Closed Bug 929004 Opened 6 years ago Closed 6 years ago

crash in mozilla::system::SetStatusRunnable::Run()


(Firefox OS Graveyard :: GonkIntegration, defect, critical)

Not set


(blocking-b2g:koi+, firefox26 wontfix, firefox27 wontfix, firefox28 fixed, b2g-v1.2 fixed)

1.3 Sprint 4 - 11/8
blocking-b2g koi+
Tracking Status
firefox26 --- wontfix
firefox27 --- wontfix
firefox28 --- fixed
b2g-v1.2 --- fixed


(Reporter: nhirata, Assigned: dhylands)



(Keywords: crash, regression, topcrash-b2g, Whiteboard: [b2g-crash])

Crash Data


(1 file)

This bug was filed from the Socorro interface and is 
report bp-018b7ac8-d770-457d-ba73-09c042131021.
Crashing Thread
Frame 	Module 	Signature 	Source
0 	mozilla::system::SetStatusRunnable::Run() 	dom/system/gonk/AutoMounterSetting.cpp
1 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
2 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
3 	nsThread::Shutdown() 	xpcom/threads/nsThread.cpp
4 	mozilla::LazyIdleThread::ShutdownThread() 	xpcom/threads/LazyIdleThread.cpp
5 	mozilla::LazyIdleThread::Shutdown() 	xpcom/threads/LazyIdleThread.cpp
6 	mozilla::dom::quota::QuotaManager::Observe(nsISupports*, char const*, unsigned short const*) 	dom/quota/QuotaManager.cpp
7 	nsObserverList::NotifyObservers(nsISupports*, char const*, unsigned short const*) 	xpcom/ds/nsObserverList.cpp
8 	nsObserverService::NotifyObservers(nsISupports*, char const*, unsigned short const*) 	xpcom/ds/nsObserverService.cpp
9 	mozilla::dom::power::PowerManagerService::SyncProfile() 	dom/power/PowerManagerService.cpp
10 	mozilla::dom::power::PowerManagerService::PowerOff() 	dom/power/PowerManagerService.cpp
11 	mozilla::dom::PowerManager::PowerOff(mozilla::ErrorResult&) 	dom/power/PowerManager.cpp
12 	mozilla::dom::MozPowerManagerBinding::powerOff 	/builds/slave/b2g_m-aurora_hamachi_ntly-0000/build/objdir-gecko/dom/bindings/MozPowerManagerBinding.cpp
13 	mozilla::dom::MozPowerManagerBinding::genericMethod 	/builds/slave/b2g_m-aurora_hamachi_ntly-0000/build/objdir-gecko/dom/bindings/MozPowerManagerBinding.cpp
14 	js::Invoke 	js/src/jscntxtinlines.h
15 	Interpret 	js/src/vm/Interpreter.cpp
16 	js::Invoke 	js/src/vm/Interpreter.cpp
17 	JS_CallFunctionValue(JSContext*, JSObject*, JS::Value, unsigned int, JS::Value*, JS::Value*) 	js/src/jsapi.cpp
18 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJSClass.cpp
19 	nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJS.cpp
20 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp
22 	nsEventListenerManager::HandleEventSubType(nsListenerStruct*, mozilla::dom::CallbackObjectHolder<mozilla::dom::EventListener, nsIDOMEventListener> const&, nsIDOMEvent*, mozilla::dom::EventTarget*, nsCxPusher*) 	content/events/src/nsEventListenerManager.cpp
23 	nsEventListenerManager::HandleEventInternal(nsPresContext*, nsEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*, nsCxPusher*) 	content/events/src/nsEventListenerManager.cpp
24 	nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, ELMCreationDetector&, nsCxPusher*) 	content/events/src/nsEventListenerManager.h
25 	nsEventTargetChainItem::HandleEventTargetChain(nsTArray<nsEventTargetChainItem>&, nsEventChainPostVisitor&, nsDispatchingCallback*, ELMCreationDetector&, nsCxPusher*) 	content/events/src/nsEventDispatcher.cpp
26 	nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) 	content/events/src/nsEventDispatcher.cpp
27 	nsAnimationManager::DoDispatchEvents() 	layout/style/nsAnimationManager.cpp
28 	nsAnimationManager::FlushAnimations(mozilla::css::CommonAnimationManager::FlushFlags) 	layout/style/nsAnimationManager.h
29 	nsAnimationManager::WillRefresh(mozilla::TimeStamp) 	layout/style/nsAnimationManager.cpp
30 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
31 	mozilla::RefreshDriverTimer::TimerTick(nsITimer*, void*) 	layout/base/nsRefreshDriver.cpp
32 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
33 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp
34 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
35 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
36 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
37 	MessageLoop::RunInternal() 	ipc/chromium/src/base/
38 	MessageLoop::Run() 	ipc/chromium/src/base/
39 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
40 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
41 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
42 	XREMain::XRE_main(int, char**, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
43 	XRE_main 	toolkit/xre/nsAppRunner.cpp
44 	b2g 	main 	b2g/app/nsBrowserApp.cpp
45 	__libc_init 	bionic/libc/bionic/libc_init_dynamic.c
46 		@0xb00045a9

More Crashes :
See Bug 928976 as I am getting this stack with the Marketplace crash in that bug.
Having the same crash when restarting device, 100% reproducible 

Device: Buri 1.2 Aurora COM RIL
BuildID: 20131021004006
Gaia: 1fd315337d8ae891c3024e4c682c4c50797ea40e
Gecko: d585fe28cd55
Version: 26.0a2
Firmware Version:  US_20130930
We should confirm if this is a dupe of bug 928976 or not.
Whiteboard: [Dupe of bug 928976?]
This crash still occurs on the 10/25 build bug 928976 was fixed the day before according to jsmith in comment 10
Whiteboard: [Dupe of bug 928976?] → [b2g-crash]

This is using the settings lock without actually checking that it was created successfully. createLock is implemented in JS and it looks as if there are lots of ways that it could fail, so this should error-check at least.

Also note that in this crash report at least, there is a nested event loop via mozilla::LazyIdleThread::ShutdownThread() so it's possible that the nested loop is causing the settings service to fail in ways that it otherwise wouldn't.

Assigning to dhylands and marking as a regression from bug 927961 per hg blame.
Assignee: nobody → dhylands
Blocks: 927961
Sounds like this is a top crash b2g regression with a known bug that caused this that's a koi+. Noming to block.
blocking-b2g: --- → koi?
Keywords: regression
Is this reproducible on all devices? Just want to make sure its not a corner case.
Flags: needinfo?(jsmith)
(In reply to Preeti Raghunath(:Preeti) from comment #7)
> Is this reproducible on all devices? Just want to make sure its not a corner
> case.

Crash stats shows this present on the following devices:

* Buri
* Leo
* Unagi
* Peak
* Keon
Flags: needinfo?(jsmith)
blocking as it crashes all devices in 1.2.
blocking-b2g: koi? → koi+
Comment on attachment 828871 [details] [diff] [review]
Check that lock is non-null before using.

Review of attachment 828871 [details] [diff] [review]:

I haven't been able to reproduce this, but this fix should address the problem being reported.
Attachment #828871 - Flags: review?(kyle)
Attachment #828871 - Flags: review?(kyle) → review+
fixed on mozilla-central seems the commit message had the wrong bug number (949004) in it :)
Closed: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.