Closed Bug 742455 Opened 12 years ago Closed 6 years ago

Intermittent crashtest content/xul/templates/src/crashtests/397148-1.xul, 330010-1.xul, 330012-1.xul | Exited with code -1073741819 during test run [@ RDFContentSinkImpl::HandleEndElement]

Categories

(Core :: XUL, defect, P3)

Product:
Core
Component:
XUL
Version:
14 Branch
Platform:
x86
Windows 7
Type:
defect

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: mbrubeck, Unassigned)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test which aborts the suite][test disabled on windows])

Crash Data

Attachments

(2 files, 1 obsolete file)

log with refcount tracing
31.06 KB, application/bzip2
Details
add a lock
6.73 KB, patch
bzbarsky
: feedback-
Details | Diff | Splinter Review 
https://tbpl.mozilla.org/php/getParsedLog.php?id=10634436&tree=Mozilla-Inbound
Rev3 WINNT 6.1 mozilla-inbound debug test crashtest on 2012-04-04 06:38:39 PDT for push ba7f8495dd57

REFTEST TEST-START | http://localhost:4444/1333546904765/1/330010-1.xul | 391 / 2040 (19%)
++DOMWINDOW == 64 (04EA3680) [serial = 885] [outer = 053E5138]
Security Error: Content at file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/329884-1.xul may not load data from file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/1.rdf.
JavaScript error: http://localhost:4444/1333546904765/1/330010-1.xul, line 14: generatedShape is undefined
REFTEST TEST-PASS | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330010-1.xul | (LOAD ONLY)
REFTEST INFO | Loading a blank page
++DOMWINDOW == 65 (086A3EB0) [serial = 886] [outer = 053E5138]
REFTEST TEST-START | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | 392 / 2040 (19%)
++DOMWINDOW == 66 (087B5430) [serial = 887] [outer = 053E5138]
--DOMWINDOW == 65 (0B0B1E20) [serial = 850] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/content/xul/content/crashtests/431906-1-inner.xul]
--DOMWINDOW == 64 (086A73D8) [serial = 828] [outer = 00000000] [url = data:text/html,]
--DOMWINDOW == 63 (08E754E0) [serial = 840] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/content/xul/content/crashtests/384877-1-inner.xul]
--DOMWINDOW == 62 (04EA2AB0) [serial = 864] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/content/xul/document/crashtests/386914-1-inner.xul]
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8738
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8738
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8738
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8738
REFTEST TEST-PASS | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | (LOAD ONLY)
REFTEST INFO | Loading a blank page
++DOMWINDOW == 63 (0B23ECC0) [serial = 888] [outer = 053E5138]
TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:02:33.300000
INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmpywaaonpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-debug/1333539620/firefox-14.0a1.en-US.win32.crashreporter-symbols.zip
PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | application crashed (minidump found)
Crash dump filename: c:\users\cltbld\appdata\local\temp\tmphepii8\minidumps\7a0646fb-008d-46b9-afdd-14a9f5230ad4.dmp
Operating system: Windows NT
                  6.1.7600 
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0xffffffffccccccc5

Thread 0 (crashed)
 0  xul.dll!PL_DHashTableOperate [pldhash.cpp:ba7f8495dd57 : 609 + 0x15]
    eip = 0x69839a3f   esp = 0x0026d348   ebp = 0x0026d358   ebx = 0x0b80eaf0
    esi = 0x0b80eb28   edi = 0x0b80eb28   eax = 0xeeeeeee8   ecx = 0xdddddddd
    edx = 0x051e0c78   efl = 0x00210a03
    Found by: given as instruction pointer in context
 1  xul.dll!nsTHashtable<nsBaseHashtableET<nsISupportsHashKey,nsAutoPtr<nsCOMArray<nsXULTemplateResultRDF> > > >::GetEntry(nsISupports *) [nsTHashtable.h:ba7f8495dd57 : 170 + 0xb]
    eip = 0x692e87c7   esp = 0x0026d360   ebp = 0x0026d368
    Found by: call frame info
 2  xul.dll!nsClassHashtable<nsISupportsHashKey,nsCOMArray<nsXULTemplateResultRDF> >::Get(nsISupports *,nsCOMArray<nsXULTemplateResultRDF> * *) [nsClassHashtable.h:ba7f8495dd57 : 120 + 0x7]
    eip = 0x692e9647   esp = 0x0026d370   ebp = 0x0026d374
    Found by: call frame info
 3  xul.dll!nsXULTemplateQueryProcessorRDF::SynchronizeAll(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,nsIRDFNode *) [nsXULTemplateQueryProcessorRDF.cpp:ba7f8495dd57 : 1061 + 0x10]
    eip = 0x692ea5ed   esp = 0x0026d37c   ebp = 0x0026d3a0
    Found by: call frame info
 4  xul.dll!nsXULTemplateQueryProcessorRDF::OnAssert(nsIRDFDataSource *,nsIRDFResource *,nsIRDFResource *,nsIRDFNode *) [nsXULTemplateQueryProcessorRDF.cpp:ba7f8495dd57 : 818 + 0x11]
    eip = 0x692ece3b   esp = 0x0026d3a8   ebp = 0x0026d3bc
    Found by: call frame info
 5  xul.dll!CompositeDataSourceImpl::OnAssert(nsIRDFDataSource *,nsIRDFResource *,nsIRDFResource *,nsIRDFNode *) [nsCompositeDataSource.cpp:ba7f8495dd57 : 1410 + 0x17]
    eip = 0x6958d029   esp = 0x0026d3c4   ebp = 0x0026d3e4
    Found by: call frame info
 6  xul.dll!InMemoryDataSource::Assert(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,bool) [nsInMemoryDataSource.cpp:ba7f8495dd57 : 1394 + 0xf]
    eip = 0x69590501   esp = 0x0026d3ec   ebp = 0x0026d40c
    Found by: call frame info
 7  xul.dll!RDFXMLDataSourceImpl::Assert(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,bool) [nsRDFXMLDataSource.cpp:ba7f8495dd57 : 671 + 0x18]
    eip = 0x69599c38   esp = 0x0026d414   ebp = 0x0026d43c
    Found by: call frame info
 8  xul.dll!RDFContentSinkImpl::HandleEndElement(wchar_t const *) [nsRDFContentSink.cpp:ba7f8495dd57 : 520 + 0x2d]
    eip = 0x695936f6   esp = 0x0026d444   ebp = 0x0026d50c
    Found by: call frame info
 9  xul.dll!nsExpatDriver::HandleEndElement(wchar_t const *) [nsExpatDriver.cpp:ba7f8495dd57 : 426 + 0x10]
    eip = 0x68c97138   esp = 0x0026d514   ebp = 0x0026d528
    Found by: call frame info
10  xul.dll!Driver_HandleEndElement [nsExpatDriver.cpp:ba7f8495dd57 : 106 + 0x7]
    eip = 0x68c97ab5   esp = 0x0026d530   ebp = 0x0026d534
    Found by: call frame info
11  xul.dll!doContent [xmlparse.c:ba7f8495dd57 : 2499 + 0x8]
    eip = 0x68cac0c0   esp = 0x0026d53c   ebp = 0x0026d59c
    Found by: call frame info
12  xul.dll!contentProcessor [xmlparse.c:ba7f8495dd57 : 2044 + 0x28]
    eip = 0x68cac51e   esp = 0x0026d5a4   ebp = 0x0026d5c8
    Found by: call frame info
13  xul.dll!doProlog [xmlparse.c:ba7f8495dd57 : 4024 + 0x18]
    eip = 0x68cada62   esp = 0x0026d5d0   ebp = 0x0026d600
    Found by: call frame info
14  xul.dll!prologProcessor [xmlparse.c:ba7f8495dd57 : 3759 + 0x24]
    eip = 0x68cadbd5   esp = 0x0026d608   ebp = 0x0026d640
    Found by: call frame info
15  xul.dll!prologInitProcessor [xmlparse.c:ba7f8495dd57 : 3575 + 0x18]
    eip = 0x68cadd5c   esp = 0x0026d648   ebp = 0x0026d65c
    Found by: call frame info
16  xul.dll!MOZ_XML_Parse [xmlparse.c:ba7f8495dd57 : 1520 + 0x1e]
    eip = 0x68ca992c   esp = 0x0026d664   ebp = 0x0026d684
    Found by: call frame info
17  xul.dll!nsExpatDriver::ParseBuffer(wchar_t const *,unsigned int,bool,unsigned int *) [nsExpatDriver.cpp:ba7f8495dd57 : 1022 + 0x15]
    eip = 0x68c965db   esp = 0x0026d68c   ebp = 0x0026d6ac
    Found by: call frame info
18  xul.dll!nsExpatDriver::ConsumeToken(nsScanner &,bool &) [nsExpatDriver.cpp:ba7f8495dd57 : 1120 + 0x1b]
    eip = 0x68c9917a   esp = 0x0026d6b4   ebp = 0x0026d7f8
    Found by: call frame info
19  xul.dll!nsParser::Tokenize(bool) [nsParser.cpp:ba7f8495dd57 : 2276 + 0x1a]
    eip = 0x68ca4dff   esp = 0x0026d800   ebp = 0x0026d824
    Found by: call frame info
20  xul.dll!nsParser::ResumeParse(bool,bool,bool) [nsParser.cpp:ba7f8495dd57 : 1566 + 0x12]
    eip = 0x68ca5026   esp = 0x0026d82c   ebp = 0x0026d844
    Found by: call frame info
21  xul.dll!nsParser::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsParser.cpp:ba7f8495dd57 : 2158 + 0xb]
    eip = 0x68ca3682   esp = 0x0026d84c   ebp = 0x0026d888
    Found by: call frame info
