Closed Bug 809635 Opened 12 years ago Closed 12 years ago

Intermittent test_bug382113.html | Exited with code 1 during test run, with crash in nsObjectLoadingContent::UnbindFromTree

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: dholbert, Unassigned)

References

(
URL
)

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test that aborts the suite])

Crash Data

https://tbpl.mozilla.org/php/getParsedLog.php?id=16836151&full=1&branch=mozilla-inbound Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test mochitest-1 on 2012-11-07 14:17:29 PST for push ed5120ffd118 builder: mozilla-inbound_snowleopard-debug_test-mochitest-1 slave: talos-r4-snow-014 { WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004003: file ../../../../intl/uconv/src/nsCharsetConverterManager.cpp, line 301 TEST-UNEXPECTED-FAIL | /tests/content/base/test/test_bug382113.html | Exited with code 1 during test run INFO | automation.py | Application ran for: 0:04:46.058852 INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpuucGptpidlog Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64-debug/1352324043/firefox-19.0a1.en-US.mac64.crashreporter-symbols.zip PROCESS-CRASH | /tests/content/base/test/test_bug382113.html | application crashed (minidump found) Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpBuT7jy/minidumps/13E9EA98-A35F-420E-BEDC-04738AD2B16E.dmp Operating system: Mac OS X 10.6.8 10K549 CPU: amd64 family 6 model 23 stepping 10 2 CPUs Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS Crash address: 0xffffffffffffffd4 Thread 0 (crashed) 0 XUL!nsObjectLoadingContent::UnbindFromTree(bool, bool) [nsCOMPtr.h : 490 + 0x0] rbx = 0x000000013e43f930 r12 = 0x0000000103bcc3e6 r13 = 0x0000000118408820 r14 = 0x000000013e43f9c0 r15 = 0x000000013e43fa20 rip = 0x0000000101eefc8c rsp = 0x00007fff5fbf4b10 rbp = 0x0000000000000004 Found by: given as instruction pointer in context 1 XUL!nsHTMLObjectElement::UnbindFromTree(bool, bool) [nsHTMLObjectElement.cpp : 256 + 0x17] rip = 0x00000001020c3795 rsp = 0x00007fff5fbf4b60 Found by: stack scanning 2 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x21071 rip = 0x0000000103bcc161 rsp = 0x00007fff5fbf4b80 Found by: stack scanning 3 XUL!nsGenericElement::UnbindFromTree(bool, bool) [nsGenericElement.cpp : 1567 + 0xf] rip = 0x0000000101ecd09a rsp = 0x00007fff5fbf4b90 Found by: stack scanning 4 XUL!nsStandardURL::Release() [nsStandardURL.cpp : 920 + 0xb] rip = 0x000000010186c13c rsp = 0x00007fff5fbf4ba0 Found by: stack scanning 5 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x212f6 rip = 0x0000000103bcc3e6 rsp = 0x00007fff5fbf4bc8 Found by: stack scanning 6 XUL!nsGenericHTMLElement::UnbindFromTree(bool, bool) [nsGenericHTMLElement.cpp : 1779 + 0xe] rip = 0x000000010202958d rsp = 0x00007fff5fbf4bf0 Found by: stack scanning 7 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x212f6 rip = 0x0000000103bcc3e6 rsp = 0x00007fff5fbf4c08 Found by: stack scanning 8 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x21071 rip = 0x0000000103bcc161 