableOperate [pldhash.cpp:ba7f8495dd57 : 609 + 0x15] eip = 0x69839a3f esp = 0x0026d348 ebp = 0x0026d358 ebx = 0x0b80eaf0 esi = 0x0b80eb28 edi = 0x0b80eb28 eax = 0xeeeeeee8 ecx = 0xdddddddd edx = 0x051e0c78 efl = 0x00210a03 Found by: given as instruction pointer in context 1 xul.dll!nsTHashtable<nsBaseHashtableET<nsISupportsHashKey,nsAutoPtr<nsCOMArray<nsXULTemplateResultRDF> > > >::GetEntry(nsISupports *) [nsTHashtable.h:ba7f8495dd57 : 170 + 0xb] eip = 0x692e87c7 esp = 0x0026d360 ebp = 0x0026d368 Found by: call frame info 2 xul.dll!nsClassHashtable<nsISupportsHashKey,nsCOMArray<nsXULTemplateResultRDF> >::Get(nsISupports *,nsCOMArray<nsXULTemplateResultRDF> * *) [nsClassHashtable.h:ba7f8495dd57 : 120 + 0x7] eip = 0x692e9647 esp = 0x0026d370 ebp = 0x0026d374 Found by: call frame info 3 xul.dll!nsXULTemplateQueryProcessorRDF::SynchronizeAll(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,nsIRDFNode *) [nsXULTemplateQueryProcessorRDF.cpp:ba7f8495dd57 : 1061 + 0x10] eip = 0x692ea5ed esp = 0x0026d37c ebp = 0x0026d3a0 Found by: call frame info 4 xul.dll!nsXULTemplateQueryProcessorRDF::OnAssert(nsIRDFDataSource *,nsIRDFResource *,nsIRDFResource *,nsIRDFNode *) [nsXULTemplateQueryProcessorRDF.cpp:ba7f8495dd57 : 818 + 0x11] eip = 0x692ece3b esp = 0x0026d3a8 ebp = 0x0026d3bc Found by: call frame info 5 xul.dll!CompositeDataSourceImpl::OnAssert(nsIRDFDataSource *,nsIRDFResource *,nsIRDFResource *,nsIRDFNode *) [nsCompositeDataSource.cpp:ba7f8495dd57 : 1410 + 0x17] eip = 0x6958d029 esp = 0x0026d3c4 ebp = 0x0026d3e4 Found by: call frame info 6 xul.dll!InMemoryDataSource::Assert(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,bool) [nsInMemoryDataSource.cpp:ba7f8495dd57 : 1394 + 0xf] eip = 0x69590501 esp = 0x0026d3ec ebp = 0x0026d40c Found by: call frame info 7 xul.dll!RDFXMLDataSourceImpl::Assert(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,bool) [nsRDFXMLDataSource.cpp:ba7f8495dd57 : 671 + 0x18] eip = 0x69599c38 esp = 0x0026d414 ebp = 0x0026d43c Found by: call frame info 8 xul.dll!RDFContentSinkImpl::HandleEndElement(wchar_t const *) [nsRDFContentSink.cpp:ba7f8495dd57 : 520 + 0x2d] eip = 0x695936f6 esp = 0x0026d444 ebp = 0x0026d50c Found by: call frame info 9 xul.dll!nsExpatDriver::HandleEndElement(wchar_t const *) [nsExpatDriver.cpp:ba7f8495dd57 : 426 + 0x10] eip = 0x68c97138 esp = 0x0026d514 ebp = 0x0026d528 Found by: call frame info 10 xul.dll!Driver_HandleEndElement [nsExpatDriver.cpp:ba7f8495dd57 : 106 + 0x7] eip = 0x68c97ab5 esp = 0x0026d530 ebp = 0x0026d534 Found by: call frame info 11 xul.dll!doContent [xmlparse.c:ba7f8495dd57 : 2499 + 0x8] eip = 0x68cac0c0 esp = 0x0026d53c ebp = 0x0026d59c Found by: call frame info 12 xul.dll!contentProcessor [xmlparse.c:ba7f8495dd57 : 2044 + 0x28] eip = 0x68cac51e esp = 0x0026d5a4 ebp = 0x0026d5c8 Found by: call frame info 13 xul.dll!doProlog [xmlparse.c:ba7f8495dd57 : 4024 + 0x18] eip = 0x68cada62 esp = 0x0026d5d0 ebp = 0x0026d600 Found by: call frame info 14 xul.dll!prologProcessor [xmlparse.c:ba7f8495dd57 : 3759 + 0x24] eip = 0x68cadbd5 esp = 0x0026d608 ebp = 0x0026d640 Found by: call frame info 15 xul.dll!prologInitProcessor [xmlparse.c:ba7f8495dd57 : 3575 + 0x18] eip = 0x68cadd5c esp = 0x0026d648 ebp = 0x0026d65c Found by: call frame info 16 xul.dll!MOZ_XML_Parse [xmlparse.c:ba7f8495dd57 : 1520 + 0x1e] eip = 0x68ca992c esp = 0x0026d664 ebp = 0x0026d684 Found by: call frame info 17 xul.dll!nsExpatDriver::ParseBuffer(wchar_t const *,unsigned int,bool,unsigned int *) [nsExpatDriver.cpp:ba7f8495dd57 : 1022 + 0x15] eip = 0x68c965db esp = 0x0026d68c ebp = 0x0026d6ac Found by: call frame info 18 xul.dll!nsExpatDriver::ConsumeToken(nsScanner &,bool &) [nsExpatDriver.cpp:ba7f8495dd57 : 1120 + 0x1b] eip = 0x68c9917a esp = 0x0026d6b4 ebp = 0x0026d7f8 Found by: call frame info 19 xul.dll!nsParser::Tokenize(bool) [nsParser.cpp:ba7f8495dd57 : 2276 + 0x1a] eip = 0x68ca4dff esp = 0x0026d800 ebp = 0x0026d824 Found by: call frame info 20 xul.dll!nsParser::ResumeParse(bool,bool,bool) [nsParser.cpp:ba7f8495dd57 : 1566 + 0x12] eip = 0x68ca5026 esp = 0x0026d82c ebp = 0x0026d844 Found by: call frame info 21 xul.dll!nsParser::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsParser.cpp:ba7f8495dd57 : 2158 + 0xb] eip = 0x68ca3682 esp = 0x0026d84c ebp = 0x0026d888 Found by: call frame info 22 xul.dll!RDFXMLDataSourceImpl::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsRDFXMLDataSource.cpp:ba7f8495dd57 : 1179 + 0x1f] eip = 0x69599a2d esp = 0x0026d890 ebp = 0x0026d8a8 Found by: call frame info 23 xul.dll!nsStreamListenerTee::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsStreamListenerTee.cpp:ba7f8495dd57 : 122 + 0x1c] eip = 0x68bb8766 esp = 0x0026d8b0 ebp = 0x0026d8e4 Found by: call frame info 24 xul.dll!nsHttpChannel::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsHttpChannel.cpp:ba7f8495dd57 : 4608 + 0x3c] eip = 0x68c25183 esp = 0x0026d8ec ebp = 0x0026d91c Found by: call frame info 25 xul.dll!nsInputStreamPump::OnStateTransfer() [nsInputStreamPump.cpp:ba7f8495dd57 : 514 + 0x1b] eip = 0x68b9ab80 esp = 0x0026d924 ebp = 0x0026d968 Found by: call frame info 26 xul.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *) [nsInputStreamPump.cpp:ba7f8495dd57 : 402 + 0x7] eip = 0x68b9b1bf esp = 0x0026d970 ebp = 0x0026d97c Found by: call frame info 27 xul.dll!nsInputStreamReadyEvent::Run() [nsStreamUtils.cpp:ba7f8495dd57 : 114 + 0x10] eip = 0x69860fd8 esp = 0x0026d984 ebp = 0x0026d994 Found by: call frame info 28 xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:ba7f8495dd57 : 656 + 0xd] eip = 0x69875aa6 esp = 0x0026d99c ebp = 0x0026d9c4 Found by: call frame info 29 xul.dll!NS_ProcessNextEvent_P(nsIThread *,bool) [nsThreadUtils.cpp:ba7f8495dd57 : 245 + 0xc] eip = 0x69838648 esp = 0x0026d9cc ebp = 0x0026d9d8 Found by: call frame info 30 xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [MessagePump.cpp:ba7f8495dd57 : 110 + 0x9] eip = 0x6974c2aa esp = 0x0026d9e0 ebp = 0x0026da04 Found by: call frame info 31 xul.dll!MessageLoop::RunInternal() [message_loop.cc:ba7f8495dd57 : 208 + 0x8] eip = 0x698a86f3 esp = 0x0026da0c ebp = 0x0026da24 Found by: call frame info 32 