22  xul.dll!RDFXMLDataSourceImpl::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsRDFXMLDataSource.cpp:ba7f8495dd57 : 1179 + 0x1f]
    eip = 0x69599a2d   esp = 0x0026d890   ebp = 0x0026d8a8
    Found by: call frame info
23  xul.dll!nsStreamListenerTee::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsStreamListenerTee.cpp:ba7f8495dd57 : 122 + 0x1c]
    eip = 0x68bb8766   esp = 0x0026d8b0   ebp = 0x0026d8e4
    Found by: call frame info
24  xul.dll!nsHttpChannel::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsHttpChannel.cpp:ba7f8495dd57 : 4608 + 0x3c]
    eip = 0x68c25183   esp = 0x0026d8ec   ebp = 0x0026d91c
    Found by: call frame info
25  xul.dll!nsInputStreamPump::OnStateTransfer() [nsInputStreamPump.cpp:ba7f8495dd57 : 514 + 0x1b]
    eip = 0x68b9ab80   esp = 0x0026d924   ebp = 0x0026d968
    Found by: call frame info
26  xul.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *) [nsInputStreamPump.cpp:ba7f8495dd57 : 402 + 0x7]
    eip = 0x68b9b1bf   esp = 0x0026d970   ebp = 0x0026d97c
    Found by: call frame info
27  xul.dll!nsInputStreamReadyEvent::Run() [nsStreamUtils.cpp:ba7f8495dd57 : 114 + 0x10]
    eip = 0x69860fd8   esp = 0x0026d984   ebp = 0x0026d994
    Found by: call frame info
28  xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:ba7f8495dd57 : 656 + 0xd]
    eip = 0x69875aa6   esp = 0x0026d99c   ebp = 0x0026d9c4
    Found by: call frame info
29  xul.dll!NS_ProcessNextEvent_P(nsIThread *,bool) [nsThreadUtils.cpp:ba7f8495dd57 : 245 + 0xc]
    eip = 0x69838648   esp = 0x0026d9cc   ebp = 0x0026d9d8
    Found by: call frame info
30  xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [MessagePump.cpp:ba7f8495dd57 : 110 + 0x9]
    eip = 0x6974c2aa   esp = 0x0026d9e0   ebp = 0x0026da04
    Found by: call frame info
31  xul.dll!MessageLoop::RunInternal() [message_loop.cc:ba7f8495dd57 : 208 + 0x8]
    eip = 0x698a86f3   esp = 0x0026da0c   ebp = 0x0026da24
    Found by: call frame info
32  xul.dll!MessageLoop::RunHandler() [message_loop.cc:ba7f8495dd57 : 201 + 0x4]
    eip = 0x698a8c30   esp = 0x0026da2c   ebp = 0x0026da58
    Found by: call frame info
33  xul.dll!MessageLoop::Run() [message_loop.cc:ba7f8495dd57 : 175 + 0x6]
    eip = 0x698a90fb   esp = 0x0026da60   ebp = 0x0026da78
    Found by: call frame info
34  xul.dll!nsBaseAppShell::Run() [nsBaseAppShell.cpp:ba7f8495dd57 : 189 + 0xb]
    eip = 0x69687df7   esp = 0x0026da80   ebp = 0x0026da88
    Found by: call frame info
35  xul.dll!nsAppShell::Run() [nsAppShell.cpp:ba7f8495dd57 : 267 + 0x5]
    eip = 0x69657093   esp = 0x0026da90   ebp = 0x0026f9dc
    Found by: call frame info
36  xul.dll!nsAppStartup::Run() [nsAppStartup.cpp:ba7f8495dd57 : 295 + 0x11]
    eip = 0x694eba00   esp = 0x0026f9e4   ebp = 0x0026f9ec
    Found by: call frame info
37  xul.dll!XREMain::XRE_mainRun() [nsAppRunner.cpp:ba7f8495dd57 : 3772 + 0xd]
    eip = 0x68b6cc69   esp = 0x0026f9f4   ebp = 0x0026fac0
    Found by: call frame info
38  xul.dll!XREMain::XRE_main(int,char * * const,nsXREAppData const *) [nsAppRunner.cpp:ba7f8495dd57 : 3849 + 0x6]
    eip = 0x68b6cdec   esp = 0x0026fac8   ebp = 0x0026fad8
    Found by: call frame info
39  xul.dll!XRE_main [nsAppRunner.cpp:ba7f8495dd57 : 3925 + 0x11]
    eip = 0x68b6cf51   esp = 0x0026fae0   ebp = 0x0026fbe8
    Found by: call frame info
40  firefox.exe!do_main [nsBrowserApp.cpp:ba7f8495dd57 : 190 + 0xe]
    eip = 0x008f1bc9   esp = 0x0026fbf0   ebp = 0x0026fd1c
    Found by: call frame info
41  firefox.exe!NS_internal_main(int,char * *) [nsBrowserApp.cpp:ba7f8495dd57 : 277 + 0xd]
    eip = 0x008f1dec   esp = 0x0026fd24   ebp = 0x0026fea4
    Found by: call frame info
42  firefox.exe!wmain [nsWindowsWMain.cpp:ba7f8495dd57 : 107 + 0x6]
    eip = 0x008f1f5b   esp = 0x0026feac   ebp = 0x0026fed8
    Found by: call frame info
43  firefox.exe!__tmainCRTStartup [crtexe.c : 552 + 0x18]
    eip = 0x008f537f   esp = 0x0026fee0   ebp = 0x0026ff28
    Found by: call frame info
44  firefox.exe!wmainCRTStartup [crtexe.c : 370 + 0x4]
    eip = 0x008f51af   esp = 0x0026ff30   ebp = 0x0026ff30
    Found by: call frame info
45  kernel32.dll + 0x51173
    eip = 0x757c1174   esp = 0x0026ff38   ebp = 0x0026ff3c
    Found by: call frame info
46  ntdll.dll + 0x5b3f4
    eip = 0x76ebb3f5   esp = 0x0026ff44   ebp = 0x0026ff7c
    Found by: previous frame's frame pointer
47  ntdll.dll + 0x5b3c7
    eip = 0x76ebb3c8   esp = 0x0026ff84   ebp = 0x0026ff94
    Found by: previous frame's frame pointer
https://tbpl.mozilla.org/php/getParsedLog.php?id=10627714&full=1&branch=mozilla-inbound
Rev3 WINNT 6.1 mozilla-inbound debug test crashtest on 2012-04-04 00:28:37 PDT for push f64f62213f61

