966387 - crash in mozilla::dom::ContentChild::AllocPBrowserChild(mozilla::dom::IPCTabContext const&, unsigned int const&)

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, defect)

Description

[Tony Nguyen]

This bug was filed from the Socorro interface and is 
report bp-7595b5ed-1faa-4999-a4d6-279532140131.
=============================================================

Encountered this crash while cancelling a download from the Marketplace. I will add updated STR when I can narrow it down.

Repro Steps:
1. Updated Buri to BuildID: 20140131004001
2. Connect to Cellular Data
3. Navigate to Market Place
4. Download Game Pack
5. Tap Home button
6. Slide Homescreen to left to navigate to E.me 
7. Tap and hold on Game Pack
8. Tap the little 'x' icon to cancel download

Actual Result: 
Buri Device crashes

Expected Result:
Buri Device doesn't crash

Environmental Variables:
Device: Buri v1.3 mozRIL
BuildID: 20140131004001
Gaia: 0ddcd8da5bfe1b48c73502ef29220e92f2db6b73
Gecko: 32e45047b663
Version: 28.0a2
v1.2-device.cfg

Comment 1

[Jason Smith [:jsmith]]

A couple of questions:

1. Can we consistently reproduce this? How often?
2. Does this reproduce on 1.1?
3. Is this a full phone crash or an app crash?

Comment 2

[sarsenyev]

1. Cannot reproduce this crash on the latest 1.3
2. It doesn't reproduce on 1.1
3. It was a full phone crash

Device: Buri 1.3 MOZ
BuildID: 20140213004002
Gaia: 999808c18d2fc95f14d65b925f25237e78436f56
Gecko: 6279534238d8
Version: 28.0
Firmware Version: v1.2-device.cfg

Comment 3

[James Zhang (Spreadtrum)]

We meet this crash on v1.3t twice with monkey test.
The log address is ftp://ftp.spreadtrum.com/FirefoxOS/MonkeyLog/0610/Bug317624/
pcheng known the account and password, please ask her to get the log.