xul.dll!MessageLoop::RunHandler() [message_loop.cc:ba7f8495dd57 : 201 + 0x4] eip = 0x698a8c30 esp = 0x0026da2c ebp = 0x0026da58 Found by: call frame info 33 xul.dll!MessageLoop::Run() [message_loop.cc:ba7f8495dd57 : 175 + 0x6] eip = 0x698a90fb esp = 0x0026da60 ebp = 0x0026da78 Found by: call frame info 34 xul.dll!nsBaseAppShell::Run() [nsBaseAppShell.cpp:ba7f8495dd57 : 189 + 0xb] eip = 0x69687df7 esp = 0x0026da80 ebp = 0x0026da88 Found by: call frame info 35 xul.dll!nsAppShell::Run() [nsAppShell.cpp:ba7f8495dd57 : 267 + 0x5] eip = 0x69657093 esp = 0x0026da90 ebp = 0x0026f9dc Found by: call frame info 36 xul.dll!nsAppStartup::Run() [nsAppStartup.cpp:ba7f8495dd57 : 295 + 0x11] eip = 0x694eba00 esp = 0x0026f9e4 ebp = 0x0026f9ec Found by: call frame info 37 xul.dll!XREMain::XRE_mainRun() [nsAppRunner.cpp:ba7f8495dd57 : 3772 + 0xd] eip = 0x68b6cc69 esp = 0x0026f9f4 ebp = 0x0026fac0 Found by: call frame info 38 xul.dll!XREMain::XRE_main(int,char * * const,nsXREAppData const *) [nsAppRunner.cpp:ba7f8495dd57 : 3849 + 0x6] eip = 0x68b6cdec esp = 0x0026fac8 ebp = 0x0026fad8 Found by: call frame info 39 xul.dll!XRE_main [nsAppRunner.cpp:ba7f8495dd57 : 3925 + 0x11] eip = 0x68b6cf51 esp = 0x0026fae0 ebp = 0x0026fbe8 Found by: call frame info 40 firefox.exe!do_main [nsBrowserApp.cpp:ba7f8495dd57 : 190 + 0xe] eip = 0x008f1bc9 esp = 0x0026fbf0 ebp = 0x0026fd1c Found by: call frame info 41 firefox.exe!NS_internal_main(int,char * *) [nsBrowserApp.cpp:ba7f8495dd57 : 277 + 0xd] eip = 0x008f1dec esp = 0x0026fd24 ebp = 0x0026fea4 Found by: call frame info 42 firefox.exe!wmain [nsWindowsWMain.cpp:ba7f8495dd57 : 107 + 0x6] eip = 0x008f1f5b esp = 0x0026feac ebp = 0x0026fed8 Found by: call frame info 43 firefox.exe!__tmainCRTStartup [crtexe.c : 552 + 0x18] eip = 0x008f537f esp = 0x0026fee0 ebp = 0x0026ff28 Found by: call frame info 44 firefox.exe!wmainCRTStartup [crtexe.c : 370 + 0x4] eip = 0x008f51af esp = 0x0026ff30 ebp = 0x0026ff30 Found by: call frame info 45 kernel32.dll + 0x51173 eip = 0x757c1174 esp = 0x0026ff38 ebp = 0x0026ff3c Found by: call frame info 46 ntdll.dll + 0x5b3f4 eip = 0x76ebb3f5 esp = 0x0026ff44 ebp = 0x0026ff7c Found by: previous frame's frame pointer 47 ntdll.dll + 0x5b3c7 eip = 0x76ebb3c8 esp = 0x0026ff84 ebp = 0x0026ff94 Found by: previous frame's frame pointer
https://tbpl.mozilla.org/php/getParsedLog.php?id=10627714&full=1&branch=mozilla-inbound Rev3 WINNT 6.1 mozilla-inbound debug test crashtest on 2012-04-04 00:28:37 PDT for push f64f62213f61 REFTEST TEST-START | file:///C:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/397148-1.xul | 393 / 2040 (19%) WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735 WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735 WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735 WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735 WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735 WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735 TEST-UNEXPECTED-FAIL | file:///C:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/397148-1.xul | Exited with code -1073741819 during