REFTEST TEST-START | file:///C:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/397148-1.xul | 393 / 2040 (19%)
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8735
TEST-UNEXPECTED-FAIL | file:///C:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/397148-1.xul | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:02:29.518000
INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmp2yrhazpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-debug/1333518442/firefox-14.0a1.en-US.win32.crashreporter-symbols.zip
PROCESS-CRASH | file:///C:/talos-slave/test/build/reftest/tests/content/xul/templates/src/crashtests/397148-1.xul | application crashed (minidump found)
Crash dump filename: c:\users\cltbld\appdata\local\temp\tmpd_jeol\minidumps\c20c368c-469a-452c-8716-33d255fb8fda.dmp
Operating system: Windows NT
                  6.1.7600 
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0xffffffffccccccc5

Thread 0 (crashed)
 0  xul.dll!PL_DHashTableOperate [pldhash.cpp:f64f62213f61 : 609 + 0x15]
    eip = 0x6bf89ac1   esp = 0x0023cce0   ebp = 0x0023ccf0   ebx = 0x0b5d1558
    esi = 0x0b5d1590   edi = 0x0b5d1590   eax = 0xeeeeeee8   ecx = 0xdddddddd
    edx = 0x07ae7c20   efl = 0x00210a03
    Found by: given as instruction pointer in context
 1  xul.dll!nsTHashtable<nsBaseHashtableET<nsISupportsHashKey,nsAutoPtr<nsCOMArray<nsXULTemplateResultRDF> > > >::GetEntry(nsISupports *) [nsTHashtable.h:f64f62213f61 : 170 + 0xb]
    eip = 0x6ba3880f   esp = 0x0023ccf8   ebp = 0x0023cd00
    Found by: call frame info
 2  xul.dll!nsClassHashtable<nsISupportsHashKey,nsCOMArray<nsXULTemplateResultRDF> >::Get(nsISupports *,nsCOMArray<nsXULTemplateResultRDF> * *) [nsClassHashtable.h:f64f62213f61 : 120 + 0x7]
    eip = 0x6ba3968f   esp = 0x0023cd08   ebp = 0x0023cd0c
    Found by: call frame info
 3  xul.dll!nsXULTemplateQueryProcessorRDF::SynchronizeAll(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,nsIRDFNode *) [nsXULTemplateQueryProcessorRDF.cpp:f64f62213f61 : 1061 + 0x10]
    eip = 0x6ba3a635   esp = 0x0023cd14   ebp = 0x0023cd38
    Found by: call frame info
 4  xul.dll!nsXULTemplateQueryProcessorRDF::OnAssert(nsIRDFDataSource *,nsIRDFResource *,nsIRDFResource *,nsIRDFNode *) [nsXULTemplateQueryProcessorRDF.cpp:f64f62213f61 : 818 + 0x11]
    eip = 0x6ba3ce83   esp = 0x0023cd40   ebp = 0x0023cd54
    Found by: call frame info
 5  xul.dll!CompositeDataSourceImpl::OnAssert(nsIRDFDataSource *,nsIRDFResource *,nsIRDFResource *,nsIRDFNode *) [nsCompositeDataSource.cpp:f64f62213f61 : 1410 + 0x17]
    eip = 0x6bcdd0ae   esp = 0x0023cd5c   ebp = 0x0023cd7c
    Found by: call frame info
 6  xul.dll!InMemoryDataSource::Assert(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,bool) [nsInMemoryDataSource.cpp:f64f62213f61 : 1394 + 0xf]
    eip = 0x6bce0587   esp = 0x0023cd84   ebp = 0x0023cda4
    Found by: call frame info
 7  xul.dll!RDFXMLDataSourceImpl::Assert(nsIRDFResource *,nsIRDFResource *,nsIRDFNode *,bool) [nsRDFXMLDataSource.cpp:f64f62213f61 : 671 + 0x18]
    eip = 0x6bce9cc2   esp = 0x0023cdac   ebp = 0x0023cdd4
    Found by: call frame info
 8  xul.dll!RDFContentSinkImpl::HandleEndElement(wchar_t const *) [nsRDFContentSink.cpp:f64f62213f61 : 520 + 0x2d]
    eip = 0x6bce377c   esp = 0x0023cddc   ebp = 0x0023cea4
    Found by: call frame info
 9  xul.dll!nsExpatDriver::HandleEndElement(wchar_t const *) [nsExpatDriver.cpp:f64f62213f61 : 426 + 0x10]
    eip = 0x6b3e7138   esp = 0x0023ceac   ebp = 0x0023cec0
    Found by: call frame info