mozilla/Crash Reports/pending/5c3b4d37-cbb5-f960-7c6523f3-40f8f5d9.dmp
--------------------
Count: 1
--------------------
>>>> mozilla/Crash Reports/pending/5c3b4d37-cbb5-f960-7c6523f3-40f8f5d9.dmp <<<<
---- extra ----
B2G_OS_Version=1.3.0.0-prerelease
Android_Device=sp6821a_gonk
Android_Manufacturer=Spreadtrum
ProductName=B2G
Android_Board=sp6821a
Android_CPU_ABI=armeabi-v7a
Vendor=Mozilla
InstallTime=5133474
Notes=GL Layers! EGL? EGL+ GL Context? GL Context+ GL Layers+ 
ReleaseChannel=release-spreadtrum
Android_CPU_ABI2=armeabi
Version=28.1
Android_Brand=Spreadtrum
ServerURL=https://crash-reports.mozilla.com/submit?id={3c2e2abc-06d4-11e1-ac3b-374f68613e61}&version=28.1&buildid=20140609020457
Android_Hardware=sp8810
useragent_locale=en-US
BuildID=20140609020457
ProductID={3c2e2abc-06d4-11e1-ac3b-374f68613e61}
Android_Version=15(AOSP)
Android_Model=sp6821a
CrashTime=5197092
StartupTime=5196743
ProcessType=
URL=app://camera.gaiamobile.org/manifest.webapp
---- stack ----
0  libxul.so!mozilla::dom::ContentChild::AllocPBrowserChild(mozilla::dom::IPCTabContext const&, unsigned int const&) [ContentChild.cpp : 714 + 0x2]
1  libxul.so!mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) [PContentChild.cpp : 3208 + 0xd]
2  libxul.so!mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) [MessageChannel.cpp : 1135 + 0x5]
3  libxul.so!mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message const&) [MessageChannel.cpp : 1053 + 0x3]
4  libxul.so!mozilla::ipc::MessageChannel::OnMaybeDequeueOne() [MessageChannel.cpp : 1036 + 0x3]
5  libxul.so!RunnableMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)(), Tuple0>::Run() [tuple.h : 383 + 0x5]
6  libxul.so!mozilla::ipc::MessageChannel::DequeueTask::Run() [MessageChannel.h : 371 + 0x9]
7  libxul.so!MessageLoop::RunTask(Task*) [message_loop.cc : 340 + 0x5]
8  libxul.so!MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) [message_loop.cc : 348 + 0x5]
9  libxul.so!MessageLoop::DoWork() [message_loop.cc : 448 + 0x7]
10  libxul.so!mozilla::ipc::DoWorkRunnable::Run() [MessagePump.cpp : 45 + 0x7]
11  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp : 612 + 0x5]
12  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp : 263 + 0xb]
13  libxul.so!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [MessagePump.cpp : 85 + 0x7]
14  libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [MessagePump.cpp : 250 + 0x7]
15  libxul.so!MessageLoop::RunInternal() [message_loop.cc : 222 + 0x5]
16  libxul.so!MessageLoop::Run() [message_loop.cc : 215 + 0x5]
17  libxul.so!nsBaseAppShell::Run() [nsBaseAppShell.cpp : 161 + 0x7]
18  libxul.so!XRE_RunAppShell [nsEmbedFunctions.cpp : 683 + 0x5]
19  libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [MessagePump.cpp : 217 + 0x3]
20  libxul.so!MessageLoop::RunInternal() [message_loop.cc : 222 + 0x5]
21  libxul.so!MessageLoop::Run() [message_loop.cc : 215 + 0x5]
22  libxul.so!XRE_InitChildProcess [nsEmbedFunctions.cpp : 520 + 0x9]
23  libxul.so!content_process_main(int, char**) [plugin-container.cpp : 137 + 0x5]
24  libxul.so!mozilla::ipc::ProcLoaderLoadRunner::DoWork() [ProcessUtils_linux.cpp : 358 + 0x7]
25  libxul.so!XRE_ProcLoaderServiceRun [ProcessUtils_linux.cpp : 499 + 0x7]
26  b2g!main [B2GLoader.cpp : 151 + 0x11]
27  libc.so!__libc_init [libc_init_dynamic.c : 114 + 0x7]
28  0xb0001dc5
29  b2g!MOZ_PNG_benign_err [pngerror.c : 383 + 0x3]
30  0xffe

Comment 4

[Josh Matthews [:jdm]]

https://hg.mozilla.org/releases/mozilla-b2g28_v1_3t/file/0e56308ce67b/dom/ipc/ContentChild.cpp#l714

>709     MaybeInvalidTabContext tc(aContext);
>710     if (!tc.IsValid()) {
>711         NS_ERROR(nsPrintfCString("Received an invalid TabContext from "
>712                                  "the parent process. (%s)  Crashing...",
>713                                  tc.GetInvalidReason()).get());
>714         MOZ_CRASH("Invalid TabContext received from the parent process.");
>715     }

Fun.

Comment 5

[Josh Matthews [:jdm]]

It would be nice to learn the value of mInvalidReason in the MaybeInvalidTabContext that's there.

Comment 6

[Josh Matthews [:jdm]]

Does the log contain the "Received an invalid TabContext" string?

Comment 7

[Joe Cheng [:jcheng] (please needinfo)]

let's not block the release with this bug at this moment. we are close to done here for tarako (unless this is an easily reproduced bug from end users instead of monkey test)

Comment 8

[ying.xu]

we meet another

URL=app://costcontrol.gaiamobile.org/manifest.webapp

ralted logs:

02-04 01:19:13.245 <6>0[37014.190089] [ 8015]     0  8015      189       33       19   0       0             0 sh
02-04 01:19:13.245 <6>0[37014.190110] [ 8017]     0  8017      172       43       13   0       0             0 orng
02-04 01:19:13.245 <6>0[37014.190131] [ 8143] 18143  8143    14591     3086     2066   0      11           734 Browser
02-04 01:19:13.245 <6>0[37014.190153] [ 8161] 18161  8161    15103     2855     2288   0      11           734 Usage
02-04 01:19:13.245 <6>0[37014.190174] [ 8174] 18174  8174    14863     4122     1192   0      10           667 Browser
02-04 01:19:13.245 <6>0[37014.190195] [ 8204]     0  8204    13019     3001     1104   0       2           134 (Preallocated a
02-04 01:19:13.245 <4>0[37014.190219] zram0 status unit(page):
02-04 01:19:13.245 <4>0[37014.190224]   mem_used_total:  4648
02-04 01:19:13.245 <4>0[37014.190230]   compr_data_size: 4533
02-04 01:19:13.245 <4>0[37014.190236]   orig_data_size:  12023
02-04 01:19:13.245 <4>0[37014.190241]   num_reads:       8017327
02-04 01:19:13.245 <4>0[37014.190247]   num_writes:      7824371
02-04 01:19:13.722 <4>0[37014.687281] UMP<2>: Session closed
02-04 01:19:18.071 <4>0[37018.978657] lowmem_shrink select 8161 (Usage), adj 11, size 5130, to kill
02-04 01:19:18.071 <4>0[37018.978713] lowmem_shrink send sigkill to 8161 (Usage), adj 11, size 5130

2-04 01:19:12.910  8204  8204 I Gecko   : ###################################### forms.js loaded
02-04 01:19:12.920  8204  8204 I Gecko   : ############################### browserElementPanning.js loaded
02-04 01:19:12.940  8204  8204 I Gecko   : ######################## BrowserElementChildPreload.js loaded
02-04 01:19:12.950   635   635 I Gonk    : bug988110 dispatchOnce data.type: 0
02-04 01:19:12.950   635   635 I Gonk    : bug988110 dispatchOnce MOTION mTouchEventsFiltered: 0
02-04 01:19:12.950   635   635 E GeckoConsole: [JavaScript Error: "can't access dead object" {file: "chrome://global/content/BrowserElementPanning.js" line: 59}]
02-04 01:19:12.950   635   635 I Gecko   : TabParent.cpp  SendRealTouchEvent e == 0x44b9c250
02-04 01:19:13.100   635   635 I Gonk    : bug988110 dispatchOnce data.type: 0
02-04 01:19:13.100   635   635 I Gonk    : bug988110 dispatchOnce MOTION mTouchEventsFiltered: 0
02-04 01:19:13.330   635   635 I Gonk    : bug988110 dispatchOnce data.type: 0
02-04 01:19:13.330   635   635 I Gonk    : bug988110 dispatchOnce MOTION mTouchEventsFiltered: 0
02-04 01:19:13.500   635   635 E GeckoConsole: [JavaScript Error: "can't access dead object" {file: "chrome://global/content/BrowserElementPanning.js" line: 59}]
02-04 01:19:13.550   635   635 I Gonk    : bug988110 dispatchOnce data.type: 0
02-04 01:19:13.560   635   635 I Gonk    : bug988110 dispatchOnce MOTION mTouchEventsFiltered: 0
02-04 01:19:13.720   635   635 I Gonk    : bug988110 dispatchOnce data.type: 0
02-04 01:19:13.720   635   635 I Gonk    : bug988110 dispatchOnce MOTION mTouchEventsFiltered: 0
02-04 01:19:13.790   635   635 E GeckoConsole: [JavaScript Error: "can't access dead object" {file: "chrome://global/content/BrowserElementPanning.js" line: 59}]
02-04 01:19:13.830   635   635 I Gonk    : bug988110 dispatchOnce data.type: 0
02-04 01:19:13.830   635   635 I Gonk    : bug988110 dispatchOnce MOTION mTouchEventsFiltered: 0
02-04 01:19:13.910   635   635 I Gecko   :
02-04 01:19:13.910   635   635 I Gecko   : ###!!! [Parent][MessageChannel] Error: Channel error: cannot send/recv
02-04 01:19:13.910   635   635 I Gecko   :
02-04 01:19:13.920   635   635 I Gecko   : -*- RadioInterfaceLayer: Received 'child-process-shutdown' message from content process
02-04 01:19:13.950   635   635 I GeckoDump: Crash reporter : Not online, postponing.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.