test run INFO | automation.py | Application ran for: 0:02:29.518000 INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmp2yrhazpidlog Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-debug/1333518442/firefox-14.0a1.en-US.win32.crashreporter-symbols.zip PROCESS-CRASH | file:///C:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/397148-1.xul | application crashed (minidump found) Crash dump filename: c:\users\cltbld\appdata\local\temp\tmpd_jeol\minidumps\c20c368c-469a-452c-8716-33d255fb8fda.dmp Operating system: Windows NT 6.1.7600 CPU: x86 GenuineIntel family 6 model 23 stepping 10 2 CPUs Crash reason: EXCEPTION_ACCESS_VIOLATION_READ Crash address: 0xffffffffccccccc5 Thread 0 (crashed) 0 xul.dll!PL_DHashTableOperate [pldhash.cpp:f64f62213f61 : 609 + 0x15] eip = 0x6bf89ac1 esp = 0x0023cce0 ebp = 0x0023ccf0 ebx = 0x0b5d1558 esi = 0x0b5d1590 edi = 0x0b5d1590 eax = 0xeeeeeee8 ecx = 0xdddddddd edx = 0x07ae7c20 efl = 0x00210a03 Found by: given as instruction pointer in context 1 xul.dll!nsTHashtable<nsBaseHashtableET<nsISupportsHashKey,nsAutoPtr<nsCOMArray<nsXULTemplateResultRDF> > > >::GetEntry(nsISupports *) [nsTHashtable.h:f64f62213f61 : 170 + 0xb] eip = 0x6ba3880f esp = 0x0023ccf8 ebp = 0x0023cd00 Found by: call frame info 2 xul.dll!nsClassHashtable<nsISupportsHashKey,nsCOMArray<nsXULTemplateResultRDF> >::Get(nsISupports *,nsCOMArray<nsXULTemplateResultRDF> * *) [nsClassHashtable.h:f64f62213f61 : 120 + 0x7] eip = 0x6ba3968f esp = 0x0023cd08 ebp = 0x0023cd0c Found by: call frame info 3 xul.dll!nsXULTemplateQueryProcessorRDF::SynchronizeAll(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,nsIRDFNode *) [nsXULTemplateQueryProcessorRDF.cpp:f64f62213f61 : 1061 + 0x10] eip = 0x6ba3a635 esp = 0x0023cd14 ebp = 0x0023cd38 Found by: call frame info 4 xul.dll!nsXULTemplateQueryProcessorRDF::OnAssert(nsIRDFDataSource *,nsIRDFResource *,nsIRDFResource *,nsIRDFNode *) [nsXULTemplateQueryProcessorRDF.cpp:f64f62213f61 : 818 + 0x11] eip = 0x6ba3ce83 esp = 0x0023cd40 ebp = 0x0023cd54 Found by: call frame info 5 xul.dll!CompositeDataSourceImpl::OnAssert(nsIRDFDataSource *,nsIRDFResource *,nsIRDFResource *,nsIRDFNode *) [nsCompositeDataSource.cpp:f64f62213f61 : 1410 + 0x17] eip = 0x6bcdd0ae esp = 0x0023cd5c ebp = 0x0023cd7c Found by: call frame info 6 xul.dll!InMemoryDataSource::Assert(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,bool) [nsInMemoryDataSource.cpp:f64f62213f61 : 1394 + 0xf] eip = 0x6bce0587 esp = 0x0023cd84 ebp = 0x0023cda4 Found by: call frame info 7 xul.dll!RDFXMLDataSourceImpl::Assert(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,bool) [nsRDFXMLDataSource.cpp:f64f62213f61 : 671 + 0x18] eip = 0x6bce9cc2 esp = 0x0023cdac ebp = 0x0023cdd4 Found by: call frame info 8 xul.dll!RDFContentSinkImpl::HandleEndElement(wchar_t const *) [nsRDFContentSink.cpp:f64f62213f61 : 520 + 0x2d] eip = 0x6bce377c esp = 0x0023cddc ebp = 0x0023cea4 Found by: call frame info 9 xul.dll!nsExpatDriver::HandleEndElement(wchar_t const *) [nsExpatDriver.cpp:f64f62213f61 : 426 + 0x10] eip = 0x6b3e7138 esp = 0x0023ceac ebp = 