Intermittent mochitest-a11y Exited with code -2147483645 during test run | application crashed [@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext *,JSObject *,nsID const &)] after "Assertion failure: JS_IsExceptionPending(cx)"

RESOLVED FIXED in Firefox 26

Status

()

Core
XPConnect
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: RyanVM, Assigned: Bobby Holley (parental leave - send mail for anything urgent))

Tracking

({assertion, crash, intermittent-failure})

Trunk
mozilla27
assertion, crash, intermittent-failure
Points:
---

Firefox Tracking Flags

(firefox25 unaffected, firefox26 fixed, firefox27 fixed, firefox-esr24 unaffected)

Details

Attachments

(1 attachment)

https://tbpl.mozilla.org/php/getParsedLog.php?id=27652409&tree=Fx-Team

Windows XP 32-bit fx-team debug test mochitest-other on 2013-09-10 10:33:30 PDT for push 2ea8259f7e39
slave: t-xp32-ix-074

10:55:01     INFO -  1650 INFO TEST-START | chrome://mochitests/content/a11y/accessible/tests/mochitest/bounds/test_zoom_text.html
10:55:01     INFO -  ++DOMWINDOW == 88 (13ACB9C8) [serial = 91] [outer = 0C47C3A0]
10:55:01     INFO -  ++DOCSHELL 13D74AF0 == 16 [id = 16]
10:55:01     INFO -  ++DOMWINDOW == 89 (138E79F8) [serial = 92] [outer = 00000000]
10:55:01     INFO -  ++DOMWINDOW == 90 (138F9758) [serial = 93] [outer = 138E79F8]
10:55:01     INFO -  WARNING: NS_ENSURE_TRUE(lastNodeWithCaret) failed: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/accessible/src/base/SelectionManager.cpp, line 232
10:55:01     INFO -  ++DOCSHELL 13E184B8 == 17 [id = 17]
10:55:01     INFO -  ++DOMWINDOW == 91 (13E18D30) [serial = 94] [outer = 00000000]
10:55:01     INFO -  ++DOCSHELL 13E1AF28 == 18 [id = 18]
10:55:01     INFO -  ++DOMWINDOW == 92 (13E1B860) [serial = 95] [outer = 00000000]
10:55:01     INFO -  ++DOCSHELL 13ED6D80 == 19 [id = 19]
10:55:01     INFO -  ++DOMWINDOW == 93 (13ED7760) [serial = 96] [outer = 00000000]
10:55:01     INFO -  ++DOMWINDOW == 94 (13E763E8) [serial = 97] [outer = 13ED7760]
10:55:01     INFO -  WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv) && subjPrincipal) failed: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/docshell/base/nsDocShell.cpp, line 8444
10:55:01     INFO -  WARNING: Subdocument container has no frame: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/layout/base/nsDocumentViewer.cpp, line 2339
10:55:01     INFO -  ++DOMWINDOW == 95 (13F3B6E0) [serial = 98] [outer = 13E18D30]
10:55:01     INFO -  WARNING: Subdocument container has no frame: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/layout/base/nsDocumentViewer.cpp, line 2339
10:55:01     INFO -  ++DOMWINDOW == 96 (13F659F0) [serial = 99] [outer = 13E1B860]
10:55:01     INFO -  WARNING: NS_ENSURE_TRUE(hWnd) failed: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/accessible/src/windows/msaa/AccessibleWrap.cpp, line 1646
10:55:01     INFO -  WARNING: Unable to retrieve the tooltip node document.: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/layout/xul/base/src/nsXULTooltipListener.cpp, line 563
10:55:01     INFO -  WARNING: Subdocument container has no frame: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/layout/base/nsDocumentViewer.cpp, line 2339
