Closed Bug 960761 Opened 12 years ago Closed 12 years ago

Intermittent browser_profiler_console_api.js | application crashed [@ mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::ContainerLayerParamet

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE
Tracking Flags:
Tracking Status
firefox29 --- affected
firefox30 --- affected

People

(Reporter: RyanVM, Unassigned)

References

Details

(Keywords: crash, intermittent-failure, sec-critical, Whiteboard: [close if no STR/recurrence by March?])

https://tbpl.mozilla.org/php/getParsedLog.php?id=33042831&tree=Fx-Team Ubuntu VM 12.04 fx-team opt test mochitest-browser-chrome on 2014-01-15 09:07:15 PST for push 59251ffa1853 slave: tst-linux32-spot-343 09:42:18 INFO - TEST-START | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js 09:42:18 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | Console message: [JavaScript Error: "A promise chain failed to handle a rejection. 09:42:18 INFO - Date: Wed Jan 15 2014 09:42:17 GMT-0800 (PST) 09:42:18 INFO - Full Message: TypeError: this.panel is null 09:42:18 INFO - Full Stack: Cleopatra.prototype.parse/</poll@resource://gre/modules/commonjs/toolkit/loader.js -> resource:///modules/devtools/profiler/cleopatra.js:113 09:42:18 INFO - Cleopatra.prototype.parse/<@resource://gre/modules/commonjs/toolkit/loader.js -> resource:///modules/devtools/profiler/cleopatra.js:127 09:42:18 INFO - Handler.prototype.process@resource://gre/modules/Promise.jsm:767 09:42:18 INFO - this.PromiseWalker.walkerLoop@resource://gre/modules/Promise.jsm:531 09:42:18 INFO - " {file: "resource://gre/modules/commonjs/toolkit/loader.js -> resource:///modules/devtools/profiler/cleopatra.js" line: 113 column: 0 source: "113"}] 09:42:19 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | Console message: [JavaScript Warning: "XUL box for span element contained an inline #text child, forcing all its children to be wrapped in a block." {file: "resource://app/modules/devtools/SideMenuWidget.jsm" line: 583}] 09:42:19 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | Console message: [JavaScript Warning: "XUL box for span element contained an inline #text child, forcing all its children to be wrapped in a block." {file: "resource:///modules/devtools/ViewHelpers.jsm" line: 993}] 09:42:21 WARNING - TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | application terminated with exit code 4 09:42:21 INFO - INFO | runtests.py | Application ran for: 0:30:32.919732 09:42:21 INFO - INFO | zombiecheck | Reading PID log: /tmp/tmpcrQJPWpidlog 09:42:21 INFO - ==> process 2271 launched child process 2317 09:42:21 INFO - ==> process 2271 launched child process 2324 09:42:21 INFO - ==> process 2271 launched child process 2329 09:42:21 INFO - ==> process 2271 launched child process 2377 09:42:21 INFO - ==> process 2271 launched child process 2381 09:42:21 INFO - ==> process 2271 launched child process 2385 09:42:21 INFO - ==> process 2271 launched child process 2401 09:42:21 INFO - ==> process 2271 launched child process 2423 09:42:21 INFO - ==> process 2271 launched child process 2438 09:42:21 INFO - ==> process 2271 launched child process 2453 09:42:21 INFO - ==> process 2271 launched child process 2463 09:42:21 INFO - ==> process 2271 launched child process 2478 09:42:21 INFO - ==> process 2271 launched child process 2493 09:42:21 INFO - ==> process 2271 launched child process 2513 09:42:21 INFO - ==> process 2271 launched child process 2528 09:42:21 INFO - ==> process 2271 launched child process 2543 09:42:21 INFO - ==> process 2271 launched child process 2558 09:42:21 INFO - ==> process 2271 launched child process 2574 09:42:21 INFO - ==> process 2271 launched child process 2589 09:42:21 INFO - ==> process 2271 launched child process 2607 09:42:21 INFO - ==> process 2271 launched child process 2622 09:42:21 INFO - ==> process 2271 launched child process 2637 09:42:21 INFO - ==> process 2271 launched child process 2652 09:42:21 INFO - ==> process 2271 launched child process 2667 09:42:21 INFO - ==> process 2271 launched child process 2682 09:42:21 INFO - ==> process 2271 launched child process 2686 09:42:21 INFO - ==> process 2271 launched child process 2709 09:42:21 INFO - ==> process 2271 launched child process 2721 09:42:21 INFO - ==> process 2271 launched child process 2731 09:42:21 INFO - ==> process 2271 launched child process 2743 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2317 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2324 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2329 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2377 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2381 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2385 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2401 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2423 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2438 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2453 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2463 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2478 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2493 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2513 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2528 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2543 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2558 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2574 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2589 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2607 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2622 