10  xul.dll!Driver_HandleEndElement [nsExpatDriver.cpp:f64f62213f61 : 106 + 0x7]
    eip = 0x6b3e7ab5   esp = 0x0023cec8   ebp = 0x0023cecc
    Found by: call frame info
11  xul.dll!doContent [xmlparse.c:f64f62213f61 : 2499 + 0x8]
    eip = 0x6b3fc0c0   esp = 0x0023ced4   ebp = 0x0023cf34
    Found by: call frame info
12  xul.dll!contentProcessor [xmlparse.c:f64f62213f61 : 2044 + 0x28]
    eip = 0x6b3fc51e   esp = 0x0023cf3c   ebp = 0x0023cf60
    Found by: call frame info
13  xul.dll!doProlog [xmlparse.c:f64f62213f61 : 4024 + 0x18]
    eip = 0x6b3fda62   esp = 0x0023cf68   ebp = 0x0023cf98
    Found by: call frame info
14  xul.dll!prologProcessor [xmlparse.c:f64f62213f61 : 3759 + 0x24]
    eip = 0x6b3fdbd5   esp = 0x0023cfa0   ebp = 0x0023cfd8
    Found by: call frame info
15  xul.dll!prologInitProcessor [xmlparse.c:f64f62213f61 : 3575 + 0x18]
    eip = 0x6b3fdd5c   esp = 0x0023cfe0   ebp = 0x0023cff4
    Found by: call frame info
16  xul.dll!MOZ_XML_Parse [xmlparse.c:f64f62213f61 : 1520 + 0x1e]
    eip = 0x6b3f992c   esp = 0x0023cffc   ebp = 0x0023d01c
    Found by: call frame info
17  xul.dll!nsExpatDriver::ParseBuffer(wchar_t const *,unsigned int,bool,unsigned int *) [nsExpatDriver.cpp:f64f62213f61 : 1022 + 0x15]
    eip = 0x6b3e65db   esp = 0x0023d024   ebp = 0x0023d044
    Found by: call frame info
18  xul.dll!nsExpatDriver::ConsumeToken(nsScanner &,bool &) [nsExpatDriver.cpp:f64f62213f61 : 1120 + 0x1b]
    eip = 0x6b3e917a   esp = 0x0023d04c   ebp = 0x0023d190
    Found by: call frame info
19  xul.dll!nsParser::Tokenize(bool) [nsParser.cpp:f64f62213f61 : 2276 + 0x1a]
    eip = 0x6b3f4dff   esp = 0x0023d198   ebp = 0x0023d1bc
    Found by: call frame info
20  xul.dll!nsParser::ResumeParse(bool,bool,bool) [nsParser.cpp:f64f62213f61 : 1566 + 0x12]
    eip = 0x6b3f5026   esp = 0x0023d1c4   ebp = 0x0023d1dc
    Found by: call frame info
21  xul.dll!nsParser::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsParser.cpp:f64f62213f61 : 2158 + 0xb]
    eip = 0x6b3f3682   esp = 0x0023d1e4   ebp = 0x0023d220
    Found by: call frame info
22  xul.dll!RDFXMLDataSourceImpl::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsRDFXMLDataSource.cpp:f64f62213f61 : 1179 + 0x1f]
    eip = 0x6bce9ab7   esp = 0x0023d228   ebp = 0x0023d240
    Found by: call frame info
23  xul.dll!nsStreamListenerTee::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsStreamListenerTee.cpp:f64f62213f61 : 122 + 0x1c]
    eip = 0x6b308766   esp = 0x0023d248   ebp = 0x0023d27c
    Found by: call frame info
24  xul.dll!nsHttpChannel::OnDataAvailable(nsIRequest *,nsISupports *,nsIInputStream *,unsigned int,unsigned int) [nsHttpChannel.cpp:f64f62213f61 : 4608 + 0x3c]
    eip = 0x6b375187   esp = 0x0023d284   ebp = 0x0023d2b4
    Found by: call frame info
25  xul.dll!nsInputStreamPump::OnStateTransfer() [nsInputStreamPump.cpp:f64f62213f61 : 514 + 0x1b]
    eip = 0x6b2eab80   esp = 0x0023d2bc   ebp = 0x0023d300
    Found by: call frame info
26  xul.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *) [nsInputStreamPump.cpp:f64f62213f61 : 402 + 0x7]
    eip = 0x6b2eb1bf   esp = 0x0023d308   ebp = 0x0023d314
    Found by: call frame info
27  xul.dll!nsInputStreamReadyEvent::Run() [nsStreamUtils.cpp:f64f62213f61 : 114 + 0x10]
    eip = 0x6bfb1082   esp = 0x0023d31c   ebp = 0x0023d32c
    Found by: call frame info
28  xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:f64f62213f61 : 656 + 0xd]
    eip = 0x6bfc5b4d   esp = 0x0023d334   ebp = 0x0023d35c