10:55:01     INFO -  WARNING: Subdocument container has no frame: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/layout/base/nsDocumentViewer.cpp, line 2339
10:55:01     INFO -  ++DOMWINDOW == 97 (13F32DC8) [serial = 100] [outer = 13E1B860]
10:55:01     INFO -  ++DOMWINDOW == 98 (13F80368) [serial = 101] [outer = 13ED7760]
10:55:01     INFO -  WARNING: NS_ENSURE_TRUE(mMutable) failed: file e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/netwerk/base/src/nsSimpleURI.cpp, line 266
10:55:02     INFO -  Assertion failure: JS_IsExceptionPending(cx) (JS failed without setting an exception!), at e:/builds/moz2_slave/fx-team-w32-d-0000000000000000/build/js/xpconnect/src/XPCWrappedJSClass.cpp:258
10:55:02     INFO -  nsStringStats
10:55:02     INFO -   => mAllocCount:          96935
10:55:02     INFO -   => mReallocCount:         8824
10:55:02     INFO -   => mFreeCount:           63687  --  LEAKED 33248 !!!
10:55:02     INFO -   => mShareCount:         159650
10:55:02     INFO -   => mAdoptCount:           7634
10:55:02     INFO -   => mAdoptFreeCount:       7631  --  LEAKED 3 !!!
10:55:02  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/a11y/accessible/tests/mochitest/bounds/test_zoom_text.html | Exited with code -2147483645 during test run
10:55:02     INFO -  INFO | automation.py | Application ran for: 0:00:24.935000
10:55:02     INFO -  INFO | zombiecheck | Reading PID log: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmptuvvtbpidlog
10:55:09  WARNING -  PROCESS-CRASH | chrome://mochitests/content/a11y/accessible/tests/mochitest/bounds/test_zoom_text.html | application crashed [@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext *,JSObject *,nsID const &)]
10:55:09     INFO -  Crash dump filename: c:\docume~1\cltbld~1.t-x\locals~1\temp\tmppmmvgq\minidumps\fab6d0dd-82cf-44f8-95e4-adaedac9ed2a.dmp
10:55:09     INFO -  Operating system: Windows NT
10:55:09     INFO -                    5.1.2600 Service Pack 3
10:55:09     INFO -  CPU: x86
10:55:09     INFO -       GenuineIntel family 6 model 30 stepping 5
10:55:09     INFO -       8 CPUs
10:55:09     INFO -  Crash reason:  EXCEPTION_BREAKPOINT
10:55:09     INFO -  Crash address: 0x2dbeedc
10:55:09     INFO -  Thread 0 (crashed)
10:55:09     INFO -   0  xul.dll!nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext *,JSObject *,nsID const &) [XPCWrappedJSClass.cpp:2ea8259f7e39 : 258 + 0x23]
10:55:09     INFO -      eip = 0x02dbeedc   esp = 0x0012eafc   ebp = 0x0012ebdc   ebx = 0x00000000
10:55:09     INFO -      esi = 0x138e7e38   edi = 0x00d78560   eax = 0x00000000   ecx = 0xfffd4f9f
10:55:09     INFO -      edx = 0x10361f48   efl = 0x00000206
10:55:09     INFO -      Found by: given as instruction pointer in context
10:55:09     INFO -   1  xul.dll!nsXPCWrappedJSClass::DelegatedQueryInterface(nsXPCWrappedJS *,nsID const &,void * *) [XPCWrappedJSClass.cpp:2ea8259f7e39 : 714 + 0x58]
10:55:09     INFO -      eip = 0x02dbf85f   esp = 0x0012ebe4   ebp = 0x0012ed48
10:55:09     INFO -      Found by: call frame info
10:55:09     INFO -   2  xul.dll!nsXPCWrappedJS::AggregatedQueryInterface(nsID const &,void * *) [XPCWrappedJS.cpp:2ea8259f7e39 : 92 + 0x12]
10:55:09     INFO -      eip = 0x02dbb820   esp = 0x0012ed50   ebp = 0x0012ed64
10:55:09     INFO -      Found by: call frame info
10:55:09     INFO -   3  xul.dll!nsBindingManager::GetBindingImplementation(nsIContent *,nsID const &,void * *) [nsBindingManager.cpp:2ea8259f7e39 : 709 + 0x1c]
10:55:09     INFO -      eip = 0x029bde47   esp = 0x0012ed6c   ebp = 0x0012ede8
10:55:09     INFO -      Found by: call frame info
10:55:09     INFO -   4  xul.dll!mozilla::dom::Element::QueryInterface(nsID const &,void * *) [Element.cpp:2ea8259f7e39 : 146 + 0x1c]
10:55:09     INFO -      eip = 0x0271aa22   esp = 0x0012edf0   ebp = 0x0012ee00
10:55:09     INFO -      Found by: call frame info
10:55:09     INFO -   5  xul.dll!nsXULElement::QueryInterface(nsID const &,void * *) [nsXULElement.cpp:2ea8259f7e39 : 350 + 0xe]
10:55:09     INFO -      eip = 0x02cb264d   esp = 0x0012ee08   ebp = 0x0012ee20
10:55:09     INFO -      Found by: call frame info
10:55:09     INFO -   6  xul.dll!nsQueryInterface::operator()(nsID const &,void * *) [nsCOMPtr.cpp:2ea8259f7e39 : 14 + 0x8]
10:55:09     INFO -      eip = 0x0361a59c   esp = 0x0012ee28   ebp = 0x0012ee34
10:55:09     INFO -      Found by: call frame info
10:55:09     INFO -   7  xul.dll!nsCOMPtr<nsIDOMXULSelectControlElement>::assign_from_qi(nsQueryInterface,nsID const &) [nsCOMPtr.h:2ea8259f7e39 : 1199 + 0x11]
10:55:09     INFO -      eip = 0x02294b9c   esp = 0x0012ee3c   ebp = 0x0012ee44
10:55:09     INFO -      Found by: call frame info
10:55:09     INFO -   8  xul.dll!mozilla::a11y::XULSelectControlAccessible::XULSelectControlAccessible(nsIContent *,mozilla::a11y::DocAccessible *) [XULSelectControlAccessible.cpp:2ea8259f7e39 : 35 + 0x5e]
10:55:09     INFO -      eip = 0x022cbea3   esp = 0x0012ee4c   ebp = 0x0012ee58
10:55:09     INFO -      Found by: call frame info
https://tbpl.mozilla.org/php/getParsedLog.php?id=27664888&tree=Mozilla-Central
Comment hidden (Treeherder Robot)
https://tbpl.mozilla.org/php/getParsedLog.php?id=27722473&tree=B2g-Inbound
OS: Windows XP → All
Hardware: x86 → All
Comment hidden (Treeherder Robot)
Comment hidden (Treeherder Robot)
https://tbpl.mozilla.org/php/getParsedLog.php?id=27785121&tree=Fx-Team
Summary: Intermittent test_zoom_text.html | Exited with code -2147483645 during test run | application crashed [@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext *,JSObject *,nsID const &)] after "Assertion failure: JS_IsExceptionPending(cx)" → Intermittent mochitest-a11y Exited with code -2147483645 during test run | application crashed [@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext *,JSObject *,nsID const &)] after "Assertion failure: JS_IsExceptionPending(cx)"
https://tbpl.mozilla.org/php/getParsedLog.php?id=27787549&tree=Mozilla-Inbound
Duplicate of this bug: 916062
Comment hidden (Treeherder Robot)
https://tbpl.mozilla.org/php/getParsedLog.php?id=27859486&tree=Mozilla-Central
https://tbpl.mozilla.org/php/getParsedLog.php?id=27874266&tree=Fx-Team
https://tbpl.mozilla.org/php/getParsedLog.php?id=27882275&tree=Mozilla-Inbound

Trev or Alexander, any idea what might be going on here? This appears to only affect mochitest-a11y.
Flags: needinfo?(trev.saunders)
Flags: needinfo?(surkov.alexander)

Comment 13

4 years ago
It doesn't seem like a11y problem since it crashes when we try to query DOM element so we need someobody from content/js to look at it. Looks like a11y just reveals a content problem.
Flags: needinfo?(surkov.alexander)

Comment 14

4 years ago
cc'ing Olli for ideas
This is really more bholley's area.
The assertion isn't technically valid, because JS _can_ fail without setting an exception. In general, it means we either OOMed or were killed by the slow script dialog.

We should probably remove the assert, but if the QI hook is OOMing the test will probably just start failing in some other way. Alexander, is the a scripted QI implementation here that might be allocating tons of memory?
> We should probably remove the assert, but if the QI hook is OOMing the test
> will probably just start failing in some other way. Alexander, is the a
> scripted QI implementation here that might be allocating tons of memory?

I don't think there is one here
Flags: needinfo?(trev.saunders)
Comment hidden (Treeherder Robot)
Created attachment 806052 [details] [diff] [review]
Don't assert against OOM in XPCWrappedJS QI hooks. v1
Attachment #806052 - Flags: review?(gkrizsanits)
Comment on attachment 806052 [details] [diff] [review]
Don't assert against OOM in XPCWrappedJS QI hooks. v1

Review of attachment 806052 [details] [diff] [review]:
-----------------------------------------------------------------

The JS function could have thrown undefined or null, which would also get us here, so I agree with the removal of the assertion.

My problem is that if the JS function throws something then we report it, but if it throws accidentally undefined, we swallow the OOM and just do a warning instead. I find this a bit inconsistent, is there a way to report OOM instead?
Attachment #806052 - Flags: review?(gkrizsanits) → review-
https://tbpl.mozilla.org/php/getParsedLog.php?id=27991177&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=27973329&tree=Mozilla-Central
Comment on attachment 806052 [details] [diff] [review]
Don't assert against OOM in XPCWrappedJS QI hooks. v1

(In reply to Gabor Krizsanits [:krizsa :gabor] from comment #20)
> The JS function could have thrown undefined or null, which would also get us
> here, so I agree with the removal of the assertion.

Huh? |throw undefined| will cause JS_IsPendingException to be true. The JS engine tracks |throwing| and |exception| as separate pieces of state.

> My problem is that if the JS function throws something then we report it,
> but if it throws accidentally undefined, we swallow the OOM and just do a
> warning instead.

As noted above, this isn't the case.

> I find this a bit inconsistent, is there a way to report
> OOM instead?

The JS engine signals OOM by returning false without setting |throwing| to true. It doesn't get 'reported' per se.
Attachment #806052 - Flags: review- → review+
Comment on attachment 806052 [details] [diff] [review]
Don't assert against OOM in XPCWrappedJS QI hooks. v1

err, I meant to reflag for review.
Attachment #806052 - Flags: review+ → review?(gkrizsanits)
https://tbpl.mozilla.org/php/getParsedLog.php?id=27999679&tree=Mozilla-Inbound
Comment on attachment 806052 [details] [diff] [review]
Don't assert against OOM in XPCWrappedJS QI hooks. v1

Review of attachment 806052 [details] [diff] [review]:
-----------------------------------------------------------------

Ehh, sorry. I cannot imagine how can this test fail then. OOM is not very likely, cleared or not propagated exception from another context maybe?
Attachment #806052 - Flags: review?(gkrizsanits) → review+
(In reply to Gabor Krizsanits [:krizsa :gabor] from comment #26)
> Comment on attachment 806052 [details] [diff] [review]
> Don't assert against OOM in XPCWrappedJS QI hooks. v1
> 
> Review of attachment 806052 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> Ehh, sorry. I cannot imagine how can this test fail then. OOM is not very
> likely, cleared or not propagated exception from another context maybe?

Yeah, probably something like that. This looks hard to track down though, so it's easier to just fix our incorrect API usage here and propagate the error here. Hopefully the test handles that and doesn't just end up going orange somewhere else. :-)

https://hg.mozilla.org/integration/mozilla-inbound/rev/3e12fb5e831b
Thanks!

(Drive-by nit: "QI hook ran OOMed" took me a bit to parse. I guess you don't need 'ed'.)
https://hg.mozilla.org/mozilla-central/rev/3e12fb5e831b
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
Bobby, can you please request Aurora approval for this when you get a chance? Thanks :)
Assignee: nobody → bobbyholley+bmo
status-firefox25: --- → unaffected
status-firefox26: --- → affected
status-firefox27: --- → fixed
status-firefox-esr24: --- → unaffected
Comment on attachment 806052 [details] [diff] [review]
Don't assert against OOM in XPCWrappedJS QI hooks. v1

[Approval Request Comment]
Bug caused by (feature/regressing bug #): unknown
User impact if declined: more intermittent oranges for sheriffs to star. Possible null deref crashes in the wild.
Testing completed (on m-c, etc.): just landed on m-c.
Risk to taking this patch (and alternatives if risky): Extremely low risk.
String or IDL/UUID changes made by this patch: None
Attachment #806052 - Flags: approval-mozilla-aurora?
Attachment #806052 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/f9163b5efff8
status-firefox26: affected → fixed
You need to log in before you can comment on or make changes to this bug.