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2637 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2652 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2667 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2682 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2686 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2709 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2721 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2731 09:42:21 INFO - INFO | zombiecheck | Checking for orphan process with PID: 2743 09:42:21 INFO - mozcrash INFO | Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/fx-team-linux/1389801523/firefox-29.0a1.en-US.linux-i686.crashreporter-symbols.zip 09:43:13 WARNING - PROCESS-CRASH | chrome://mochitests/content/browser/browser/devtools/profiler/test/browser_profiler_console_api.js | application crashed [@ mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::ContainerLayerParameters const&, gfx3DMatrix const*, unsigned int)] 09:43:13 INFO - Crash dump filename: /tmp/tmpBFladX/minidumps/5e702247-8b99-7738-034f2bcb-1cbb8d71.dmp 09:43:13 INFO - Operating system: Linux 09:43:13 INFO - 0.0.0 Linux 3.2.0-23-generic-pae #36-Ubuntu SMP Tue Apr 10 22:19:09 UTC 2012 i686 09:43:13 INFO - CPU: x86 09:43:13 INFO - GenuineIntel family 6 model 45 stepping 7 09:43:13 INFO - 1 CPU 09:43:13 INFO - Crash reason: SIGILL 09:43:13 INFO - Crash address: 0xb4b1b681 09:43:13 INFO - Thread 0 (crashed) 09:43:13 INFO - 0 libxul.so!mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::ContainerLayerParameters const&, gfx3DMatrix const*, unsigned int) [FrameLayerBuilder.h:59251ffa1853 : 74 + 0x4] 09:43:13 INFO - eip = 0xb4b1b681 esp = 0xbfcbb960 ebp = 0xbfcbbba8 ebx = 0xb6d8730c 09:43:13 INFO - esi = 0xbfcbba78 edi = 0xbfcbba78 eax = 0x00000000 ecx = 0xfffffd9f 09:43:13 INFO - edx = 0xbfcbbc00 efl = 0x00010246 09:43:13 INFO - Found by: given as instruction pointer in context 09:43:13 INFO - 1 libxul.so!nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) [nsDisplayList.cpp:59251ffa1853 : 3099 + 0x2b] 09:43:13 INFO - eip = 0xb4b3f116 esp = 0xbfcbbbb0 ebp = 0xbfcbbc18 ebx = 0xb6d8730c 09:43:13 INFO - esi = 0x8b95dcf4 edi = 0xbfcbbc5c 09:43:13 INFO - Found by: call frame info 09:43:13 INFO - 2 libxul.so!mozilla::FrameLayerBuilder::AddThebesDisplayItem(mozilla::ThebesLayerData*, nsDisplayItem*, mozilla::DisplayItemClip const&, nsIFrame*, mozilla::LayerState, nsPoint const&, nsAutoPtr<nsDisplayItemGeometry>) [FrameLayerBuilder.cpp:59251ffa1853 : 2650 + 0x2] 09:43:13 INFO - eip = 0xb4b18850 esp = 0xbfcbbc20 ebp = 0xbfcbbcd8 ebx = 0xb6d8730c 09:43:13 INFO - esi = 0x7f5ddd80 edi = 0x8c722d8c 09:43:13 INFO - Found by: call frame info 09:43:13 INFO - 3 libxul.so!mozilla::ContainerState::ProcessDisplayItems(nsDisplayList const&, unsigned int) [FrameLayerBuilder.cpp:59251ffa1853 : 2468 + 0x28] 09:43:13 INFO - eip = 0xb4b1af1f esp = 0xbfcbbce0 ebp = 0xbfcbbde8 ebx = 0xb6d8730c 09:43:13 INFO - esi = 0x82231e80 edi = 0xbfcbbd4c 09:43:13 INFO - Found by: call frame info 09:43:13 INFO - 4 libxul.so!mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::ContainerLayerParameters const&, gfx3DMatrix const*, unsigned int) [FrameLayerBuilder.cpp:59251ffa1853 : 3152 + 0x17] 09:43:13 INFO - eip = 0xb4b1ba45 esp = 0xbfcbbdf0 ebp = 0xbfcbc048 ebx = 0xb6d8730c 09:43:13 INFO - esi = 0xb6e0e7fc edi = 0xbfcbbf18 09:43:13 INFO - Found by: call frame info 09:43:13 INFO - 5 libxul.so!nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const [nsDisplayList.cpp:59251ffa1853 : 1156 + 0x4] 09:43:13 INFO - eip = 0xb4b39cbf esp = 0xbfcbc050 ebp = 0xbfcbc168 ebx = 0xb6d8730c 09:43:13 INFO - esi = 0xa870bf40 edi = 0x7f5dda10 09:43:13 INFO - Found by: call frame info 09:43:13 INFO - 6 libxul.so!nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const [nsDisplayList.cpp:59251ffa1853 : 1076 + 0x11] 09:43:13 INFO - eip = 0xb4b3a294 esp = 0xbfcbc170 ebp = 0xbfcbc1b8 ebx = 0xb6d8730c 09:43:13 INFO - esi = 0xbfcbc290 edi = 0xbfcbc19c 09:43:13 INFO - Found by: call frame info
The crash reason/address makes me think this might be exploitable: Crash reason: SIGILL Crash address: 0xb4b1b681
Group: core-security
Severity: normal → critical
Keywords: sec-critical
Mats want to own this one? (We don't like "Nobody")
Flags: needinfo?(matspal)
(In reply to Ryan VanderMeulen [:RyanVM UTC-5] from comment #2) > Guessing this is the same failure: > https://tbpl.mozilla.org/php/getParsedLog.php?id=33185403&tree=Mozilla- > Central That one looks like bug 897158, which is a different crash.
Flags: needinfo?(matspal)
(In reply to David Bolter [:davidb] from comment #3) > Mats want to own this one? (We don't like "Nobody") I don't think there's much anyone can do with a single occurrence like this. Fwiw, I ran "mach mochitest-browser --repeat=100 browser/devtools/profiler/test/browser_profiler_console_api.js" locally in a debug build on Linux64 without crashing. Perhaps someone in QA could investigate if it's reproducible on other platforms/builds?
Whiteboard: [close if no STR/recurrence by March?]
Depends on: 973974
That this is one of many crashes in https://bugzilla.mozilla.org/showdependencytree.cgi?id=973974&hide_resolved=1 makes me suspect some sort of memory corruption (although getting a SIGILL from memory corruption seems surprising).
This happened twice in mid-January, so I think we should close this unless it starts happening again.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → INCOMPLETE
Group: core-security
You need to log in before you can comment on or make changes to this bug.