rsp = 0x00007fff5fbf4c20 Found by: stack scanning 9 XUL!nsGenericElement::UnbindFromTree(bool, bool) [nsGenericElement.cpp : 1567 + 0xf] rip = 0x0000000101ecd09a rsp = 0x00007fff5fbf4c30 Found by: stack scanning 10 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x212f6 rip = 0x0000000103bcc3e6 rsp = 0x00007fff5fbf4c58 Found by: stack scanning 11 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x212f6 rip = 0x0000000103bcc3e6 rsp = 0x00007fff5fbf4c68 Found by: stack scanning 12 XUL!nsGenericHTMLElement::UnbindFromTree(bool, bool) [nsGenericHTMLElement.cpp : 1779 + 0xe] rip = 0x000000010202958d rsp = 0x00007fff5fbf4c90 Found by: stack scanning 13 XUL!nsHTMLBodyElement::UnbindFromTree(bool, bool) [nsHTMLBodyElement.cpp : 342 + 0xc] rip = 0x000000010204e8b3 rsp = 0x00007fff5fbf4ca0 Found by: stack scanning 14 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x21071 rip = 0x0000000103bcc161 rsp = 0x00007fff5fbf4cc0 Found by: stack scanning 15 XUL!nsGenericElement::UnbindFromTree(bool, bool) [nsGenericElement.cpp : 1567 + 0xf] rip = 0x0000000101ecd09a rsp = 0x00007fff5fbf4cd0 Found by: stack scanning 16 XUL!nsDocument::QueryInterface(nsID const&, void**) [nsDocument.cpp : 1477 + 0x14] rip = 0x0000000101e8043d rsp = 0x00007fff5fbf4cf0 Found by: stack scanning 17 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x21071 rip = 0x0000000103bcc161 rsp = 0x00007fff5fbf4d10 Found by: stack scanning 18 XUL!nsGenericHTMLElement::UnbindFromTree(bool, bool) [nsGenericHTMLElement.cpp : 1779 + 0xe] rip = 0x000000010202958d rsp = 0x00007fff5fbf4d30 Found by: stack scanning 19 XUL!nsHTMLSharedElement::UnbindFromTree(bool, bool) [nsHTMLSharedElement.cpp : 433 + 0xf] rip = 0x00000001020f54d4 rsp = 0x00007fff5fbf4d70 Found by: stack scanning 20 XUL!_ZN7mozilla3cssL11kCharsetSymE + 0x212f6 rip = 0x0000000103bcc3e6 rsp = 0x00007fff5fbf4d80 Found by: stack scanning 21 XUL!nsDocument::cycleCollection::UnlinkImpl(void*) [nsDocument.cpp : 1713 + 0x12] rip = 0x0000000101e7fe88 rsp = 0x00007fff5fbf4da0 Found by: stack scanning 22 XUL!_ZZL13nsEscapeCountPKc12nsEscapeMaskPmE8hexChars + 0x5149 rip = 0x0000000103cf358a rsp = 0x00007fff5fbf4db8 Found by: stack scanning 23 XUL!_ZZL13nsEscapeCountPKc12nsEscapeMaskPmE8hexChars + 0x5149 rip = 0x0000000103cf358a rsp = 0x00007fff5fbf4dd8 Found by: stack scanning 24 XUL!nsHTMLDocument::cycleCollection::UnlinkImpl(void*) [nsHTMLDocument.cpp : 224 + 0x2c] rip = 0x000000010214ead3 rsp = 0x00007fff5fbf4df0 Found by: stack scanning 25 XUL!_ZZL13nsEscapeCountPKc12nsEscapeMaskPmE8hexChars + 0x5149 rip = 0x0000000103cf358a rsp = 0x00007fff5fbf4e08 Found by: stack scanning 26 XUL!nsCycleCollector::CollectWhite(nsICycleCollectorListener*) [nsCycleCollector.cpp : 2384 + 0xb] rip = 0x000000010304e5d0 rsp = 0x00007fff5fbf4e20 Found by: stack scanning 27 XUL!nsCycleCollector::FinishCollection(nsICycleCollectorListener*) [nsCycleCollector.cpp : 2907 + 0x4] rip = 0x000000010304ed92 rsp = 0x00007fff5fbf4e80 Found by: stack scanning 28 XUL!nsCycleCollectorRunner::Collect(bool, nsCycleCollectorResults*, nsICycleCollectorListener*) [nsCycleCollector.cpp : 3271 + 0xb] rip = 0x000000010305009a rsp = 0x00007fff5fbf4eb0 Found by: stack scanning 29 XUL!_ZZN7mozilla5imageL14get_header_strEPcS1_mE3hex + 0x2035f rip = 0x0000000103b96950 rsp = 0x00007fff5fbf4ef8 Found by: stack scanning 30 XUL!SearchTable [pldhash.cpp : 435 + 0xc] rip = 0x0000000102fdd465 rsp = 0x00007fff5fbf4f10 Found by: stack scanning 31 libplds4.dylib!PL_CompareStrings [plhash.c : 476 + 0x4] rip = 0x00000001000cf2f9 rsp = 0x00007fff5fbf4f20 Found by: stack scanning 32 libplds4.dylib!PL_HashTableLookup [plhash.c : 146 + 0xa] rip = 0x00000001000cf0c1 rsp = 0x00007fff5fbf4f30 Found by: stack scanning 33 libplds4.dylib!PL_CompareStrings [plhash.c : 476 + 0x4] rip = 0x00000001000cf2f9 rsp = 0x00007fff5fbf4f60 Found by: stack scanning 34 libplds4.dylib!PL_HashTableLookup [plhash.c : 146 + 0xa] rip = 0x00000001000cf0c1 rsp = 0x00007fff5fbf4f70 Found by: stack scanning 35 XUL!_ZZN7mozilla5imageL14get_header_strEPcS1_mE3hex + 0x2035f rip = 0x0000000103b96950 rsp = 0x00007fff5fbf4fa8 Found by: stack scanning 36 XUL!GetBloatEntry [nsTraceRefcntImpl.cpp : 429 + 0xa] rip = 0x000000010304a3b2 rsp = 0x00007fff5fbf4fc0 Found by: stack scanning 37 libSystem.B.dylib + 0x3ac4c rip = 0x00007fff82411c4d rsp = 0x00007fff5fbf4fd0 Found by: stack scanning 38 libSystem.B.dylib + 0x6699 rip = 0x00007fff823dd69a rsp = 0x00007fff5fbf4fe0 Found by: stack scanning 39 XUL!gfxTextRun::GetAdvanceWidth(unsigned int, unsigned int, gfxTextRun::PropertyProvider*) [gfxFont.cpp : 5262 + 0x10] rip = 0x00000001030b7357 rsp = 0x00007fff5fbf5030 Found by: stack scanning 40 XUL!_ZZN7mozilla5imageL14get_header_strEPcS1_mE3hex + 0x2035f rip = 0x0000000103b96950 rsp = 0x00007fff5fbf5058 Found by: stack scanning 41 libplds4.dylib!PL_CompareStrings [plhash.c : 476 + 0x4] rip = 0x00000001000cf2f9 rsp = 0x00007fff5fbf5060 Found by: stack scanning 42 libplds4.dylib!PL_HashTableLookup [plhash.c : 146 + 0xa] rip = 0x00000001000cf0c1 rsp = 0x00007fff5fbf5070 Found by: stack scanning 43 libplds4.dylib!PL_CompareStrings [plhash.c : 476 + 0x4] rip = 0x00000001000cf2f9 rsp = 0x00007fff5fbf50a0 Found by: stack scanning 44 libplds4.dylib!PL_CompareStrings [plhash.c : 476 + 0x4] rip = 0x00000001000cf2f9 rsp = 0x00007fff5fbf50c0 Found by: stack scanning 45 libplds4.dylib!PL_HashTableLookup [plhash.c : 146 + 0xa] rip = 0x00000001000cf0c1 rsp = 0x00007fff5fbf50d0 Found by: stack scanning 46 libplds4.dylib!PL_CompareStrings [plhash.c : 476 + 0x4] rip = 0x00000001000cf2f9 rsp = 0x00007fff5fbf5100 Found by: stack scanning 47 XUL!JS::LeaveAssertNoGCScope() [ThreadLocal.h : 123 + 0xb] rip = 0x0000000103687a73 rsp = 0x00007fff5fbf5110 Found by: stack scanning 48 XUL!js::StackFrame::script() const [Root.h : 339 + 0x4] rip = 0x00000001036b2ff7 rsp = 0x00007fff5fbf5130 Found by: stack scanning 49 XUL!js::mjit::CanMethodJIT(JSContext*, JSScript*, unsigned char*, bool, js::mjit::CompileRequest, js::StackFrame*) [Compiler.cpp : 1012 + 0xb] rip = 0x000000010393ba0c rsp = 0x00007fff5fbf5150 Found by: stack scanning 50 XUL!GetBloatEntry [nsTraceRefcntImpl.cpp : 429 + 0xa] rip = 0x000000010304a3b2 rsp = 0x00007fff5fbf5160 Found by: stack scanning 51 XUL!gfxFont::Measure(gfxTextRun*, unsigned int, unsigned int, gfxFont::BoundingBoxType, gfxContext*, gfxFont::Spacing*) [gfxFont.cpp : 2186 + 0x8] rip = 0x00000001030af61c rsp = 0x00007fff5fbf51a0 Found by: stack scanning 52 libplds4.dylib!PL_CompareStrings [plhash.c : 476 + 0x4] rip = 0x00000001000cf2f9 rsp = 0x00007fff5fbf5250 Found by: stack scanning 53 libplds4.dylib!PL_HashTableLookup [plhash.c : 146 + 0xa] rip = 0x00000001000cf0c1 rsp = 0x00007fff5fbf5260 Found by: stack scanning 54 XUL!nsPlainTextSerializer::DoOpenContainer(nsIAtom*)::bulletCharArray + 0x21b62 rip = 0x0000000103bfe1f0 rsp = 0x00007fff5fbf5298 Found by: stack scanning 55 XUL!GetBloatEntry [nsTraceRefcntImpl.cpp : 429 + 0xa] rip = 0x000000010304a3b2 rsp = 0x00007fff5fbf52b0 Found by: stack scanning 56 libSystem.B.dylib + 0x3ac4c rip = 0x00007fff82411c4d rsp = 0x00007fff5fbf52c0 Found by: stack scanning 57 libSystem.B.dylib + 0x6699 rip = 0x00007fff823dd69a rsp = 0x00007fff5fbf52d0 Found by: stack scanning 58 libnspr4.dylib!PR_Unlock [ptsynch.c : 205 + 0x7] rip = 0x0000000100319644 rsp = 0x00007fff5fbf52f0 Found by: stack scanning 59 XUL + 0x18dc95f rip = 0x00000001030dc960 rsp = 0x00007fff5fbf5300 Found by: stack scanning 60 XUL!gfxTextRun::AccumulateMetricsForRun(gfxFont*, unsigned int, unsigned int, gfxFont::BoundingBoxType, gfxContext*, gfxTextRun::PropertyProvider*, unsigned int, unsigned int, gfxFont::RunMetrics*) [nsTArray-inl.h : 22 + 0x10] rip = 0x00000001030b668f rsp = 0x00007fff5fbf5320 Found by: stack scanning } Note: This happened after a bunch of --DOMWINDOW / --DOCSHELL lines of output, for other test files. So it might be one of those tests (not necessarily test_bug382113.html) that's tickling the crashing code.
Severity: normal → critical
Crash Signature: [@ nsObjectLoadingContent::UnbindFromTree(bool, bool)]
Keywords: crash
Summary: TEST-UNEXPECTED-FAIL | /tests/content/base/test/test_bug382113.html | Exited with code 1 during test run, with crash in nsObjectLoadingContent::UnbindFromTree → Intermittent test_bug382113.html | Exited with code 1 during test run, with crash in nsObjectLoadingContent::UnbindFromTree
This stack trace makes no sense. That seems like a bug in our stack walking tool(s).
Yeah, there's something wrong happening here: (In reply to Daniel Holbert [:dholbert] from comment #0) > 1 XUL!nsHTMLObjectElement::UnbindFromTree(bool, bool) > [nsHTMLObjectElement.cpp : 256 + 0x17] > rip = 0x00000001020c3795 rsp = 0x00007fff5fbf4b60 > Found by: stack scanning This shouldn't have to scan the stack, it should have unwind info in the symbols.
Whiteboard: [orange][test that aborts the suite] → [test that aborts the suite]
Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of: {random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open} There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.