Closed Bug 960761 Opened 10 years ago Closed 10 years ago

Intermittent browser_profiler_console_api.js | application crashed [@ mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::ContainerLayerParamet

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE
Tracking Flags:
Tracking Status
firefox29 --- affected
firefox30 --- affected

People

(Reporter: RyanVM, Unassigned)

References

Details

(Keywords: crash, intermittent-failure, sec-critical, Whiteboard: [close if no STR/recurrence by March?]) 

https://tbpl.mozilla.org/php/getParsedLog.php?id=33042831&tree=Fx-Team

Ubuntu VM 12.04 fx-team opt test mochitest-browser-chrome on 2014-01-15 09:07:15 PST for push 59251ffa1853
slave: tst-linux32-spot-343

09:42:18     INFO -  TEST-START | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js
09:42:18     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | Console message: [JavaScript Error: "A promise chain failed to handle a rejection.
09:42:18     INFO -  Date: Wed Jan 15 2014 09:42:17 GMT-0800 (PST)
09:42:18     INFO -  Full Message: TypeError: this.panel is null
09:42:18     INFO -  Full Stack: Cleopatra.prototype.parse/</poll@resource://gre/modules/commonjs/toolkit/loader.js -> resource:///modules/devtools/profiler/cleopatra.js:113
09:42:18     INFO -  Cleopatra.prototype.parse/<@resource://gre/modules/commonjs/toolkit/loader.js -> resource:///modules/devtools/profiler/cleopatra.js:127
09:42:18     INFO -  Handler.prototype.process@resource://gre/modules/Promise.jsm:767
09:42:18     INFO -  this.PromiseWalker.walkerLoop@resource://gre/modules/Promise.jsm:531
09:42:18     INFO -  " {file: "resource://gre/modules/commonjs/toolkit/loader.js -> resource:///modules/devtools/profiler/cleopatra.js" line: 113 column: 0 source: "113"}]
09:42:19     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | Console message: [JavaScript Warning: "XUL box for span element contained an inline #text child, forcing all its children to be wrapped in a block." {file: "resource://app/modules/devtools/SideMenuWidget.jsm" line: 583}]
09:42:19     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | Console message: [JavaScript Warning: "XUL box for span element contained an inline #text child, forcing all its children to be wrapped in a block." {file: "resource:///modules/devtools/ViewHelpers.jsm" line: 993}]
09:42:21  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | application terminated with exit code 4
09:42:21     INFO -  INFO | runtests.py | Application ran for: 0:30:32.919732
09:42:21     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpcrQJPWpidlog
09:42:21     INFO -  ==> process 2271 launched child process 2317
09:42:21     INFO -  ==> process 2271 launched child process 2324
09:42:21     INFO -  ==> process 2271 launched child process 2329
09:42:21     INFO -  ==> process 2271 launched child process 2377
09:42:21     INFO -  ==> process 2271 launched child process 2381
09:42:21     INFO -  ==> process 2271 launched child process 2385
09:42:21     INFO -  ==> process 2271 launched child process 2401
09:42:21     INFO -  ==> process 2271 launched child process 2423
09:42:21     INFO -  ==> process 2271 launched child process 2438
09:42:21     INFO -  ==> process 2271 launched child process 2453
09:42:21     INFO -  ==> process 2271 launched child process 2463
09:42:21     INFO -  ==> process 2271 launched child process 2478
09:42:21     INFO -  ==> process 2271 launched child process 2493
09:42:21     INFO -  ==> process 2271 launched child process 2513
09:42:21     INFO -  ==> process 2271 launched child process 2528
09:42:21     INFO -  ==> process 2271 launched child process 2543
09:42:21     INFO -  ==> process 2271 launched child process 2558
09:42:21     INFO -  ==> process 2271 launched child process 2574
09:42:21     INFO -  ==> process 2271 launched child process 2589
09:42:21     INFO -  ==> process 2271 launched child process 2607
09:42:21     INFO -  ==> process 2271 launched child process 2622
09:42:21     INFO -  ==> process 2271 launched child process 2637
09:42:21     INFO -  ==> process 2271 launched child process 2652
09:42:21     INFO -  ==> process 2271 launched child process 2667
09:42:21     INFO -  ==> process 2271 launched child process 2682
09:42:21     INFO -  ==> process 2271 launched child process 2686
09:42:21     INFO -  ==> process 2271 launched child process 2709
09:42:21     INFO -  ==> process 2271 launched child process 2721
09:42:21     INFO -  ==> process 2271 launched child process 2731
09:42:21     INFO -  ==> process 2271 launched child process 2743
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2317
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2324
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2329
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2377
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2381
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2385
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2401
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2423
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2438
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2453
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2463
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2478
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2493
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2513
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2528
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2543
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2558
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2574
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2589
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2607
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2622
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2637
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2652
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2667
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2682
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2686
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2709
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2721
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2731
09:42:21     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 2743
09:42:21     INFO -  mozcrash INFO | Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/fx-team-linux/1389801523/firefox-29.0a1.en-US.linux-i686.crashreporter-symbols.zip
09:43:13  WARNING -  PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | application crashed [@ mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::ContainerLayerParameters const&, gfx3DMatrix const*, unsigned int)]
09:43:13     INFO -  Crash dump filename: /tmp/tmpBFladX/minidumps/5e702247-8b99-7738-034f2bcb-1cbb8d71.dmp
09:43:13     INFO -  Operating system: Linux
09:43:13     INFO -                    0.0.0 Linux 3.2.0-23-generic-pae #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012 i686
09:43:13     INFO -  CPU: x86
09:43:13     INFO -       GenuineIntel family 6 model 45 stepping 7
09:43:13     INFO -       1 CPU
09:43:13     INFO -  Crash reason:  SIGILL
09:43:13     INFO -  Crash address: 0xb4b1b681
09:43:13     INFO -  Thread 0 (crashed)
09:43:13     INFO -   0  libxul.so!mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::ContainerLayerParameters const&, gfx3DMatrix const*, unsigned int) [FrameLayerBuilder.h:59251ffa1853 : 74 + 0x4]
09:43:13     INFO -      eip = 0xb4b1b681   esp = 0xbfcbb960   ebp = 0xbfcbbba8   ebx = 0xb6d8730c
09:43:13     INFO -      esi = 0xbfcbba78   edi = 0xbfcbba78   eax = 0x00000000   ecx = 0xfffffd9f
09:43:13     INFO -      edx = 0xbfcbbc00   efl = 0x00010246
09:43:13     INFO -      Found by: given as instruction pointer in context
09:43:13     INFO -   1  libxul.so!nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) [nsDisplayList.cpp:59251ffa1853 : 3099 + 0x2b]
09:43:13     INFO -      eip = 0xb4b3f116   esp = 0xbfcbbbb0   ebp = 0xbfcbbc18   ebx = 0xb6d8730c
09:43:13     INFO -      esi = 0x8b95dcf4   edi = 0xbfcbbc5c
09:43:13     INFO -      Found by: call frame info
09:43:13     INFO -   2  libxul.so!mozilla::FrameLayerBuilder::AddThebesDisplayItem(mozilla::ThebesLayerData*, nsDisplayItem*, mozilla::DisplayItemClip const&, nsIFrame*, mozilla::LayerState, nsPoint const&, nsAutoPtr<nsDisplayItemGeometry>) [FrameLayerBuilder.cpp:59251ffa1853 : 2650 + 0x2]
09:43:13     INFO -      eip = 0xb4b18850   esp = 0xbfcbbc20   ebp = 0xbfcbbcd8   ebx = 0xb6d8730c
09:43:13     INFO -      esi = 0x7f5ddd80   edi = 0x8c722d8c
09:43:13     INFO -      Found by: call frame info
09:43:13     INFO -   3  libxul.so!mozilla::ContainerState::ProcessDisplayItems(nsDisplayList const&, unsigned int) [FrameLayerBuilder.cpp:59251ffa1853 : 2468 + 0x28]
09:43:13     INFO -      eip = 0xb4b1af1f   esp = 0xbfcbbce0   ebp = 0xbfcbbde8   ebx = 0xb6d8730c
09:43:13     INFO -      esi = 0x82231e80   edi = 0xbfcbbd4c
09:43:13     INFO -      Found by: call frame info
09:43:13     INFO -   4  libxul.so!mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::ContainerLayerParameters const&, gfx3DMatrix const*, unsigned int) [FrameLayerBuilder.cpp:59251ffa1853 : 3152 + 0x17]
09:43:13     INFO -      eip = 0xb4b1ba45   esp = 0xbfcbbdf0   ebp = 0xbfcbc048   ebx = 0xb6d8730c
09:43:13     INFO -      esi = 0xb6e0e7fc   edi = 0xbfcbbf18
09:43:13     INFO -      Found by: call frame info
09:43:13     INFO -   5  libxul.so!nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const [nsDisplayList.cpp:59251ffa1853 : 1156 + 0x4]
09:43:13     INFO -      eip = 0xb4b39cbf   esp = 0xbfcbc050   ebp = 0xbfcbc168   ebx = 0xb6d8730c
09:43:13     INFO -      esi = 0xa870bf40   edi = 0x7f5dda10
09:43:13     INFO -      Found by: call frame info
09:43:13     INFO -   6  libxul.so!nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const [nsDisplayList.cpp:59251ffa1853 : 1076 + 0x11]
09:43:13     INFO -      eip = 0xb4b3a294   esp = 0xbfcbc170   ebp = 0xbfcbc1b8   ebx = 0xb6d8730c
09:43:13     INFO -      esi = 0xbfcbc290   edi = 0xbfcbc19c
09:43:13     INFO -      Found by: call frame info
The crash reason/address makes me think this might be exploitable:
Crash reason:  SIGILL
Crash address: 0xb4b1b681
Group: core-security
Severity: normal → critical
Keywords: sec-critical
Mats want to own this one? (We don't like "Nobody")
Flags: needinfo?(matspal)
(In reply to Ryan VanderMeulen [:RyanVM UTC-5] from comment #2)
> Guessing this is the same failure:
> https://tbpl.mozilla.org/php/getParsedLog.php?id=33185403&tree=Mozilla-
> Central

That one looks like bug 897158, which is a different crash.
Flags: needinfo?(matspal)
(In reply to David Bolter [:davidb] from comment #3)
> Mats want to own this one? (We don't like "Nobody")

I don't think there's much anyone can do with a single occurrence like this.

Fwiw, I ran "mach mochitest-browser --repeat=100 browser/devtools/profiler/test/browser_profiler_console_api.js" locally in a debug build on Linux64
without crashing.  Perhaps someone in QA could investigate if it's reproducible
on other platforms/builds?
Whiteboard: [close if no STR/recurrence by March?]
Depends on: 973974
That this is one of many crashes in https://bugzilla.mozilla.org/showdependencytree.cgi?id=973974&hide_resolved=1 makes me suspect some sort of memory corruption (although getting a SIGILL from memory corruption seems surprising).
This happened twice in mid-January, so I think we should close this unless it starts happening again.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → INCOMPLETE
Group: core-security
You need to log in before you can comment on or make changes to this bug.