Closed Bug 758572 Opened 12 years ago Closed 12 years ago

Intermittent crash during browser_bookmarks.js [@ xpc::WrapperFactory::WrapForSameCompartment]

Categories

(Core :: XPConnect, defect)

Product:
Core
Component:
XPConnect
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: emorley, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

Android XUL Tegra 250 mozilla-inbound opt test browser-chrome on 2012-05-25 01:21:13 PDT for push 97b524dbc4ad

slave: tegra-080

https://tbpl.mozilla.org/php/getParsedLog.php?id=12057763&tree=Mozilla-Inbound

{
TEST-START | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Test adding a bookmark with the Star button
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
INFO | automation.py | Application ran for: 0:00:46.349316
INFO | automation.py | Reading PID log: /tmp/tmpYTP9dtpidlog
getting files in '/mnt/sdcard/tests/profile/minidumps/'
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android-xul/1337930530/fennec-15.0a1.en-US.android-arm.crashreporter-symbols.zip
PROCESS-CRASH | automation.py | application crashed (minidump found)
Crash dump filename: /tmp/tmpkdoMS6/491ba388-105a-dc9f-67643b78-5ad3fb07.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.32.9 #1 SMP PREEMPT Fri Nov 5 19:33:10 UTC 2010 armv7l
CPU: arm
     0 CPUs

Crash reason:  SIGSEGV
Crash address: 0xdadadada

Thread 4 (crashed)
 0  libxul.so!xpc::WrapperFactory::WrapForSameCompartment [xpcpublic.h:97b524dbc4ad : 62 + 0x0]
     r4 = 0x4913e660    r5 = 0x4ece8790    r6 = 0xdadadada    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x476626e8   r10 = 0x4eced010    fp = 0x4d08a980
     sp = 0x47662378    lr = 0x72c652df    pc = 0x72803220
    Found by: given as instruction pointer in context
 1  libxul.so!WrapForSameCompartment [jscompartment.cpp:97b524dbc4ad : 107 + 0x2]
     r4 = 0x47662510    r5 = 0x4913e660    r6 = 0x4b7f4000    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x476626e8   r10 = 0x4eced010    fp = 0x4d08a980
     sp = 0x47662388    pc = 0x72c652df
    Found by: call frame info
 2  libxul.so!JSCompartment::wrap [jscompartment.cpp:97b524dbc4ad : 163 + 0x8]
     r4 = 0x47662510    r5 = 0x4913e660    r6 = 0x4b7f4000    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x476626e8   r10 = 0x4eced010    fp = 0x4d08a980
     sp = 0x47662390    pc = 0x72c670a3
    Found by: call frame info
 3  libxul.so!JS_WrapValue [jsapi.cpp:97b524dbc4ad : 1505 + 0x0]
     r4 = 0x4913e660    r5 = 0x73208df8    r6 = 0x47662500    r7 = 0x47662570
     r8 = 0x00000000    r9 = 0x476626e8   r10 = 0x4eced010    fp = 0x4d08a980
     sp = 0x47662408    pc = 0x72c49ff3
    Found by: call frame info
 4  libxul.so!nsFrameMessageManager::ReceiveMessage [nsFrameMessageManager.cpp:97b524dbc4ad : 398 + 0x4]
     r4 = 0x4913e660    r5 = 0x73208df8    r6 = 0x47662500    r7 = 0x47662570
     r8 = 0x00000000    r9 = 0x476626e8   r10 = 0x4eced010    fp = 0x4d08a980
     sp = 0x47662410    pc = 0x724d8ca9
    Found by: call frame info
 5  libxul.so!nsFrameMessageManager::ReceiveMessage [nsFrameMessageManager.cpp:97b524dbc4ad : 480 + 0x1e]
     r4 = 0x4913e660    r5 = 0x73208df8    r6 = 0x4edb7640    r7 = 0x00000001
     r8 = 0x00000000    r9 = 0x476626e8   r10 = 0x4f20adc0    fp = 0x4edb7640
     sp = 0x476625b8    pc = 0x724d90e9
    Found by: call frame info
 6  libxul.so!nsAsyncMessageToParent::Run [nsAutoPtr.h : 874 + 0x0]
     r4 = 0x4edb7640    r5 = 0x4f16de08    r6 = 0x00000000    r7 = 0x49f1248c
     r8 = 0x476627bf    r9 = 0x00000001   r10 = 0x00000000    fp = 0x0021db50
     sp = 0x47662760    pc = 0x724da1cf
    Found by: call frame info
 7  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:97b524dbc4ad : 624 + 0x6]
     r4 = 0x49f12460    r5 = 0x00000000    r6 = 0x00000000    r7 = 0x49f1248c
     r8 = 0x476627bf    r9 = 0x00000001   r10 = 0x00000000    fp = 0x0021db50
     sp = 0x47662780    pc = 0x72a1f03d
}
Android XUL Tegra 250 try opt test browser-chrome on 2012-05-25 04:04:07 PDT for push 4ffdbceaa5fd

slave: tegra-070

https://tbpl.mozilla.org/php/getParsedLog.php?id=12061528&tree=Try

{
TEST-START | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Test adding a bookmark with the Star button
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must to be declared in the document or in the transfer protocol." {file: "chrome://mochitests/content/browser/mobile/chrome/tests/browser_blank_01.html" line: 0}]
TEST-PASS | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | chrome://mochitests/content/browser/mobile/chrome/tests/browser_blank_01.html should be added.
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Test clicking on a bookmark loads the web page
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "redeclaration of const COMPOSITION_ATTR_RAWINPUT" {file: "chrome://mochikit/content/tests/SimpleTest/EventUtils.js" line: 583}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "NS_ERROR_INVALID_POINTER: Component returned failure code: 0x80004003 (NS_ERROR_INVALID_POINTER) [inIDOMUtils.setContentState]" {file: "chrome://browser/content/content.js" line: 628}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Console message: [JavaScript Error: "The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must to be declared in the document or in the transfer protocol." {file: "chrome://mochitests/content/browser/mobile/chrome/tests/browser_blank_02.html" line: 0}]
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | waitFor NavigationPanelShown(JS frame :: chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js :: <TOP_LEVEL> :: line 109)
TEST-INFO | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | receive NavigationPanelShown
TEST-PASS | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Found the bookmark
TEST-PASS | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Bookmark has the right URL via attribute
TEST-PASS | chrome://mochitests/content/browser/mobile/chrome/tests/browser_bookmarks.js | Bookmark has the right URL via property
INFO | automation.py | Application ran for: 0:00:46.290681
INFO | automation.py | Reading PID log: /tmp/tmpPtfI1Bpidlog
getting files in '/mnt/sdcard/tests/profile/minidumps/'
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/bobbyholley@gmail.com-4ffdbceaa5fd/try-android-xul/fennec-15.0a1.en-US.android-arm.crashreporter-symbols.zip
PROCESS-CRASH | automation.py | application crashed (minidump found)
Crash dump filename: /tmp/tmpiClu44/1abc65ac-3ca1-4b7d-45958a5f-03f1d94e.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.32.9 #1 SMP PREEMPT Fri Nov 5 19:33:10 UTC 2010 armv7l
CPU: arm
     0 CPUs

Crash reason:  SIGSEGV
Crash address: 0xdadadada

Thread 4 (crashed)
 0  libxul.so!JS_ObjectToOuterObject [jsobjinlines.h:4ffdbceaa5fd : 1223 + 0x2]
     r4 = 0x49040660    r5 = 0x49040660    r6 = 0x4b27c000    r7 = 0x00000000
     r8 = 0x47682350    r9 = 0x47682678   r10 = 0x4da60010    fp = 0x4d2d0ec0
     sp = 0x476822c8    lr = 0x727e6e3d    pc = 0x72c91768
    Found by: given as instruction pointer in context
 1  libxul.so!xpc::WrapperFactory::RewrapForSameCompartment [jsfriendapi.h : 356 + 0x0]
     r4 = 0x49040660    r5 = 0x49040660    r6 = 0x4b27c000    r7 = 0x00000000
     r8 = 0x47682350    r9 = 0x47682678   r10 = 0x4da60010    fp = 0x4d2d0ec0
     sp = 0x476822d0    pc = 0x727e6e3d
    Found by: call frame info
 2  libxul.so!WrapForSameCompartment [jscompartment.cpp:4ffdbceaa5fd : 140 + 0x2]
     r4 = 0x476824a0    r5 = 0x49040660    r6 = 0x4b27c000    r7 = 0x00000000
     r8 = 0x47682350    r9 = 0x47682678   r10 = 0x4da60010    fp = 0x4d2d0ec0
     sp = 0x476822e0    pc = 0x72c3fdbb
    Found by: call frame info
 3  libxul.so!JSCompartment::wrap [jscompartment.cpp:4ffdbceaa5fd : 196 + 0x8]
     r4 = 0x476824a0    r5 = 0x49040660    r6 = 0x4b27c000    r7 = 0x00000000
     r8 = 0x47682350    r9 = 0x47682678   r10 = 0x4da60010    fp = 0x4d2d0ec0
     sp = 0x476822e8    pc = 0x72c41c5b
    Found by: call frame info
 4  libxul.so!JS_WrapValue [jsapi.cpp:4ffdbceaa5fd : 1509 + 0x0]
     r4 = 0x49040660    r5 = 0x731d5310    r6 = 0x47682490    r7 = 0x47682500
     r8 = 0x00000000    r9 = 0x47682678   r10 = 0x4da60010    fp = 0x4d2d0ec0
     sp = 0x47682398    pc = 0x72c24d27
    Found by: call frame info
 5  libxul.so!nsFrameMessageManager::ReceiveMessage [nsFrameMessageManager.cpp:4ffdbceaa5fd : 431 + 0x4]
     r4 = 0x49040660    r5 = 0x731d5310    r6 = 0x47682490    r7 = 0x47682500
     r8 = 0x00000000    r9 = 0x47682678   r10 = 0x4da60010    fp = 0x4d2d0ec0
     sp = 0x476823a0    pc = 0x724c2e1d
    Found by: call frame info
 6  libxul.so!nsFrameMessageManager::ReceiveMessage [nsFrameMessageManager.cpp:4ffdbceaa5fd : 513 + 0x1e]
     r4 = 0x49040660    r5 = 0x731d5310    r6 = 0x4f6d8400    r7 = 0x00000001
     r8 = 0x00000000    r9 = 0x47682678   r10 = 0x4fa631f0    fp = 0x4f6d8400
     sp = 0x47682548    pc = 0x724c325d
    Found by: call frame info
 7  libxul.so!nsAsyncMessageToParent::Run [nsAutoPtr.h : 908 + 0x0]
     r4 = 0x4f6d8400    r5 = 0x4fb4f2f8    r6 = 0x00000001    r7 = 0x49f1248c
     r8 = 0x4768274f    r9 = 0x00000001   r10 = 0x00000000    fp = 0x0021db28
     sp = 0x476826f0    pc = 0x724c4343
}
Crash Signature: [@ xpc::WrapperFactory::WrapForSameCompartment] → [@ JS_ObjectToOuterObject] [@ xpc::WrapperFactory::WrapForSameCompartment]
Summary: Intermittent crash during browser_bookmarks.js [@ xpc::WrapperFactory::WrapForSameCompartment] → Intermittent crash during browser_bookmarks.js [@ JS_ObjectToOuterObject] [@ xpc::WrapperFactory::WrapForSameCompartment]
The call to JS_ObjectToOuterObject was only in one of the try pushes - it was removed from the landing.

Anyway, what appears to be happening is that we're trying to wrap a garbage object that comes from nsFrameMessageManager::ReceiveMessage. But looking at that code, it seems like we're calling it from here:

http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsInProcessTabChildGlobal.cpp#46

Which passes nsnull as aObjectsArray, which causes it to be created here:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsFrameMessageManager.cpp#387

But it's immediately rooted, and the conservative stack scanner should handle it in any case. And the object itself is just an empty array that gets allocated here:

http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsFrameMessageManager.cpp#387
Crash Signature: [@ JS_ObjectToOuterObject] [@ xpc::WrapperFactory::WrapForSameCompartment] → [@ xpc::WrapperFactory::WrapForSameCompartment]
Summary: Intermittent crash during browser_bookmarks.js [@ JS_ObjectToOuterObject] [@ xpc::WrapperFactory::WrapForSameCompartment] → Intermittent crash during browser_bookmarks.js [@ xpc::WrapperFactory::WrapForSameCompartment]
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.