    Found by: call frame info
29  xul.dll!NS_ProcessNextEvent_P(nsIThread *,bool) [nsThreadUtils.cpp:f64f62213f61 : 245 + 0xc]
    eip = 0x6bf886ca   esp = 0x0023d364   ebp = 0x0023d370
    Found by: call frame info
30  xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [MessagePump.cpp:f64f62213f61 : 110 + 0x9]
    eip = 0x6be9c32d   esp = 0x0023d378   ebp = 0x0023d39c
    Found by: call frame info
31  xul.dll!MessageLoop::RunInternal() [message_loop.cc:f64f62213f61 : 208 + 0x8]
    eip = 0x6bff8795   esp = 0x0023d3a4   ebp = 0x0023d3bc
    Found by: call frame info
32  xul.dll!MessageLoop::RunHandler() [message_loop.cc:f64f62213f61 : 201 + 0x4]
    eip = 0x6bff8cd2   esp = 0x0023d3c4   ebp = 0x0023d3f0
    Found by: call frame info
33  xul.dll!MessageLoop::Run() [message_loop.cc:f64f62213f61 : 175 + 0x6]
    eip = 0x6bff919d   esp = 0x0023d3f8   ebp = 0x0023d410
    Found by: call frame info
34  xul.dll!nsBaseAppShell::Run() [nsBaseAppShell.cpp:f64f62213f61 : 189 + 0xb]
    eip = 0x6bdd7e7a   esp = 0x0023d418   ebp = 0x0023d420
    Found by: call frame info
35  xul.dll!nsAppShell::Run() [nsAppShell.cpp:f64f62213f61 : 267 + 0x5]
    eip = 0x6bda7115   esp = 0x0023d428   ebp = 0x0023f374
    Found by: call frame info
36  xul.dll!nsAppStartup::Run() [nsAppStartup.cpp:f64f62213f61 : 295 + 0x11]
    eip = 0x6bc3ba8c   esp = 0x0023f37c   ebp = 0x0023f384
    Found by: call frame info
37  xul.dll!XREMain::XRE_mainRun() [nsAppRunner.cpp:f64f62213f61 : 3772 + 0xd]
    eip = 0x6b2bcc69   esp = 0x0023f38c   ebp = 0x0023f458
    Found by: call frame info
38  xul.dll!XREMain::XRE_main(int,char * * const,nsXREAppData const *) [nsAppRunner.cpp:f64f62213f61 : 3849 + 0x6]
    eip = 0x6b2bcdec   esp = 0x0023f460   ebp = 0x0023f470
    Found by: call frame info
39  xul.dll!XRE_main [nsAppRunner.cpp:f64f62213f61 : 3925 + 0x11]
    eip = 0x6b2bcf51   esp = 0x0023f478   ebp = 0x0023f580
    Found by: call frame info
40  firefox.exe!do_main [nsBrowserApp.cpp:f64f62213f61 : 190 + 0xe]
    eip = 0x00fd1bc9   esp = 0x0023f588   ebp = 0x0023f6b4
    Found by: call frame info
41  firefox.exe!NS_internal_main(int,char * *) [nsBrowserApp.cpp:f64f62213f61 : 277 + 0xd]
    eip = 0x00fd1dec   esp = 0x0023f6bc   ebp = 0x0023f83c
    Found by: call frame info
42  firefox.exe!wmain [nsWindowsWMain.cpp:f64f62213f61 : 107 + 0x6]
    eip = 0x00fd1f5b   esp = 0x0023f844   ebp = 0x0023f870
    Found by: call frame info
43  firefox.exe!__tmainCRTStartup [crtexe.c : 552 + 0x18]
    eip = 0x00fd537f   esp = 0x0023f878   ebp = 0x0023f8c0
    Found by: call frame info
44  firefox.exe!wmainCRTStartup [crtexe.c : 370 + 0x4]
    eip = 0x00fd51af   esp = 0x0023f8c8   ebp = 0x0023f8c8
    Found by: call frame info
45  kernel32.dll + 0x51173
    eip = 0x76611174   esp = 0x0023f8d0   ebp = 0x0023f8d4
    Found by: call frame info
46  ntdll.dll + 0x5b3f4
    eip = 0x779ab3f5   esp = 0x0023f8dc   ebp = 0x0023f914
    Found by: previous frame's frame pointer
47  ntdll.dll + 0x5b3c7
    eip = 0x779ab3c8   esp = 0x0023f91c   ebp = 0x0023f92c
    Found by: previous frame's frame pointer
This is XUL rather than RDF, moving it over there to get traction.
Component: RDF → XUL
QA Contact: rdf → xptoolkit.widgets
http://tinderbox.mozilla.org/showlog.cgi?log=SeaMonkey/1333608083.1333608571.30263.gz
WINNT 5.2 comm-central-trunk debug test crashtest on 2012/04/04 23:41:23
s: cb-seamonkey-win32-02
{
REFTEST TEST-START | file:///e:/builds/slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | 392 / 2040 (19%)

TEST-UNEXPECTED-FAIL | file:///e:/builds/slave/test/build/reftest/tests/content/xul/templates/src/crashtests/330012-1.xul | Exited with code -1073741819 during test run

 8  xul.dll!RDFContentSinkImpl::HandleEndElement(wchar_t const *) [nsRDFContentSink.cpp:ed9cbe6a817e : 520 + 0x46]
}
https://tbpl.mozilla.org/php/getParsedLog.php?id=10790012&tree=Mozilla-Inbound
Summary: Intermittent crashtest content/xul/templates/src/crashtests/397148-1.xul or 330012-1.xul | Exited with code -1073741819 during test run [@ RDFContentSinkImpl::HandleEndElement] → Intermittent crashtest content/xul/templates/src/crashtests/397148-1.xul, 330010-1.xul, 330012-1.xul | Exited with code -1073741819 during test run [@ RDFContentSinkImpl::HandleEndElement]
It's quite often taking me five tries to get Windows crashtests to run on a particular push, and it's pretty clear that the imaginary person who is looking into this is overloaded. Shall I just disable this test until that person become more corporeal?
Maybe it's a regression from bug 739674? That's the only change to content/xul/templates/ around the time this bug was filed.
It does look suspicious :-(

The crash is coming from

 mObservers[i]->OnAssert(this, aSource, aProperty, aTarget);

but mObservens is declared as

 nsCOMArray<nsIRDFObserver> mObservers;

so it should not be accessing a deleted object. Will try to reproduce this.
Attached file asan crash log (obsolete) — 
I was able to reproduce this on linux with asan. What I did was

* build with asan, debug *and* optimizations, so that the timing would be similar to what we see on the bots
* run the tests with

schedtool -a 4 -e make crashtest

to pin firefox to one cpu. I will try to fix this on Monday. Thanks for ccing me.
Niel, can you take a look at the log I attached? Unfortunately it doesn't help me a lot. If I am reading it correctly, it show we freeing a nsXULTemplateQueryProcessorRDF when its refcount reaches zero, but then accessing it via a nsCOMArray<nsIRDFObserver>, which should keep a reference itself :-(

I tried enabling refcount logging for nsXULTemplateQueryProcessorRDF, but have been unable to reproduce the bug with it on so far.
Managed to get a log with refcount tracing.It looks like the problem might be a race on when NodeWillBeDestroyed is called.
Attachment #619223 - Attachment is obsolete: true
It looks as if the document is being evicted from the bfcache (the cache that holds documents in the back button history), yet the rdf data for that document hasn't finished loading. The tests being run in that log aren't waiting for the data to be loaded before continuing (which means they may not be testing what they think they should be)

I assume that the call stack for the last release of nsXULTemplateQueryProcessorRDF in that log is from the same call stack as the memory access error occurs. I notice that the callstack is similar up until nsXULTemplateQueryProcessorRDF::OnAssert.

It may be necessary to add a script blocker earlier on in nsXULTemplateQueryProcessorRDF::OnAssert and related observer methods to prevent the document from being destroyed while processing data.
I was expecting that

  mObservers[i]->OnAssert(this, aSource, aProperty, aTarget)

would hold a ref count to mObservers[i] and prevent it from being deleted. I did a try push to

https://tbpl.mozilla.org/?tree=Try&rev=2b7d38061c24

Which a last minute synchronization. This should at least move the crash if our theory is right.

Another option that might work is to use

 nsCOMPtr<..> foo =  mObservers[i];
 foo->OnAssert(this, aSource, aProperty, aTarget)

but I am not sure if the is still a race condition on the first line or not.
With the patch on try I was no longer able to reproduce the crash locally. I will let Neil Deakin comment on this being the best place to synchronize or not, but it should at least fix the orange.
Attached patch add a lock — — Splinter Review 
Assignee: nobody → respindola
Status: NEW → ASSIGNED

        Attachment #620005 -
        Flags: feedback?

        Attachment #620005 -
        Flags: feedback? → feedback?(enndeakin)

    
    

    
  
I'm not sure what this really does or what the performance implications here are. Would be best to ask someone on the content team to comment, pointing out comments 297-299.

    
    

    
  
Adding bz.

bz,  the most relevant comments are 297 and higher.

        Attachment #620005 -
        Flags: feedback?(enndeakin) → feedback?(bzbarsky)

    
    

    
  
> yet the rdf data for that document hasn't finished loading.

Why would the document be in bfcache, then?

The second stack in the attachment seems to indicate that somehow we ended up under nsXULTemplateBuilder::Observe for the window-destroyed topic in the middle of setting up our template content?  That's really odd.  Can script run in there?

> mObservers[i]->OnAssert(this, aSource, aProperty, aTarget)

This is only safe if you know OnAssert won't modify mObservers.

Why is that a safe assumption in general?  If it's being violated here, seems like the code is just slightly broken no matter what....

Why does adding mutexes help anything?  All this stuff should be main-thread-only; there should be no races here.

    
    

    
  
> Why does adding mutexes help anything?  All this stuff should be
> main-thread-only; there should be no races here.

Then I guess the (a?) bug is that something is using from another thread. The stack that shows remove being called doesn't have OnAssert in it. After that we get a crash with OnAssert on the stack, indicating it got the reference to the nsXULTemplateQueryProcessorRDF before it was removed from mObservers.

Tomorrow I will try to replace the mutex with asserts about being on the main thread and see what I get.

Thanks

    
    

    
  
If you look at that ASAN output:

  READ of size 4 at 0x7f2077a35ef4 thread T0
...
  freed by thread T0 here:
...
  previously allocated by thread T0 here:

All this stuff is touching DOM nodes.  If there were any non-main threads this would already be asserting like the 4th of July.

In any case, the stack to the free call from ASAN does have OnAssert on it: frame 20.  Are you looking at some other stack?

    
    

    
  
I don't think this has anything to do with threads.

I just guessed that it had something to with the bfcache because nsSHEntryShared::RemoveFromBFCacheAsync appears in one of the stacks before the document is destroyed. I don't know much about it though.

The issue is that the loop that iterates over observers isn't protected from something removing items from the list. I suggested adding a script blocker there, as the template observer can generate content, set attributes, etc that can call scripts.
 
It would also be nice to know what exactly is causing the document to be destroyed.

Rafael, can you reproduce this locally, or can you only reproduce this by submitting patches to the tryserver?

    
    

    
  
I can reproduce it locally with asan. Fails 1 in 3 more or less.

> In any case, the stack to the free call from ASAN does have OnAssert on it: frame 20.  Are you looking at some other stack?

No, I had missed it. I guess the lock was just turning this into a timeout :-(

I added a simple assert that should make this easy to reproduce anywhere:

   PRInt32 Count = mObservers.Count();
    for (PRInt32 i = mObservers.Count() - 1; i >= 0; --i) {
        mObservers[i]->OnAssert(this, aSource, aProperty, aTarget);
        MOZ_ASSERT(mObservers.Count() == Count);
    }

Lets see if it does.

    
    

    
  
With the above assert I am able to reproduce it with a regular gcc debug build.

        Attachment #619636 -
        Attachment is patch: false

        Attachment #619636 -
        Attachment mime type: text/plain → application/bzip2

    
    

    
  
Sorry, I take that back. The one that was failing was still with asan.

There is a lot more going on this bug about content that I am familiar with (this is the first time I see the bfcache for example).

I am more than happy to help reproducing the problem, but it would probably be more productive to assign it to someone else.

        Attachment #620005 -
        Flags: feedback?(bzbarsky) → feedback-

    
  
Severity: normal → critical

    
    

    
  
This is not showing up on tbpl, so I am dropping my assignment. I am still available to help anyone reproduce this.
Assignee: respindola → nobody
Severity: critical → normal
Status: ASSIGNED → NEW

    
  
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME

    
    

    
  
(In reply to Rafael Ávila de Espíndola (:espindola) from comment #311)
> This is not showing up on tbpl, so I am dropping my assignment. I am still
> available to help anyone reproduce this.

Is that not because of:

(In reply to Phil Ringnalda (:philor) from comment #288)
> Skipped on Windows in https://hg.mozilla.org/mozilla-central/rev/989503f680bc

?

    
    

    
  
Ah, right.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---

    
  
Status: REOPENED → UNCONFIRMED
Ever confirmed: false
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][test disabled on windows]

    
    

    
  
Taras tells me I should keep it assigned to me.
QA Contact: respindola
Assignee: nobody → respindola
Status: UNCONFIRMED → NEW
Ever confirmed: true
QA Contact: respindola

    
    

    
  
A clarification: I will not have time to work on this any time soon, so I am resetting the assignment.  I will reamin cced in case someone needs help reproducing it.
Assignee: respindola → nobody
Whiteboard: [orange][test which aborts the suite][test disabled on windows] → [test which aborts the suite][test disabled on windows]

    
    

    
  
Bulk assigning P3 to all open intermittent bugs without a priority set in Firefox components per bug 1298978.
Priority: -- → P3

    
    

    
  
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 12 years ago → 6 years ago
Resolution: --- → WONTFIX

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: