TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/layout/base/test/chrome/test_bug396367-2.html | ABORT: PresArena: poison overwritten | Exited with code 1 during test run

RESOLVED INVALID

Status

()

Core
Layout
--
critical
RESOLVED INVALID
6 years ago
3 years ago

People

(Reporter: briansmith, Unassigned)

Tracking

({intermittent-failure})

15 Branch
x86
Mac OS X
intermittent-failure
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox14 wontfix, firefox15 affected, firefox16 affected, firefox17 affected)

Details

(Whiteboard: [badslave?])

+++ This bug was initially created as a clone of Bug #710873 +++

This looks like a problem detected by frame poisoning on Aurora 15.

https://tbpl.mozilla.org/php/getParsedLog.php?id=13408077&tree=Mozilla-Aurora&full=1#error0

start+0x00000B2C [/Users/cltbld/talos-slave/test/build/FirefoxAuroraDebug.app/Contents/MacOS/firefox-bin +0x00001C8C]
###!!! ABORT: PresArena: poison overwritten: '*reinterpret_cast<uintptr_t*>(p) == ARENA_POISON', file ../../../layout/base/nsPresArena.cpp, line 322
WARNING: shutting down early because of crash!: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 699
WARNING: plugin process _exit()ing: file ../../../../dom/plugins/ipc/PluginModuleChild.cpp, line 664
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/layout/base/test/chrome/test_bug396367-2.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:04:19.359311
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpS9efzHpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-aurora-macosx64-debug/1341962864/firefox-15.0a2.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/chrome/layout/base/test/chrome/test_bug396367-2.html | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmp5iQz5J/minidumps/D2CDAA63-1949-4908-84B8-E8CBF89698A1.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x0

Thread 0 (crashed)
 0  libmozalloc.dylib!TouchBadMemory [mozalloc_abort.cpp : 35 + 0x0]
    rbx = 0x70cbb2f8   r12 = 0x70cbb2f8   r13 = 0x5fbf7af0   r14 = 0x03884819
    r15 = 0x038847e8   rip = 0x000e0984   rsp = 0x5fbf7a90   rbp = 0x5fbf7a90
    Found by: given as instruction pointer in context
 1  libmozalloc.dylib!mozalloc_abort [mozalloc_abort.cpp : 56 + 0x4]
    rbx = 0x70cbb2f8   r12 = 0x70cbb2f8   r13 = 0x5fbf7af0   r14 = 0x03884819
    r15 = 0x038847e8   rip = 0x000e09ca   rsp = 0x5fbf7aa0   rbp = 0x5fbf7ab0
    Found by: call frame info
 2  XUL!NS_DebugBreak_P [nsDebugImpl.cpp : 382 + 0x7]
    rbx = 0x5fbf7ae0   r12 = 0x70cbb2f8   r13 = 0x5fbf7af0   r14 = 0x03884819
    r15 = 0x038847e8   rip = 0x02e7d45f   rsp = 0x5fbf7ac0   rbp = 0x5fbf7f20
    Found by: call frame info
 3  XUL!nsPresArena::AllocateBySize [nsPresArena.cpp : 321 + 0x30]
    rbx = 0x00e61eb0   r12 = 0x00e61ec8   r13 = 0x00e61e30   r14 = 0x00000386
    r15 = 0x00000387   rip = 0x013f7e91   rsp = 0x5fbf7f30   rbp = 0x5fbf7f70
    Found by: call frame info
 4  XUL!nsRuleNode::ComputeBackgroundData [nsIPresShell.h : 259 + 0xd]
    rbx = 0x1f5f5478   r12 = 0x5fbf8280   r13 = 0x1f251a00   r14 = 0x00000001
    r15 = 0x00000001   rip = 0x0165350f   rsp = 0x5fbf7f80   rbp = 0x5fbf8130
    Found by: call frame info
 5  XUL!nsRuleNode::WalkRuleTree [nsStyleStructList.h : 77 + 0x30]
    rbx = 0x00000001   r12 = 0x00f765f0   r13 = 0x00000009   r14 = 0x00000009
    r15 = 0x00000001   rip = 0x0162e33b   rsp = 0x5fbf8140   rbp = 0x5fbf83a0
    Found by: call frame info
 6  XUL!nsRuleNode::GetStyleBackground [nsStyleStructList.h : 77 + 0xd2]
    rbx = 0x00cfe6c0   r12 = 0x00000000   r13 = 0x2e350588   r14 = 0x05726840
    r15 = 0x2b2c0478   rip = 0x01631daf   rsp = 0x5fbf83b0   rbp = 0x5fbf83c0
    Found by: call frame info
 7  XUL!nsStyleContext::CalcStyleDifference [nsStyleStructList.h : 77 + 0x10]
    rbx = 0x0000003f   r12 = 0x00000000   r13 = 0x2e350588   r14 = 0x05726840
    r15 = 0x2b2c0478   rip = 0x0166d3c1   rsp = 0x5fbf83d0   rbp = 0x5fbf8430
    Found by: call frame info
 8  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 982 + 0x7]
    rbx = 0x00000000   r12 = 0x2a733100   r13 = 0x2b2c0478   r14 = 0x00000002
    r15 = 0x05726f08   rip = 0x013da838   rsp = 0x5fbf8440   rbp = 0x5fbf8650
    Found by: call frame info
 9  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x05726f08   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x05726af0   rip = 0x013db0f1   rsp = 0x5fbf8660   rbp = 0x5fbf8870
    Found by: call frame info
10  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x05726af0   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f5fa2d0   rip = 0x013db0f1   rsp = 0x5fbf8880   rbp = 0x5fbf8a90
    Found by: call frame info
11  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f5fa2d0   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f5f9e20   rip = 0x013db0f1   rsp = 0x5fbf8aa0   rbp = 0x5fbf8cb0
    Found by: call frame info
12  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1134 + 0x59]
    rbx = 0x1f5f9b78   r12 = 0x1f5f9e20   r13 = 0x2b1b0528   r14 = 0x00000002
    r15 = 0x1f5f9b78   rip = 0x013dbca8   rsp = 0x5fbf8cc0   rbp = 0x5fbf8ed0
    Found by: call frame info
13  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f5f9b78   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f5f9300   rip = 0x013db0f1   rsp = 0x5fbf8ee0   rbp = 0x5fbf90f0
    Found by: call frame info
14  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f5f9300   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f5f5760   rip = 0x013db0f1   rsp = 0x5fbf9100   rbp = 0x5fbf9310
    Found by: call frame info
15  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f5f5760   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f5f51a0   rip = 0x013db0f1   rsp = 0x5fbf9320   rbp = 0x5fbf9530
    Found by: call frame info
16  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f5f51a0   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f5f1878   rip = 0x013db0f1   rsp = 0x5fbf9540   rbp = 0x5fbf9750
    Found by: call frame info
17  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1567 + 0x5c]
    rbx = 0x1f5fc998   r12 = 0x1f5f1878   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f5f00e0   rip = 0x013db39d   rsp = 0x5fbf9760   rbp = 0x5fbf9970
    Found by: call frame info
18  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f5f00e0   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f251f38   rip = 0x013db0f1   rsp = 0x5fbf9980   rbp = 0x5fbf9b90
    Found by: call frame info
19  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f251f38   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f250da0   rip = 0x013db0f1   rsp = 0x5fbf9ba0   rbp = 0x5fbf9db0
    Found by: call frame info
20  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f250da0   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f250ba0   rip = 0x013db0f1   rsp = 0x5fbf9dc0   rbp = 0x5fbf9fd0
    Found by: call frame info
21  XUL!nsFrameManager::ReResolveStyleContext [nsFrameManager.cpp : 1588 + 0x5c]
    rbx = 0x1f250ba0   r12 = 0x04420a80   r13 = 0x00000000   r14 = 0x00000001
    r15 = 0x1f2503e8   rip = 0x013db0f1   rsp = 0x5fbf9fe0   rbp = 0x5fbfa1f0
    Found by: call frame info
22  XUL!nsFrameManager::ComputeStyleChangeFor [nsFrameManager.cpp : 1679 + 0x45]
    rbx = 0x1f2503e8   r12 = 0x1f2503e8   r13 = 0x0000003f   r14 = 0x1f2503e8
    r15 = 0x27809b40   rip = 0x013dccac   rsp = 0x5fbfa200   rbp = 0x5fbfa470
    Found by: call frame info
23  XUL!nsCSSFrameConstructor::RebuildAllStyleData [nsCSSFrameConstructor.cpp : 11610 + 0x1a]
    rbx = 0x257eac10   r12 = 0x5fbfa480   r13 = 0x27809b40   r14 = 0x0000003f
    r15 = 0x0000003f   rip = 0x01377a05   rsp = 0x5fbfa480   rbp = 0x5fbfa600
    Found by: call frame info
24  XUL!DocumentViewerImpl::SetTextZoom [nsPresContext.h : 513 + 0xc]
    rbx = 0x25686120   r12 = 0x257eac10   r13 = 0x5fbfa620   r14 = 0x5fbfa6c0
    r15 = 0x25686138   rip = 0x013cb550   rsp = 0x5fbfa610   rbp = 0x5fbfa650
    Found by: call frame info
25  XUL!NS_InvokeByIndex_P [xptcinvoke_x86_64_unix.cpp : 163 + 0x1]
    rbx = 0x00000001   r12 = 0x00000001   r13 = 0x02e91ad0   r14 = 0x5fbfa6c0
    r15 = 0x25686138   rip = 0x02e91be3   rsp = 0x5fbfa660   rbp = 0x5fbfa730
    Found by: call frame info
26  XUL!XPCWrappedNative::CallMethod [XPCWrappedNative.cpp : 3110 + 0x18]
    rbx = 0x5fbfab50   r12 = 0x5fbfaa00   r13 = 0x00000001   r14 = 0x00000000
    r15 = 0x00000001   rip = 0x0243d6c9   rsp = 0x5fbfa740   rbp = 0x5fbfab10
    Found by: call frame info
27  XUL!XPC_WN_GetterSetter [xpcprivate.h : 2757 + 0xc]
    rbx = 0x5fbfab50   r12 = 0x00000000   r13 = 0x4ecae580   r14 = 0x070410b0
    r15 = 0x26c89640   rip = 0x024485c4   rsp = 0x5fbfab20   rbp = 0x5fbfac70
    Found by: call frame info
28  XUL!js::CallJSNative [jscntxtinlines.h : 395 + 0x5]
    rbx = 0x9999999a   r12 = 0x070410c8   r13 = 0x5fbfae00   r14 = 0xffffffff
    r15 = 0x26c89640   rip = 0x03410876   rsp = 0x5fbfac80   rbp = 0x5fbfacd0
    Found by: call frame info
29  XUL!js::InvokeKernel [jsinterp.cpp : 310 + 0xb]
    rbx = 0x4ec46e20   r12 = 0x00000000   r13 = 0x26c89640   r14 = 0xffffffff
    r15 = 0x0440c4e0   rip = 0x0340ca9e   rsp = 0x5fbface0   rbp = 0x5fbfadf0
    Found by: call frame info
30  XUL!js::Invoke [jsinterp.h : 125 + 0x3a]
    rbx = 0x4ecae580   r12 = 0x070410c0   r13 = 0x5fbfb288   r14 = 0x5fbfb280
    r15 = 0x26c89640   rip = 0x0340e224   rsp = 0x5fbfae00   rbp = 0x5fbfaed0
    Found by: call frame info
31  XUL!js::InvokeGetterOrSetter [jsinterp.cpp : 432 + 0x1f]
    rbx = 0x26c89640   r12 = 0x5fbfb280   r13 = 0x5fbfb280   r14 = 0x00000001
    r15 = 0x5fbfaf90   rip = 0x0340e3a9   rsp = 0x5fbfaee0   rbp = 0x5fbfaf30
    Found by: call frame info
32  XUL!js::Shape::set [jsscopeinlines.h : 291 + 0x16]
    rbx = 0x4ec80970   r12 = 0x26c89640   r13 = 0x26c89640   r14 = 0x5fbfb000
    r15 = 0x5fbfb280   rip = 0x03456603   rsp = 0x5fbfaf40   rbp = 0x5fbfafe0
    Found by: call frame info
33  XUL!js_NativeSet [jsobj.cpp : 5032 + 0xd]
    rbx = 0x4ec80970   r12 = 0x26c89640   r13 = 0x4ecae580   r14 = 0x5fbfb280
    r15 = 0x00000978   rip = 0x0343083a   rsp = 0x5fbfaff0   rbp = 0x5fbfb040
    Found by: call frame info
34  XUL!js::baseops::SetPropertyHelper [jsobj.cpp : 5436 + 0x2a]
    rbx = 0x5fbfb2a0   r12 = 0x26c89640   r13 = 0x5fbfb270   r14 = 0x00000075
    r15 = 0x00000000   rip = 0x0343a441   rsp = 0x5fbfb050   rbp = 0x5fbfb230
    Found by: call frame info
35  XUL!js::SetPropertyOperation [jsinterpinlines.h : 311 + 0x14]
    rbx = 0x00000000   r12 = 0x09b5af80   r13 = 0x00000036   r14 = 0x04f84008
    r15 = 0x26c89640   rip = 0x03410c26   rsp = 0x5fbfb240   rbp = 0x5fbfb2e0
    Found by: call frame info
36  XUL!js::Interpret [jsinterp.cpp : 2424 + 0x1a]
    rbx = 0x00000036   r12 = 0x00000000   r13 = 0x00000036   r14 = 0x99999900
    r15 = 0x0440c4e0   rip = 0x033edb43   rsp = 0x5fbfb2f0   rbp = 0x5fbfbe70
    Found by: call frame info
37  XUL!js::RunScript [jsinterp.cpp : 266 + 0xc]
    rbx = 0x4ecaa060   r12 = 0x26c89640   r13 = 0x07041030   r14 = 0x4ec6f700
    r15 = 0x07041030   rip = 0x0340b52d   rsp = 0x5fbfbe80   rbp = 0x5fbfbed0
    Found by: call frame info
38  XUL!js::ExecuteKernel [jsinterp.cpp : 466 + 0x11]
    rbx = 0x04b74a58   r12 = 0x00fa0600   r13 = 0x07041030   r14 = 0x4ec6f700
    r15 = 0x4ec841f0   rip = 0x0340bd76   rsp = 0x5fbfbee0   rbp = 0x5fbfbfa0
    Found by: call frame info
39  XUL!js::Execute [jsinterp.cpp : 508 + 0x1f]
    rbx = 0x4ecc3040   r12 = 0x26c89640   r13 = 0x00000000   r14 = 0x4ec6f700
    r15 = 0x00000000   rip = 0x0340c900   rsp = 0x5fbfbfb0   rbp = 0x5fbfc020
    Found by: call frame info
40  XUL!EvaluateUCScriptForPrincipalsCommon [jsapi.cpp : 5390 + 0x12]
    rbx = 0x4ec6f700   r12 = 0x26c89640   r13 = 0x00000096   r14 = 0x29376bd8
    r15 = 0x00000000   rip = 0x032f6e8b   rsp = 0x5fbfc030   rbp = 0x5fbfc0f0
    Found by: call frame info
41  XUL!JS_EvaluateUCScriptForPrincipalsVersionOrigin [jsapi.cpp : 5427 + 0x36]
    rbx = 0x00001000   r12 = 0x00000000   r13 = 0x26c89640   r14 = 0x00000040
    r15 = 0x00000096   rip = 0x032fed4d   rsp = 0x5fbfc100   rbp = 0x5fbfc180
    Found by: call frame info
42  XUL!nsJSContext::EvaluateString [nsJSEnvironment.cpp : 1453 + 0x4a]
    rbx = 0x4ecaa060   r12 = 0x00172cd0   r13 = 0x26c88490   r14 = 0x00000000
    r15 = 0x4ecaa060   rip = 0x01cdb1ab   rsp = 0x5fbfc190   rbp = 0x5fbfc320
    Found by: call frame info
43  XUL!nsScriptLoader::EvaluateScript [nsScriptLoader.cpp : 877 + 0x51]
    rbx = 0x00172cd0   r12 = 0x47779290   r13 = 0x2567f640   r14 = 0x26c88490
    r15 = 0x477792e8   rip = 0x018d29a7   rsp = 0x5fbfc330   rbp = 0x5fbfc4a0
    Found by: call frame info
44  XUL!nsScriptLoader::ProcessRequest [nsScriptLoader.cpp : 770 + 0x11]
    rbx = 0x00000000   r12 = 0x04390590   r13 = 0x5fbfc5d0   r14 = 0x0c9f2700
    r15 = 0x47779290   rip = 0x018d3261   rsp = 0x5fbfc4b0   rbp = 0x5fbfc680
    Found by: call frame info
45  XUL!nsScriptLoader::ProcessScriptElement [nsScriptLoader.cpp : 716 + 0x7]
    rbx = 0x0c9f2740   r12 = 0x00000000   r13 = 0x47779290   r14 = 0x4f531f50
    r15 = 0x2b890720   rip = 0x018d6277   rsp = 0x5fbfc690   rbp = 0x5fbfcc50
    Found by: call frame info
46  XUL!nsScriptElement::MaybeProcessScript [nsScriptElement.cpp : 136 + 0xa]
    rbx = 0x00000000   r12 = 0x2b890720   r13 = 0x47779290   r14 = 0x5fbfcc88
    r15 = 0x00d87600   rip = 0x018cede8   rsp = 0x5fbfcc60   rbp = 0x5fbfcd10
    Found by: call frame info
47  XUL!nsHtml5TreeOpExecutor::RunScript [nsIScriptElement.h : 220 + 0x9]
    rbx = 0x00000000   r12 = 0x2b890720   r13 = 0x47753200   r14 = 0x2b890740
    r15 = 0x5fbfcd60   rip = 0x01fe6ead   rsp = 0x5fbfcd20   rbp = 0x5fbfcdc0
    Found by: call frame info
48  XUL!nsHtml5TreeOpExecutor::RunFlushLoop [nsHtml5TreeOpExecutor.cpp : 549 + 0x7]
    rbx = 0x4d0f2ba8   r12 = 0x4d0f2ba8   r13 = 0x47753200   r14 = 0x00000024
    r15 = 0x5fbfce18   rip = 0x01fe84ca   rsp = 0x5fbfcdd0   rbp = 0x5fbfce70
    Found by: call frame info
49  XUL!nsHtml5ExecutorReflusher::Run [nsHtml5TreeOpExecutor.cpp : 63 + 0x8]
    rbx = 0x27813cd0   r12 = 0x00000000   r13 = 0x00609840   r14 = 0x00609800
    r15 = 0x00000000   rip = 0x01fe912c   rsp = 0x5fbfce80   rbp = 0x5fbfce90
    Found by: call frame info
50  XUL!nsThread::ProcessNextEvent [nsThread.cpp : 624 + 0x5]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x00609840   r14 = 0x00609800
    r15 = 0x00000000   rip = 0x02e6bc88   rsp = 0x5fbfcea0   rbp = 0x5fbfcf70
    Found by: call frame info
51  XUL!NS_ProcessPendingEvents_P [nsThreadUtils.cpp : 163 + 0xd]
    rbx = 0x00609800   r12 = 0x00000000   r13 = 0x736f2b7d   r14 = 0x00000014
    r15 = 0x5fbfcf8f   rip = 0x02df036e   rsp = 0x5fbfcf80   rbp = 0x5fbfcfc0
    Found by: call frame info
52  XUL!nsBaseAppShell::NativeEventCallback [nsBaseAppShell.cpp : 97 + 0x13]
    rbx = 0x0013ee30   r12 = 0x00000000   r13 = 0x00609800   r14 = 0x00000000
    r15 = 0x0011b580   rip = 0x02a74f1b   rsp = 0x5fbfcfd0   rbp = 0x5fbfcff0
    Found by: call frame info
53  XUL!nsAppShell::ProcessGeckoEvents [nsAppShell.mm : 410 + 0x7]
    rbx = 0x044251e0   r12 = 0x0013ee30   r13 = 0x0085d600   r14 = 0x0011b580
    r15 = 0x0011b580   rip = 0x02a25e55   rsp = 0x5fbfd000   rbp = 0x5fbfd060
    Found by: call frame info
54  CoreFoundation + 0x4e400
    rbx = 0x00120270   r12 = 0x00120284   r13 = 0x00000001   r14 = 0x0011b580
    r15 = 0x0011b580   rip = 0x81777401   rsp = 0x5fbfd070   rbp = 0x5fbfd100
    Found by: call frame info
FTR, the above build was from rev 99faf1860ca5
Severity: normal → critical
Keywords: sec-critical
status-firefox-esr10: --- → affected
status-firefox14: --- → wontfix
status-firefox15: --- → affected
status-firefox16: --- → affected
tracking-firefox15: --- → +
tracking-firefox16: --- → +
Keywords: testcase
Ehsan can you help find us an assignee?
Assignee: nobody → ehsan

Comment 3

6 years ago
David, do you know the frame poisoning stuff?  Can you please take a look?
Assignee: ehsan → dbaron
This isn't really anything frame-poisoning specific in any way; this is just an assertion that's designed to detect memory corruption.
I don't think there's a whole lot we can do about this unless we have a way to reproduce; I'm not inclined to be concerned about a memory-corruption bug that happened *once*.  I think we're doing enough test runs that we actually might get random memory failures now and then.
Assignee: dbaron → nobody
See also similar bug 775045.
status-firefox17: --- → affected
tracking-firefox17: --- → +
although we nominally have a testcase, we need a reliable testcase.
Keywords: testcase → testcase-wanted
Maybe we can catch this by running this testsuite in an ASan build. Should run the whole suite, the memory corruption may have happened before this particular test detected it.

Gary, Christian: do either of you have time to do that?
I ran the test through an ASan debug build on Linux and was not able to spot any problems. I cannot test this with Mac OSX on try, because try aborts the tests earlier (some other test has an ASan failure/assert that we have to sort out first).
tracking-firefox15: + → ---
tracking-firefox16: + → ---
tracking-firefox17: + → ---
Taking off the esr10-affected flag, I don't know where we know that from. Very well could affect it, but since we don't know the cause and no one's said they've seen it there yet it's premature.
status-firefox-esr10: affected → ---
Critsmash triage: we're closing this as incomplete until someone can find a repro case here. We can't act on this bug without one.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → INCOMPLETE
Also worth noting that the build was from:
slave: talos-r4-snow-014
In bug 785724 I requested that talos-r4-snow-014 be removed from service due to memory corruption problems.

Updated

6 years ago
Depends on: 785724
Whiteboard: [orange] → [orange][badslave?]
Bug 785737 extends the text for this assertion to print values so that we can distinguish likelihood of hardware vs. software problems as the cause of the assertion.
This bug was observed only on one or more of the six machines listed in
bug 787281 comment 11, which seem likely to have bad memory, disk, or
other hardware problem, based on the rate of failures on those machines
and the types of failures observed.

Therefore I'm marking this bug invalid, though it should be reopened if
it occurs on other (more reliable) hardware.
Resolution: INCOMPLETE → INVALID
Group: core-security
Keywords: sec-critical
(Assignee)

Updated

6 years ago
Keywords: intermittent-failure
(Assignee)

Updated

6 years ago
Whiteboard: [orange][badslave?] → [badslave?]
Keywords: testcase-wanted
You need to log in before you can comment on or make changes to this bug.