Closed Bug 807442 Opened 12 years ago Closed 11 years ago

browser_bug386835.js | Assertion failure: mDocument->IsXUL() || mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_INTERACTIVE || (mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_UNINITIALIZED...

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
17 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla22
Tracking Flags:
Tracking Status
firefox17 --- affected
firefox18 --- affected
firefox19 --- affected
firefox20 --- affected

People

(Reporter: kats, Assigned: RyanVM)

References

(
URL
)

Details

(4 keywords)

Crash Data

Attachments

(2 files)

GDB backtrace
22.36 KB, text/plain
Details
make the assert non-fatal
2.06 KB, patch
hsivonen
: review+
Details | Diff | Splinter Review
Attached file GDB backtrace — 
Got this assertion failure while I was clicking on the links at https://bugzilla.mozilla.org/show_bug.cgi?id=750198#c11 trying to reproduce that bug. The build is a local android build from a recent (today) m-c changeset, running on an HTC Desire HD.

Backtrace attached.
Rev3 WINNT 5.1 mozilla-aurora debug test mochitest-browser-chrome on 2012-11-30 16:41:49 PST for push 19c3aa22d0ea

slave: talos-r3-xp-065

Assertion failure: mDocument->IsXUL() || mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_INTERACTIVE || (mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_UNINITIALIZED && NS_IsAboutBlank(mDocument->GetDocumentURI())) (Bad readystate), at e:/builds/moz2_slave/m-aurora-w32-dbg/build/layout/base/nsDocumentViewer.cpp:1032
nsStringStats
 => mAllocCount:          81315
 => mReallocCount:         6525
 => mFreeCount:           67549  --  LEAKED 13766 !!!
 => mShareCount:         124861
 => mAdoptCount:           5939
 => mAdoptFreeCount:       5934  --  LEAKED 5 !!!
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/base/content/test/browser_bug386835.js | Exited with code -2147483645 during test run
INFO | automation.py | Application ran for: 0:00:31.359000
INFO | automation.py | Reading PID log: c:\docume~1\cltbld\locals~1\temp\tmpzmxjrspidlog
Downloading symbols from: http://ftp-scl3.mozilla.com/pub/mozilla.org/firefox/tinderbox-builds/mozilla-aurora-win32-debug/1354318545/firefox-19.0a2.en-US.win32.crashreporter-symbols.zip
PROCESS-CRASH | chrome://mochitests/content/browser/browser/base/content/test/browser_bug386835.js | application crashed (minidump found)
Crash dump filename: c:\docume~1\cltbld\locals~1\temp\tmpdz62gg\minidumps\6b732f50-4d7b-4046-ad76-6665acf80702.dmp
Operating system: Windows NT
                  5.1.2600 Service Pack 2
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_BREAKPOINT
Crash address: 0x1e4db70

Thread 0 (crashed)
 0  xul.dll!DocumentViewerImpl::LoadComplete(tag_nsresult) [nsDocumentViewer.cpp:19c3aa22d0ea : 1032 + 0x69]
    eip = 0x01e4db70   esp = 0x0012d2e0   ebp = 0x0012d338   ebx = 0x00000000
    esi = 0x068f2cd8   edi = 0x070dd28c   eax = 0x00000000   ecx = 0x0876b116
    edx = 0x10361f48   efl = 0x00000212
    Found by: given as instruction pointer in context
 1  xul.dll!nsDocShell::EndPageLoad(nsIWebProgress *,nsIChannel *,tag_nsresult) [nsDocShell.cpp:19c3aa22d0ea : 6510 + 0xd]
    eip = 0x02887552   esp = 0x0012d340   ebp = 0x0012d520
    Found by: call frame info
 2  xul.dll!nsDocShell::OnStateChange(nsIWebProgress *,nsIRequest *,unsigned int,tag_nsresult) [nsDocShell.cpp:19c3aa22d0ea : 6338 + 0x10]
    eip = 0x02890dcc   esp = 0x0012d528   ebp = 0x0012d5d8
    Found by: call frame info
 3  xul.dll!nsDocLoader::DoFireOnStateChange(nsIWebProgress * const,nsIRequest * const,int &,tag_nsresult) [nsDocLoader.cpp:19c3aa22d0ea : 1305 + 0x18]
    eip = 0x028a1cbf   esp = 0x0012d5e0   ebp = 0x0012d678
    Found by: call frame info
 4  xul.dll!nsDocLoader::doStopDocumentLoad(nsIRequest *,tag_nsresult) [nsDocLoader.cpp:19c3aa22d0ea : 885 + 0x2f]
    eip = 0x028a2abe   esp = 0x0012d680   ebp = 0x0012d728
    Found by: call frame info
 5  xul.dll!nsDocLoader::DocLoaderIsEmpty(bool) [nsDocLoader.cpp:19c3aa22d0ea : 775 + 0xc]
    eip = 0x028a3172   esp = 0x0012d730   ebp = 0x0012d75c
    Found by: call frame info
 6  xul.dll!nsDocLoader::OnStopRequest(nsIRequest *,nsISupports *,tag_nsresult) [nsDocLoader.cpp:19c3aa22d0ea : 659 + 0x9]
    eip = 0x028a3575   esp = 0x0012d764   ebp = 0x0012d7e8
    Found by: call frame info
 7  xul.dll!nsLoadGroup::RemoveRequest(nsIRequest *,nsISupports *,tag_nsresult) [nsLoadGroup.cpp:19c3aa22d0ea : 697 + 0x14]
    eip = 0x01bc9cc5   esp = 0x0012d7f0   ebp = 0x0012d880
    Found by: call frame info
 8  xul.dll!imgRequestProxy::RemoveFromLoadGroup(bool) [imgRequestProxy.cpp:19c3aa22d0ea : 253 + 0x10]
    eip = 0x01dcb6f8   esp = 0x0012d888   ebp = 0x0012d8a8
    Found by: call frame info
 9  xul.dll!imgRequestProxy::OnStopRequest(bool) [imgRequestProxy.cpp:19c3aa22d0ea : 774 + 0x9]
    eip = 0x01dcbdca   esp = 0x0012d8b0   ebp = 0x0012d93c
    Found by: call frame info
10  xul.dll!imgStatusTracker::OnStopRequest(bool,tag_nsresult) [imgStatusTracker.cpp:19c3aa22d0ea : 705 + 0x17]
    eip = 0x01dcf5d3   esp = 0x0012d944   ebp = 0x0012d95c
    Found by: call frame info
11  xul.dll!imgRequest::OnStopRequest(nsIRequest *,nsISupports *,tag_nsresult) [imgRequest.cpp:19c3aa22d0ea : 688 + 0x11]
    eip = 0x01dc7985   esp = 0x0012d964   ebp = 0x0012d98c
    Found by: call frame info
12  xul.dll!ProxyListener::OnStopRequest(nsIRequest *,nsISupports *,tag_nsresult) [imgLoader.cpp:19c3aa22d0ea : 2052 + 0x13]
    eip = 0x01dbcef9   esp = 0x0012d994   ebp = 0x0012d9a4
    Found by: call frame info
13  xul.dll!nsJARChannel::OnStopRequest(nsIRequest *,nsISupports *,tag_nsresult) [nsJARChannel.cpp:19c3aa22d0ea : 887 + 0x14]
    eip = 0x01d703ce   esp = 0x0012d9ac   ebp = 0x0012d9c8
    Found by: call frame info
14  xul.dll!nsInputStreamPump::OnStateStop() [nsInputStreamPump.cpp:19c3aa22d0ea : 552 + 0x17]
    eip = 0x01bc11e7   esp = 0x0012d9d0   ebp = 0x0012d9f0
    Found by: call frame info
15  xul.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *) [nsInputStreamPump.cpp:19c3aa22d0ea : 374 + 0x9]
    eip = 0x01bc12dd   esp = 0x0012d9f8   ebp = 0x0012da04
    Found by: call frame info
16  xul.dll!nsInputStreamReadyEvent::Run() [nsStreamUtils.cpp:19c3aa22d0ea : 82 + 0x10]
    eip = 0x02eb1588   esp = 0x0012da0c   ebp = 0x0012da1c
    Found by: call frame info
17  xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:19c3aa22d0ea : 627 + 0xd]
Keywords: assertion, intermittent-failure
OS: Android → All
Summary: Assertion failure: mDocument->IsXUL() || mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_INTERACTIVE || (mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_UNINITIALIZED && NS_IsAboutBlank(mDocument->GetDocumentURI())) (Bad readystate) → browser_bug386835.js | Assertion failure: mDocument->IsXUL() || mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_INTERACTIVE || (mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_UNINITIALIZED...
Crash Signature: [@ DocumentViewerImpl::LoadComplete(tag_nsresult)]
1. http://www.dtnprogressivefarmer.com/dtnag/weather + 238 other urls
2. Assertion failure: mDocument->IsXUL() || mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_INTERACTIVE || (mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_UNINITIALIZED && NS_IsAboutBlank(mDocument->GetDocumentURI())) (Bad readystate)

Reproduced on Beta/18, Aurora/19, Nightly/20. Marked the status for the major branches. This probably affects esr17 as well, but I haven't tested that.

This url is reproducible on Windows 7 32bit at least.

Found regression between 20120815004159-20120816020800
Pushlog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=104388bbcab2&tochange=2759cfa65dc5
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/08/2012-08-15-mozilla-inbound-debug/firefox-17.0a1.en-US.debug-win32.installer.exe
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/08/2012-08-16-mozilla-inbound-debug/firefox-17.0a1.en-US.debug-win32.installer.exe

This has been a pita for a while now in crash automation. Can we get some traction on this now that we can reproduce reliably?
URL: http://www.dtnprogressivefarmer.com/d...
status-firefox17: --- → affected
status-firefox18: --- → affected
status-firefox19: --- → affected
status-firefox20: --- → affected
Keywords: regression, reproducible
Version: 19 Branch → 17 Branch
Somebody seems to have broken it harder, maybe that'll give it more traction.
Henri, I see that you added this assertion back in bug 775467. Can you help find an owner for this bug? It has spiked significantly in the last two days.
Flags: needinfo?(hsivonen)
(In reply to Ryan VanderMeulen [:RyanVM] from comment #15)
> Henri, I see that you added this assertion back in bug 775467. Can you help
> find an owner for this bug? It has spiked significantly in the last two days.

Somehow, bug 829456 made this go through the roof (though there have still been a few other intermittent failures prior to that landing over the last couple days).
Looks like timing changes arising from multithreaded image decoding exposed a duplicate of 779959. Fixing is a big deal. Let's just make the assertion non-fatal for now. The bogosity exposed by the assertion is real, though.
Flags: needinfo?(hsivonen)
Thanks, Henri!
Depends on: 779959
Attached patch make the assert non-fatal — — Splinter Review 
Assignee: nobody → ryanvm
Status: NEW → ASSIGNED

        Attachment #730702 -
        Flags: review?(hsivonen)

    
    

    
  
Comment on attachment 730702 [details] [diff] [review]
make the assert non-fatal

Thanks!

        Attachment #730702 -
        Flags: review?(hsivonen) → review+

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/d250db95c14b
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla22

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

    
    

    
      
  

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: