Intermittent test_process_error.xul | Exited with code 1 during test run [@ linux-gate.so + 0x424] [@ google_breakpad::UntypedMDRVA::Copy]

RESOLVED FIXED in Firefox 15

Status

()

Toolkit
Breakpad Integration
--
critical
RESOLVED FIXED
5 years ago
3 years ago

People

(Reporter: mbrubeck, Unassigned)

Tracking

({crash, intermittent-failure})

10 Branch
mozilla17
x86
Linux
crash, intermittent-failure
Points:
---

Firefox Tracking Flags

(firefox15 fixed, firefox16 fixed, firefox-esr10 fixed)

Details

(Whiteboard: [test which aborts the suite][qa-], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
https://tbpl.mozilla.org/php/getParsedLog.php?id=12555351&tree=Mozilla-Esr10
Rev3 Fedora 12 mozilla-esr10 debug test mochitest-other on 2012-06-11 09:48:35 PDT for push 629da13f0edf

slave: talos-r3-fed-013

++DOMWINDOW == 1 (0x9c3b9f8) [serial = 1] [outer = (nil)]
###!!! ASSERTION: Should have mContext in non-global/non-process manager!: 'mContext || (aChrome && !aParentManager) || aProcessManager', file ../../../../content/base/src/nsFrameMessageManager.h, line 101
JSGuardObjectNotificationReceiver::~JSGuardObjectNotificationReceiver() (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<affentry, std::allocator<affentry> >::resize(unsigned int, affentry) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<affentry, std::allocator<affentry> >::resize(unsigned int, affentry) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<affentry, std::allocator<affentry> >::resize(unsigned int, affentry) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<mozilla::plugins::IPCByteRange, std::allocator<mozilla::plugins::IPCByteRange> >::resize(unsigned int, mozilla::plugins::IPCByteRange) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<mozilla::plugins::IPCByteRange, std::allocator<mozilla::plugins::IPCByteRange> >::resize(unsigned int, mozilla::plugins::IPCByteRange) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<mozilla::plugins::IPCByteRange, std::allocator<mozilla::plugins::IPCByteRange> >::push_back(mozilla::plugins::IPCByteRange const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::deque<IPC::Message, std::allocator<IPC::Message> >::push_back(IPC::Message const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
void std::vector<std::pair<int, int>, std::allocator<std::pair<int, int> > >::emplace_back<std::pair<int, int> >(std::pair<int, int>&&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
void std::vector<std::pair<int, int>, std::allocator<std::pair<int, int> > >::emplace_back<std::pair<int, int> >(std::pair<int, int>&&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<base::Histogram*, std::allocator<base::Histogram*> >::push_back(base::Histogram* const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::deque<MessageLoop::PendingTask, std::allocator<MessageLoop::PendingTask> >::push_back(MessageLoop::PendingTask const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::deque<MessageLoop::PendingTask, std::allocator<MessageLoop::PendingTask> >::push_back(MessageLoop::PendingTask const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
void std::vector<std::pair<int, int>, std::allocator<std::pair<int, int> > >::emplace_back<std::pair<int, int> >(std::pair<int, int>&&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<base::Histogram*, std::allocator<base::Histogram*> >::push_back(base::Histogram* const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<base::Histogram*, std::allocator<base::Histogram*> >::push_back(base::Histogram* const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
JSD_GetValueForObject (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
XRE_RunAppShell (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
void std::vector<std::pair<int, int>, std::allocator<std::pair<int, int> > >::emplace_back<std::pair<int, int> >(std::pair<int, int>&&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<base::Histogram*, std::allocator<base::Histogram*> >::push_back(base::Histogram* const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
std::vector<base::Histogram*, std::allocator<base::Histogram*> >::push_back(base::Histogram* const&) (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
XRE_InitChildProcess (/home/cltbld/talos-slave/test/build/firefox/libxul.so)
_start (/home/cltbld/talos-slave/test/build/firefox/plugin-container)
__libc_start_main+0x000000E6  (/lib/libc.so.6)
WARNING: Startup cache is only available in the chrome process: file ../../startupcache/StartupCache.cpp, line 163
WARNING: NS_ENSURE_TRUE(aFile) failed: file ../../../../../modules/libjar/zipwriter/src/nsZipWriter.cpp, line 267
WARNING: could not open zipfile for write: file ../../startupcache/StartupCache.cpp, line 394
WARNING: Startup cache is only available in the chrome process: file ../../startupcache/StartupCache.cpp, line 163
WARNING: NS_ENSURE_TRUE(aFile) failed: file ../../../../../modules/libjar/zipwriter/src/nsZipWriter.cpp, line 267
WARNING: could not open zipfile for write: file ../../startupcache/StartupCache.cpp, line 394
WARNING: Startup cache is only available in the chrome process: file ../../startupcache/StartupCache.cpp, line 163
WARNING: NS_ENSURE_TRUE(aFile) failed: file ../../../../../modules/libjar/zipwriter/src/nsZipWriter.cpp, line 267
WARNING: could not open zipfile for write: file ../../startupcache/StartupCache.cpp, line 394
XPCOM_MEM_BLOAT_LOG: /tmp/tmp4FAQKD/runtests_leaks.log
Writing to log: /tmp/tmp4FAQKD/runtests_leaks_tab_pid2210.log
firefox-bin: ../../../../../../toolkit/crashreporter/google-breakpad/src/client/minidump_file_writer.cc:266: bool google_breakpad::UntypedMDRVA::Copy(MDRVA, const void*, size_t): Assertion `size' failed.
WARNING: shutting down early because of crash!: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 746
WARNING: plugin process _exit()ing: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 711
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/dom/ipc/tests/test_process_error.xul | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:02:33.235810
INFO | automation.py | Reading PID log: /tmp/tmp5P44F3pidlog
==> process 2154 launched child process 2186
==> process 2154 launched child process 2210
INFO | automation.py | Checking for orphan process with PID: 2186
INFO | automation.py | Checking for orphan process with PID: 2210
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-esr10-linux-debug/1339432285/firefox-10.0.6esrpre.en-US.linux-i686.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/chrome/dom/ipc/tests/test_process_error.xul | application crashed (minidump found)
Crash dump filename: /tmp/tmp4FAQKD/minidumps/79a31e88-9beb-2afb-3e620c86-5e9d84db.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGABRT
Crash address: 0x86a

Thread 19 (crashed)
 0  linux-gate.so + 0x424
    eip = 0x0085b424   esp = 0xa5afd930   ebp = 0xa5afd948   ebx = 0x0000086a
    esi = 0x00c1f40f   edi = 0x00c58ff4   eax = 0x00000000   ecx = 0x00000889
    edx = 0x00000006   efl = 0x00000206
    Found by: given as instruction pointer in context
 1  libc-2.11.so + 0x2c349
    eip = 0x00b1434a   esp = 0xa5afd950   ebp = 0xa5afda70
    Found by: previous frame's frame pointer
 2  libc-2.11.so + 0x23bd7
    eip = 0x00b0bbd8   esp = 0xa5afda78   ebp = 0xa5afdab8
    Found by: previous frame's frame pointer
 3  libxul.so!google_breakpad::UntypedMDRVA::Copy [minidump_file_writer.cc : 266 + 0x22]
    eip = 0x01225b78   esp = 0xa5afdac0   ebp = 0xa5afdaf8
    Found by: previous frame's frame pointer
 4  libxul.so!google_breakpad::MinidumpWriter::WriteFile [minidump_writer.cc : 1311 + 0x10]
    eip = 0x01223797   esp = 0xa5afdb00   ebp = 0xa5afdb88   ebx = 0x02a84c28
    esi = 0xb5a00008   edi = 0x0001dbf8
    Found by: call frame info
 5  libxul.so!google_breakpad::MinidumpWriter::WriteProcFile [minidump_writer.cc : 1372 + 0xc]
    eip = 0x012239af   esp = 0xa5afdb90   ebp = 0xa5afdbf8   ebx = 0x02a84c28
    esi = 0x025dd89f   edi = 0xa5afdbb3
    Found by: call frame info
 6  libxul.so!google_breakpad::MinidumpWriter::Dump [minidump_writer.cc : 560 + 0x6]
    eip = 0x01225548   esp = 0xa5afdc00   ebp = 0xa5afdcb8   ebx = 0x02a84c28
    esi = 0xa5afdcd4   edi = 0x00000008
    Found by: call frame info
 7  libxul.so!google_breakpad::WriteMinidump [minidump_writer.cc : 1417 + 0x8]
    eip = 0x012256e6   esp = 0xa5afdcc0   ebp = 0xa5afdd58   ebx = 0x02a84c28
    esi = 0xa5afdcd4   edi = 0x00000000
    Found by: call frame info
 8  libxul.so!google_breakpad::WriteMinidump [minidump_writer.cc : 1403 + 0x4]
    eip = 0x012257d9   esp = 0xa5afdd60   ebp = 0xa5afddb8   ebx = 0x02a84c28
    esi = 0xa5afdd98   edi = 0xa5afdd90
    Found by: call frame info
 9  libxul.so!google_breakpad::CrashGenerationServer::ClientEvent [crash_generation_server.cc : 393 + 0x19]
    eip = 0x01220205   esp = 0xa5afddc0   ebp = 0xa5afe328   ebx = 0x02a84c28
    esi = 0x0000003e   edi = 0xa5afe158
    Found by: call frame info
10  libxul.so!google_breakpad::CrashGenerationServer::Run [crash_generation_server.cc : 287 + 0x12]
This is failing an assertion here:
http://mxr.mozilla.org/mozilla-central/source/toolkit/crashreporter/google-breakpad/src/client/minidump_file_writer.cc#266
via http://mxr.mozilla.org/mozilla-central/source/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/minidump_writer.cc#1311
via http://mxr.mozilla.org/mozilla-central/source/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/minidump_writer.cc#1372
via http://mxr.mozilla.org/mozilla-central/source/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/minidump_writer.cc#560

This code is trying to copy /proc/self/environ to the minidump and hitting a zero-size file chunk.

I think this is just an edgecase bug in the Breakpad code.
This was fixed upstream, we should just land that patch locally:
http://code.google.com/p/google-breakpad/source/detail?r=792
Comment hidden (Treeherder Robot)

Updated

5 years ago
Severity: normal → critical
Comment hidden (Treeherder Robot)
Pushed the upstream patch:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b9923c05eafd
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Oops, that's only on inbound.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Status: REOPENED → NEW

Comment 7

5 years ago
https://hg.mozilla.org/mozilla-central/rev/b9923c05eafd
Status: NEW → RESOLVED
Last Resolved: 5 years ago5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Comment hidden (Treeherder Robot)
Ed: do you think we should land this on ESR10? It's a pretty safe correctness fix that's been upstream for quite a while.
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
(In reply to Ted Mielczarek [:ted] from comment #9)
> Ed: do you think we should land this on ESR10? It's a pretty safe
> correctness fix that's been upstream for quite a while.

Sorry wasn't CC'd (I get too much bugmail if I CC by default when merging).

Yes agree would be a good one to backport :-)
Created attachment 649601 [details] [diff] [review]
upstream fix, as landed

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration: Intermittent random orange on tinderbox.
User impact if declined: Very minimal chance that this could be hit by a user, causing a browser crash during OOP crash reporting.
Fix Landed on Version: 17
Risk to taking this patch (and alternatives if risky): Minimal, has been fixed upstream in Breakpad for a long time.
String or UUID changes made by this patch: None

See https://wiki.mozilla.org/Release_Management/ESR_Landing_Process for more info.
Attachment #649601 - Flags: approval-mozilla-esr10?
Why landing to ESR and not also uplifting to Beta/Aurora?
Comment hidden (Treeherder Robot)
I think the only reason I mentioned ESR is because the failures that are being noted here are from ESR.

The failure here is an edgecase based on the size of the environment variables for the process, so it's probably just that something on the ESR test runs makes it more likely to hit this. The code is broken on Aurora/Beta, so if it makes you feel better about the process we could certainly land it there as well. As I said, it's a very safe correctness fix.
Comment on attachment 649601 [details] [diff] [review]
upstream fix, as landed

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration: Intermittent random orange on tinderbox.
User impact if declined: Very minimal chance that this could be hit by a user, causing a browser crash during OOP crash reporting.
Fix Landed on Version: 17
Risk to taking this patch (and alternatives if risky): Minimal, has been fixed upstream in Breakpad for a long time.
String or UUID changes made by this patch: None
Attachment #649601 - Flags: approval-mozilla-beta?
Attachment #649601 - Flags: approval-mozilla-aurora?
Comment on attachment 649601 [details] [diff] [review]
upstream fix, as landed

wfm then, thanks.
Attachment #649601 - Flags: approval-mozilla-esr10?
Attachment #649601 - Flags: approval-mozilla-esr10+
Attachment #649601 - Flags: approval-mozilla-beta?
Attachment #649601 - Flags: approval-mozilla-beta+
Attachment #649601 - Flags: approval-mozilla-aurora?
Attachment #649601 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/4b14245b6996
https://hg.mozilla.org/releases/mozilla-beta/rev/d15738db65a4
https://hg.mozilla.org/releases/mozilla-esr10/rev/a3fd5359ad3e
status-firefox-esr10: --- → fixed
status-firefox15: --- → fixed
status-firefox16: --- → fixed

Updated

5 years ago
Whiteboard: [orange][test which aborts the suite] → [orange][test which aborts the suite][qa-]
(Assignee)

Updated

5 years ago
Keywords: intermittent-failure
(Assignee)

Updated

5 years ago
Whiteboard: [orange][test which aborts the suite][qa-] → [test which aborts the suite][qa-]
You need to log in before you can comment on or make changes to this bug.