0x0023cec0 Found by: call frame info 10 xul.dll!Driver_HandleEndElement [nsExpatDriver.cpp:f64f62213f61 : 106 + 0x7] eip = 0x6b3e7ab5 esp = 0x0023cec8 ebp = 0x0023cecc Found by: call frame info 11 xul.dll!doContent [xmlparse.c:f64f62213f61 : 2499 + 0x8] eip = 0x6b3fc0c0 esp = 0x0023ced4 ebp = 0x0023cf34 Found by: call frame info 12 xul.dll!contentProcessor [xmlparse.c:f64f62213f61 : 2044 + 0x28] eip = 0x6b3fc51e esp = 0x0023cf3c ebp = 0x0023cf60 Found by: call frame info 13 xul.dll!doProlog [xmlparse.c:f64f62213f61 : 4024 + 0x18] eip = 0x6b3fda62 esp = 0x0023cf68 ebp = 0x0023cf98 Found by: call frame info 14 xul.dll!prologProcessor [xmlparse.c:f64f62213f61 : 3759 + 0x24] eip = 0x6b3fdbd5 esp = 0x0023cfa0 ebp = 0x0023cfd8 Found by: call frame info 15 xul.dll!prologInitProcessor [xmlparse.c:f64f62213f61 : 3575 + 0x18] eip = 0x6b3fdd5c esp = 0x0023cfe0 ebp = 0x0023cff4 Found by: call frame info 16 xul.dll!MOZ_XML_Parse [xmlparse.c:f64f62213f61 : 1520 + 0x1e] eip = 0x6b3f992c esp = 0x0023cffc ebp = 0x0023d01c Found by: call frame info 17 xul.dll!nsExpatDriver::ParseBuffer(wchar_t const *,unsigned int,bool,unsigned int *) [nsExpatDriver.cpp:f64f62213f61 : 1022 + 0x15] eip = 0x6b3e65db esp = 0x0023d024 ebp = 0x0023d044 Found by: call frame info 18 xul.dll!nsExpatDriver::ConsumeToken(nsScanner &,bool &) [nsExpatDriver.cpp:f64f62213f61 : 1120 + 0x1b] eip = 0x6b3e917a esp = 0x0023d04c ebp = 0x0023d190 Found by: call frame info 19 xul.dll!nsParser::Tokenize(bool) [nsParser.cpp:f64f62213f61 : 2276 + 0x1a] eip = 0x6b3f4dff esp = 0x0023d198 ebp = 0x0023d1bc Found by: call frame info 20 xul.dll!nsParser::ResumeParse(bool,bool,bool) [nsParser.cpp:f64f62213f61 : 1566 + 0x12] eip = 0x6b3f5026 esp = 0x0023d1c4 ebp = 0x0023d1dc Found by: call frame info 21 xul.dll!nsParser::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsParser.cpp:f64f62213f61 : 2158 + 0xb] eip = 0x6b3f3682 esp = 0x0023d1e4 ebp = 0x0023d220 Found by: call frame info 22 xul.dll!RDFXMLDataSourceImpl::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsRDFXMLDataSource.cpp:f64f62213f61 : 1179 + 0x1f] eip = 0x6bce9ab7 esp = 0x0023d228 ebp = 0x0023d240 Found by: call frame info 23 xul.dll!nsStreamListenerTee::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsStreamListenerTee.cpp:f64f62213f61 : 122 + 0x1c] eip = 0x6b308766 esp = 0x0023d248 ebp = 0x0023d27c Found by: call frame info 24 xul.dll!nsHttpChannel::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsHttpChannel.cpp:f64f62213f61 : 4608 + 0x3c] eip = 0x6b375187 esp = 0x0023d284 ebp = 0x0023d2b4 Found by: call frame info 25 xul.dll!nsInputStreamPump::OnStateTransfer() [nsInputStreamPump.cpp:f64f62213f61 : 514 + 0x1b] eip = 0x6b2eab80 esp = 0x0023d2bc ebp = 0x0023d300 Found by: call frame info 26 xul.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *) [nsInputStreamPump.cpp:f64f62213f61 : 402 + 0x7] eip = 0x6b2eb1bf esp = 0x0023d308 ebp = 0x0023d314 Found by: call frame info 27 xul.dll!nsInputStreamReadyEvent::Run() [nsStreamUtils.cpp:f64f62213f61 : 114 + 0x10] eip = 0x6bfb1082 esp = 0x0023d31c ebp = 0x0023d32c Found by: call frame info 28 xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:f64f62213f61 : 656 + 0xd] eip = 0x6bfc5b4d esp = 0x0023d334 ebp = 0x0023d35c Found by: call frame info 29 xul.dll!NS_ProcessNextEvent_P(nsIThread *,bool) [nsThreadUtils.cpp:f64f62213f61 : 245 + 0xc] eip = 0x6bf886ca esp = 0x0023d364 ebp = 0x0023d370 Found by: call frame info 30 xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [MessagePump.cpp:f64f62213f61 : 110 + 0x9] eip = 0x6be9c32d esp = 0x0023d378 ebp = 0x0023d39c Found by: call frame info 31 xul.dll!MessageLoop::RunInternal() [message_loop.cc:f64f62213f61 : 208 + 0x8] eip = 0x6bff8795 esp = 0x0023d3a4 ebp = 0x0023d3bc Found by: call frame info 32 xul.dll!MessageLoop::RunHandler() [message_loop.cc:f64f62213f61 : 201 + 0x4] eip = 0x6bff8cd2 esp = 0x0023d3c4 ebp = 0x0023d3f0 Found by: call frame info 33 xul.dll!MessageLoop::Run() [message_loop.cc:f64f62213f61 : 175 + 0x6] eip = 0x6bff919d esp = 0x0023d3f8 ebp = 0x0023d410 Found by: call frame info 34 xul.dll!nsBaseAppShell::Run() [nsBaseAppShell.cpp:f64f62213f61 : 189 + 0xb] eip = 0x6bdd7e7a esp = 0x0023d418 ebp = 0x0023d420 Found by: call frame info 35 xul.dll!nsAppShell::Run() [nsAppShell.cpp:f64f62213f61 : 267 + 0x5] eip = 0x6bda7115 esp = 0x0023d428 ebp = 0x0023f374 Found by: call frame info 36 xul.dll!nsAppStartup::Run() [nsAppStartup.cpp:f64f62213f61 : 295 + 0x11] eip = 0x6bc3ba8c esp = 0x0023f37c ebp = 0x0023f384 Found by: call frame info 37 xul.dll!XREMain::XRE_mainRun() [nsAppRunner.cpp:f64f62213f61 : 3772 + 0xd] eip = 0x6b2bcc69 esp = 0x0023f38c ebp = 0x0023f458 Found by: call frame info 38 xul.dll!XREMain::XRE_main(int,char * * const,nsXREAppData const *) [nsAppRunner.cpp:f64f62213f61 : 3849 + 0x6] eip = 0x6b2bcdec esp = 0x0023f460 ebp = 0x0023f470 Found by: call frame info 39 xul.dll!XRE_main [nsAppRunner.cpp:f64f62213f61 : 3925 + 0x11] eip = 0x6b2bcf51 esp = 0x0023f478 ebp = 0x0023f580 Found by: call frame info 40 firefox.exe!do_main [nsBrowserApp.cpp:f64f62213f61 : 190 + 0xe] eip = 0x00fd1bc9 esp = 0x0023f588 ebp = 0x0023f6b4 Found by: call frame info 41 firefox.exe!NS_internal_main(int,char * *) [nsBrowserApp.cpp:f64f62213f61 : 277 + 0xd] eip = 0x00fd1dec esp = 0x0023f6bc ebp = 0x0023f83c Found by: call frame info 42 firefox.exe!wmain [nsWindowsWMain.cpp:f64f62213f61 : 107 + 0x6] eip = 0x00fd1f5b esp = 0x0023f844 ebp = 0x0023f870 Found by: call frame info 43 firefox.exe!__tmainCRTStartup [crtexe.c : 552 + 0x18] eip = 0x00fd537f esp = 0x0023f878 ebp = 0x0023f8c0 Found by: call frame info 44 firefox.exe!wmainCRTStartup [crtexe.c : 370 + 0x4] eip = 0x00fd51af esp = 0x0023f8c8 ebp = 0x0023f8c8 Found by: call frame info 45 kernel32.dll + 0x51173 eip = 0x76611174 esp = 0x0023f8d0 ebp = 0x0023f8d4 Found by: call frame info 46 ntdll.dll + 0x5b3f4 eip = 0x779ab3f5 esp = 0x0023f8dc ebp = 0x0023f914 Found by: previous frame's frame pointer 47 ntdll.dll + 0x5b3c7 eip = 0x779ab3c8 esp = 0x0023f91c ebp = 0x0023f92c Found by: previous frame's frame pointer
This is XUL rather than RDF, moving it over there to get traction.
Component: RDF → XUL
QA Contact: rdf → xptoolkit.widgets
http://tinderbox.mozilla.org/showlog.cgi?log=SeaMonkey/1333608083.1333608571.30263.gz WINNT 5.2 comm-central-trunk debug test crashtest on 2012/04/04 23:41:23 s: cb-seamonkey-win32-02 { REFTEST TEST-START | file:///e:/builds/slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | 392 / 2040 (19%) TEST-UNEXPECTED-FAIL | file:///e:/builds/slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | Exited with code -1073741819 during test run 8 xul.dll!RDFContentSinkImpl::HandleEndElement(wchar_t const *) [nsRDFContentSink.cpp:ed9cbe6a817e : 520 + 0x46] }
https://tbpl.mozilla.org/php/getParsedLog.php?id=10790012&tree=Mozilla-Inbound
Summary: Intermittent crashtest content/xul/templates/src/crashtests/397148-1.xul or 330012-1.xul | Exited with code -1073741819 during test run [@ RDFContentSinkImpl::HandleEndElement] → Intermittent crashtest content/xul/templates/src/crashtests/397148-1.xul, 330010-1.xul, 330012-1.xul | Exited with code -1073741819 during test run [@ RDFContentSinkImpl::HandleEndElement]
It's quite often taking me five tries to get Windows crashtests to run on a particular push, and it's pretty clear that the imaginary person who is looking into this is overloaded. Shall I just disable this test until that person become more corporeal?
Maybe it's a regression from bug 739674? That's the only change to content/xul/templates/ around the time this bug was filed.
It does look suspicious :-( The crash is coming from mObservers[i]->OnAssert(this, aSource, aProperty, aTarget); but mObservens is declared as nsCOMArray<nsIRDFObserver> mObservers; so it should not be accessing a deleted object. Will try to reproduce this.
Attached file asan crash log (obsolete) —
I was able to reproduce this on linux with asan. What I did was * build with asan, debug *and* optimizations, so that the timing would be similar to what we see on the bots * run the tests with schedtool -a 4 -e make crashtest to pin firefox to one cpu. I will try to fix this on Monday. Thanks for ccing me.
Niel, can you take a look at the log I attached? Unfortunately it doesn't help me a lot. If I am reading it correctly, it show we freeing a nsXULTemplateQueryProcessorRDF when its refcount reaches zero, but then accessing it via a nsCOMArray<nsIRDFObserver>, which should keep a reference itself :-( I tried enabling refcount logging for nsXULTemplateQueryProcessorRDF, but have been unable to reproduce the bug with it on so far.
Managed to get a log with refcount tracing.It looks like the problem might be a race on when NodeWillBeDestroyed is called.
Attachment #619223 - Attachment is obsolete: true
It looks as if the document is being evicted from the bfcache (the cache that holds documents in the back button history), yet the rdf data for that document hasn't finished loading. The tests being run in that log aren't waiting for the data to be loaded before continuing (which means they may not be testing what they think they should be) I assume that the call stack for the last release of nsXULTemplateQueryProcessorRDF in that log is from the same call stack as the memory access error occurs. I notice that the callstack is similar up until nsXULTemplateQueryProcessorRDF::OnAssert. It may be necessary to add a script blocker earlier on in nsXULTemplateQueryProcessorRDF::OnAssert and related observer methods to prevent the document from being destroyed while processing data.
I was expecting that mObservers[i]->OnAssert(this, aSource, aProperty, aTarget) would hold a ref count to mObservers[i] and prevent it from being deleted. I did a try push to https://tbpl.mozilla.org/?tree=Try&rev=2b7d38061c24 Which a last minute synchronization. This should at least move the crash if our theory is right. Another option that might work is to use nsCOMPtr<..> foo = mObservers[i]; foo->OnAssert(this, aSource, aProperty, aTarget) but I am not sure if the is still a race condition on the first line or not.
With the patch on try I was no longer able to reproduce the crash locally. I will let Neil Deakin comment on this being the best place to synchronize or not, but it should at least fix the orange.
Attached patch add a lock — — Splinter Review
Assignee: nobody → respindola
Status: NEW → ASSIGNED
Attachment #620005 - Flags: feedback?
Attachment #620005 - Flags: feedback? → feedback?(enndeakin)
I'm not sure what this really does or what the performance implications here are. Would be best to ask someone on the content team to comment, pointing out comments 297-299.
Adding bz. bz, the most relevant comments are 297 and higher.
Attachment #620005 - Flags: feedback?(enndeakin) → feedback?(bzbarsky)
> yet the rdf data for that document hasn't finished loading. Why would the document be in bfcache, then? The second stack in the attachment seems to indicate that somehow we ended up under nsXULTemplateBuilder::Observe for the window-destroyed topic in the middle of setting up our template content? That's really odd. Can script run in there? > mObservers[i]->OnAssert(this, aSource, aProperty, aTarget) This is only safe if you know OnAssert won't modify mObservers. Why is that a safe assumption in general? If it's being violated here, seems like the code is just slightly broken no matter what.... Why does adding mutexes help anything? All this stuff should be main-thread-only; there should be no races here.
> Why does adding mutexes help anything? All this stuff should be > main-thread-only; there should be no races here. Then I guess the (a?) bug is that something is using from another thread. The stack that shows remove being called doesn't have OnAssert in it. After that we get a crash with OnAssert on the stack, indicating it got the reference to the nsXULTemplateQueryProcessorRDF before it was removed from mObservers. Tomorrow I will try to replace the mutex with asserts about being on the main thread and see what I get. Thanks
If you look at that ASAN output: READ of size 4 at 0x7f2077a35ef4 thread T0 ... freed by thread T0 here: ... previously allocated by thread T0 here: All this stuff is touching DOM nodes. If there were any non-main threads this would already be asserting like the 4th of July. In any case, the stack to the free call from ASAN does have OnAssert on it: frame 20. Are you looking at some other stack?
I don't think this has anything to do with threads. I just guessed that it had something to with the bfcache because nsSHEntryShared::RemoveFromBFCacheAsync appears in one of the stacks before the document is destroyed. I don't know much about it though. The issue is that the loop that iterates over observers isn't protected from something removing items from the list. I suggested adding a script blocker there, as the template observer can generate content, set attributes, etc that can call scripts. It would also be nice to know what exactly is causing the document to be destroyed. Rafael, can you reproduce this locally, or can you only reproduce this by submitting patches to the tryserver?
I can reproduce it locally with asan. Fails 1 in 3 more or less. > In any case, the stack to the free call from ASAN does have OnAssert on it: frame 20. Are you looking at some other stack? No, I had missed it. I guess the lock was just turning this into a timeout :-( I added a simple assert that should make this easy to reproduce anywhere: PRInt32 Count = mObservers.Count(); for (PRInt32 i = mObservers.Count() - 1; i >= 0; --i) { mObservers[i]->OnAssert(this, aSource, aProperty, aTarget); MOZ_ASSERT(mObservers.Count() == Count); } Lets see if it does.
With the above assert I am able to reproduce it with a regular gcc debug build.
Attachment #619636 - Attachment is patch: false
Attachment #619636 - Attachment mime type: text/plain → application/bzip2
Sorry, I take that back. The one that was failing was still with asan. There is a lot more going on this bug about content that I am familiar with (this is the first time I see the bfcache for example). I am more than happy to help reproducing the problem, but it would probably be more productive to assign it to someone else.
Attachment #620005 - Flags: feedback?(bzbarsky) → feedback-
Severity: normal → critical
This is not showing up on tbpl, so I am dropping my assignment. I am still available to help anyone reproduce this.
Assignee: respindola → nobody
Severity: critical → normal
Status: ASSIGNED → NEW
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
(In reply to Rafael Ávila de Espíndola (:espindola) from comment #311) > This is not showing up on tbpl, so I am dropping my assignment. I am still > available to help anyone reproduce this. Is that not because of: (In reply to Phil Ringnalda (:philor) from comment #288) > Skipped on Windows in https://hg.mozilla.org/mozilla-central/rev/989503f680bc ?
Ah, right.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Status: REOPENED → UNCONFIRMED
Ever confirmed: false
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][test disabled on windows]
Taras tells me I should keep it assigned to me.
QA Contact: respindola
Assignee: nobody → respindola
Status: UNCONFIRMED → NEW
Ever confirmed: true
QA Contact: respindola
A clarification: I will not have time to work on this any time soon, so I am resetting the assignment. I will reamin cced in case someone needs help reproducing it.
Assignee: respindola → nobody
Whiteboard: [orange][test which aborts the suite][test disabled on windows] → [test which aborts the suite][test disabled on windows]
Bulk assigning P3 to all open intermittent bugs without a priority set in Firefox components per bug 1298978.
Priority: -- → P3
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 13 years ago → 6 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: