751583 - crash in CrashReporter::AppendAppNotesToCrashReport

Status: RESOLVED WORKSFORME

(Toolkit :: Crash Reporting, defect)

Description

[Scoobidiver (away)]

It's a new crash signature on Linux and is #1 top crasher over the last day (bug 750637 prevents from having a larger duration).

Stacks are various:
Frame 	Module 	Signature 	Source
0 	libmozalloc.so 	TouchBadMemory 	mozalloc_abort.cpp:68
1 	libxul.so 	CrashReporter::AppendAppNotesToCrashReport 	nsExceptionHandler.cpp:1261
2 	libxul.so 	NS_DebugBreak_P 	nsDebugImpl.cpp:388
3 	libxul.so 	AbortIfOffMainThreadIfCheckFast 	nsCycleCollector.cpp:1306
4 	libxul.so 	nsCycleCollector::Forget2 	nsCycleCollector.cpp:2716
5 	libxul.so 	NS_CycleCollectorForget2_P 	nsCycleCollector.cpp:3632
6 	libxul.so 	nsCycleCollectingAutoRefCnt::incr 	nsISupportsImpl.h:161
7 	libxul.so 	nsGlobalWindow::AddRef 	nsGlobalWindow.cpp:1409 
...

0 	libmozalloc.so 	TouchBadMemory 	mozalloc_abort.cpp:68
1 	libxul.so 	CrashReporter::AppendAppNotesToCrashReport 	nsExceptionHandler.cpp:1261
2 	libxul.so 	NS_DebugBreak_P 	nsDebugImpl.cpp:388
3 	libxul.so 	X11Error 	nsX11ErrorHandler.cpp:190
4 	libbonoboui-2.so.0.0.0 	libbonoboui-2.so.0.0.0@0x20d33 	
5 	libX11.so.6.3.0 	libX11.so.6.3.0@0x3ce38 	
6 	libX11.so.6.3.0 	libX11.so.6.3.0@0x39939 	
7 	libX11.so.6.3.0 	libX11.so.6.3.0@0x3a07b 	
8 	libXinerama.so.1.0.0 	libXinerama.so.1.0.0@0xc0f 	
9 	libxul.so 	nsScreenManagerGtk::Init 	nsScreenManagerGtk.cpp:169 
...

Frame 	Module 	Signature 	Source
0 	libmozalloc.so 	TouchBadMemory 	mozalloc_abort.cpp:68
1 	libxul.so 	CrashReporter::AppendAppNotesToCrashReport 	nsExceptionHandler.cpp:1261
2 	libxul.so 	NS_DebugBreak_P 	nsDebugImpl.cpp:388
3 	libxul.so 	X11Error 	nsX11ErrorHandler.cpp:190
4 	libbonoboui-2.so.0.0.0 	libbonoboui-2.so.0.0.0@0x20d33 	
5 	libX11.so.6.3.0 	_XError 	XlibInt.c:3103
6 	libX11.so.6.3.0 	process_responses 	xcb_io.c:214
7 	libX11.so.6.3.0 	_XEventsQueued 	xcb_io.c:263
8 	libX11.so.6.3.0 	XPending 	Pending.c:56
9 	libgdk-x11-2.0.so.0.2000.1 	gdk_event_prepare 	gdkevents-x11.c:154
10 	libglib-2.0.so.0.2400.1 	IA__g_main_context_prepare 	gmain.c:2280
11 	libglib-2.0.so.0.2400.1 	g_main_context_iterate 	gmain.c:2571
12 	libglib-2.0.so.0.2400.1 	IA__g_main_context_iteration 	gmain.c:2654
13 	libxul.so 	nsAppShell::ProcessNextNativeEvent 	nsAppShell.cpp:162 
...

Frame 	Module 	Signature 	Source
0 	libmozalloc.so 	TouchBadMemory 	mozalloc_abort.cpp:68
1 	libxul.so 	CrashReporter::AppendAppNotesToCrashReport 	nsExceptionHandler.cpp:1261
2 	libxul.so 	NS_DebugBreak_P 	nsDebugImpl.cpp:388
3 	libxul.so 	X11Error 	nsX11ErrorHandler.cpp:190
4 	libbonoboui-2.so.0.0.0 	libbonoboui-2.so.0.0.0@0x20d33 	
5 	libX11.so.6.3.0 	_XError 	XlibInt.c:3103
6 	libX11.so.6.3.0 	process_responses 	xcb_io.c:214
7 	libX11.so.6.3.0 	_XReply 	xcb_io.c:464
8 	libX11.so.6.3.0 	XSync 	Sync.c:48
9 	libgdk-x11-2.0.so.0.2000.1 	_gdk_x11_copy_to_image 	gdkimage-x11.c:521
10 	libgdk-x11-2.0.so.0.2000.1 	IA__gdk_drawable_copy_to_image 	gdkdraw.c:1094
11 	libgdk-x11-2.0.so.0.2000.1 	IA__gdk_drawable_copy_to_image 	gdkdraw.c:1094
12 	libflashplayer.so 	libflashplayer.so@0x5825ed
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=TouchBadMemory+|+CrashReporter%3A%3AAppendAppNotesToCrashReport

Comment 1

[(not currently active) Ted Mielczarek]

I'm pretty sure I don't believe this stack. Line 1261 of nsExceptionHandler.cpp is just the start of the function:
http://mxr.mozilla.org/mozilla-release/source/toolkit/crashreporter/nsExceptionHandler.cpp#1261

and nowhere in there does it call TouchBadMemory or anything that would call TouchBadMemory.

I think we're just walking the stack badly here, possibly because we don't have unwind info for TouchBadMemory?

Comment 2

[Robert Kaiser]

https://crash-stats.mozilla.com/topcrasher/byos/Firefox/12.0/Linux/7/browser says this is our #1 Linux signature now, I wonder what's up there.

Comment 3

[Scoobidiver (away)]

There are no crashes in 13.0 and above

Comment 4

[(not currently active) Ted Mielczarek]

Probably related to bug 697301, I'm still convinced of my assertions in comment 1.

Comment 5

[Scoobidiver (away)]

It might be a regression from bug 717951 that landed in 12.0.

Comment 6

[Scoobidiver (away)]

(In reply to Scoobidiver from comment #3)
> There are no crashes in 13.0 and above
There are crashes with the release version. It's currently #3 top crasher in 13.0.

Comment 7

[Scoobidiver (away)]

It's only #13 top browser crasher in 15.0.

Comment 8

[Scoobidiver (away)]

It jumped up to #3 in 15.0.1.

Comment 9

[Scoobidiver (away)]

There are no crashes in 16.0 and above.