Closed Bug 969902 Opened 10 years ago Closed 10 years ago

Crash in about:memory calling __malloc_usable_size on apparently good data due to bug in DNS memory reporter

Categories

(Core :: Networking: DNS, defect)

Product:
Core
Component:
Networking: DNS
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla30
Tracking Flags:
Tracking Status
firefox28 --- affected
firefox29 --- fixed
firefox30 --- fixed

People

(Reporter: dbaron, Assigned: n.nethercote)

References

Details

Attachments

(2 files, 1 obsolete file)

another crash
16.87 KB, text/plain
Details
Fix a problem with DNS memory reporting measurement.
1.16 KB, patch
sworkman
: review+
Sylvestre
: approval-mozilla-aurora+
lsblakk
: approval-mozilla-beta-
Details | Diff | Splinter Review 
On January 26, using a debug build built prior to that point, I crashed trying to do an about:memory dump of a Firefox instance that had started using ~12GB of memory:

#4  <signal handler called>
#5  mUSABLe (mem=0x7fe7c5018128) at malloc.c:4686
#6  __malloc_usable_size (m=<optimized out>) at malloc.c:3411
#7  0x00007fe926aaddf6 in nsACString_internal::SizeOfIncludingThisMustBeUnshared (this=0x7fe7c5018128, mallocSizeOf=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/string/src/nsTSubstring.cpp:971
#8  0x00007fe926baf4d2 in nsHostRecord::SizeOfIncludingThis (this=0x2b985ca0, 
    mallocSizeOf=0x7fe926bb1896 <DNSServiceMallocSizeOf(void const*)>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/netwerk/dns/nsHostResolver.cpp:299
#9  0x00007fe926a9bbe1 in SizeOfEntryExcludingThisEnumerator (
    table=<optimized out>, hdr=<optimized out>, number=<optimized out>, 
    arg=0x7fffd27948f0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/glue/pldhash.cpp:687
#10 0x00007fe926aa02b0 in PL_DHashTableEnumerate (table=0x440fc290, 
    etor=0x7fe926a9bbc6 <SizeOfEntryExcludingThisEnumerator(PLDHashTable*, PLDHashEntryHdr*, uint32_t, void*)>, arg=0x7fffd27948f0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/glue/pldhash.cpp:632
#11 0x00007fe926aa045f in PL_DHashTableSizeOfExcludingThis (table=0x440fc290, 
    sizeOfEntryExcludingThis=0x7fe926baf4ff <SizeOfHostDBEntExcludingThis(PLDHashEntryHdr*, mozilla::MallocSizeOf, void*)>, 
    mallocSizeOf=0x7fe926bb1896 <DNSServiceMallocSizeOf(void const*)>, arg=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/glue/pldhash.cpp:702
#12 0x00007fe926baf1a8 in nsHostResolver::SizeOfIncludingThis (
    this=0x440fc230, 
    mallocSizeOf=0x7fe926bb1896 <DNSServiceMallocSizeOf(void const*)>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/netwerk/dns/nsHostResolver.cpp:1124
#13 0x00007fe926bb4c92 in nsDNSService::SizeOfIncludingThis (this=0xe01e40, 
    mallocSizeOf=0x7fe926bb1896 <DNSServiceMallocSizeOf(void const*)>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/netwerk/dns/nsDNSService2.cpp:907
#14 0x00007fe926bb4d2f in nsDNSService::CollectReports (this=0xe01e40, 
---Type <return> to continue, or q <return> to quit---
    aHandleReport=0x37486b60, aData=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/netwerk/dns/nsDNSService2.cpp:920
#15 0x00007fe926abfd4f in nsMemoryReporterManager::GetReportsForThisProcess (
    this=<optimized out>, aHandleReport=0x37486b60, aHandleReportData=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsMemoryReporterManager.cpp:1101
#16 0x00007fe926abdd5b in nsMemoryReporterManager::GetReports (this=0xdcd650, 
    aHandleReport=0x37486b60, aHandleReportData=0x0, 
    aFinishReporting=0x2721ded0, aFinishReportingData=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsMemoryReporterManager.cpp:1073
#17 0x00007fe926b0c476 in NS_InvokeByIndex (that=<optimized out>, 
    methodIndex=<optimized out>, paramCount=<optimized out>, 
    params=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:164
#18 0x00007fe9276a2378 in Invoke (this=0x7fffd2794c80)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/XPCWrappedNative.cpp:2561
#19 CallMethodHelper::Call (this=0x7fffd2794c80)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/XPCWrappedNative.cpp:1901
#20 0x00007fe92769c7ab in XPCWrappedNative::CallMethod (ccx=..., 
    mode=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/XPCWrappedNative.cpp:1867
#21 0x00007fe92769ce44 in XPC_WN_CallMethod (cx=0x6bd3e7e0, argc=4, 
    vp=0x100b848)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1300
#22 0x00007fe928a319c0 in js::CallJSNative (cx=0x6bd3e7e0, 
    native=0x7fe92769cccf <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, args=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jscntxtinlines.h:220
#23 0x00007fe928a298f7 in js::Invoke (cx=0x6bd3e7e0, args=..., 
    construct=js::NO_CONSTRUCT)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:465
#24 0x00007fe928a23e6a in Interpret (cx=0x6bd3e7e0, state=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:2610
#25 0x00007fe928a28ec9 in RunScript (state=..., cx=0x6bd3e7e0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:422
#26 js::RunScript (cx=0x6bd3e7e0, state=...)
---Type <return> to continue, or q <return> to quit---
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:387
#27 0x00007fe928a299a0 in js::Invoke (cx=0x6bd3e7e0, args=..., 
    construct=js::NO_CONSTRUCT)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:484
#28 0x00007fe928a29ed2 in js::Invoke (cx=0x6bd3e7e0, thisv=..., fval=..., 
    argc=1, argv=<optimized out>, rval=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/vm/Interpreter.cpp:521
#29 0x00007fe92895ef36 in JS_CallFunctionValue (cx=<optimized out>, 
    objArg=<optimized out>, fval=..., argc=1, argv=0x7fffd27965f8, 
    rval=0x7fffd2796548)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/src/jsapi.cpp:5001
#30 0x00007fe9272d1e27 in mozilla::dom::EventHandlerNonNull::Call (
    this=0x2c4bde20, cx=0x6bd3e7e0, aThisObj=..., event=..., aRv=...)
    at /home/dbaron/builds/ssd/mozilla-central/obj/firefox-debugopt/dom/bindings/EventHandlerBinding.cpp:36
#31 0x00007fe9277efbdf in Call<nsISupports*> (
    aExceptionHandling=mozilla::dom::CallbackObject::eReportExceptions, 
    aRv=..., event=..., thisObj=@0x2fd19a00: 0xeeb8ae0, this=0x2c4bde20)
    at ../../../dist/include/mozilla/dom/EventHandlerBinding.h:61
#32 nsJSEventListener::HandleEvent (this=0x2fd199f0, aEvent=0x19265ac60)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/dom/src/events/nsJSEventListener.cpp:238
#33 0x00007fe927a94d6e in nsEventListenerManager::HandleEventSubType (
    this=0x314af030, aListenerStruct=<optimized out>, aDOMEvent=0x19265ac60, 
    aCurrentTarget=0xeeb8ae0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/content/events/src/nsEventListenerManager.cpp:926
#34 0x00007fe927a94f70 in nsEventListenerManager::HandleEventInternal (
    this=0x314af030, aPresContext=0x14073400, aEvent=0x7fffd2797048, 
    aDOMEvent=0x7fffd2796de0, aCurrentTarget=0xeeb8ae0, 
    aEventStatus=0x7fffd2796de8)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/content/events/src/nsEventListenerManager.cpp:986
#35 0x00007fe927a9b3cb in HandleEvent (aEventStatus=0x7fffd2796de8, 
    aCurrentTarget=0xeeb8ae0, aDOMEvent=0x7fffd2796de0, aEvent=0x7fffd2797048, 
    aPresContext=0x14073400, this=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/content/events/src/nsEventListenerManager.h:324
#36 nsEventTargetChainItem::HandleEvent (this=0x45180698, aVisitor=..., 
    aCd=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/content/events/src/nsEventDispatcher.cpp:193
#37 0x00007fe927a95149 in nsEventTargetChainItem::HandleEventTargetChain (
    aChain=..., aVisitor=..., aCallback=0x7fffd2796f48, aCd=...)
---Type <return> to continue, or q <return> to quit---
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/content/events/src/nsEventDispatcher.cpp:284
#38 0x00007fe927a98561 in nsEventDispatcher::Dispatch (aTarget=0x45180a80, 
    aPresContext=0x14073400, aEvent=0x7fffd2797048, aDOMEvent=0x0, 
    aEventStatus=0x7fffd27976fc, aCallback=0x7fffd2796f48, aTargets=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/content/events/src/nsEventDispatcher.cpp:597
#39 0x00007fe927dbb0aa in PresShell::HandleEventInternal (this=0x25db2d00, 
    aEvent=0x7fffd2797048, aStatus=0x7fffd27976fc)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/layout/base/nsPresShell.cpp:7056
#40 0x00007fe927dbb2c7 in PresShell::HandleEventWithTarget (this=0x25db2d00, 
    aEvent=0x7fffd2797048, aFrame=0xf3eb0da0, aContent=0xeeb8ae0, 
    aStatus=0x7fffd27976fc)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/layout/base/nsPresShell.cpp:6812
#41 0x00007fe927a6714a in nsEventStateManager::CheckForAndDispatchClick (
    this=0x16b4deca0, aPresContext=<optimized out>, aEvent=0x7fffd27977d8, 
    aStatus=0x7fffd27976fc)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/content/events/src/nsEventStateManager.cpp:4715
#42 0x00007fe927a6a9fc in nsEventStateManager::PostHandleEvent (
    this=0x16b4deca0, aPresContext=0x14073400, aEvent=0x7fffd27977d8, 
    aTargetFrame=0xf3eb0da0, aStatus=0x7fffd27976fc)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/content/events/src/nsEventStateManager.cpp:3381
#43 0x00007fe927dbb11c in PresShell::HandleEventInternal (
    this=<optimized out>, aEvent=0x7fffd27977d8, aStatus=0x7fffd27976fc)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/layout/base/nsPresShell.cpp:7068
#44 0x00007fe927dbb3f4 in PresShell::HandlePositionedEvent (this=0x25db2d00, 
    aTargetFrame=<optimized out>, aEvent=0x7fffd27977d8, 
    aEventStatus=0x7fffd27976fc)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/layout/base/nsPresShell.cpp:6786
#45 0x00007fe927dbc028 in PresShell::HandleEvent (this=0x1e49650, 
    aFrame=<optimized out>, aEvent=0x7fffd27977d8, 
    aDontRetargetEvents=<optimized out>, aEventStatus=0x7fffd27976fc)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/layout/base/nsPresShell.cpp:6586
#46 0x00007fe9279313b2 in nsViewManager::DispatchEvent (this=<optimized out>, 
    aEvent=0x7fffd27977d8, aView=<optimized out>, aStatus=0x7fffd27976fc)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/view/src/nsViewManager.cpp:756
#47 0x00007fe92792eae6 in nsView::HandleEvent (this=<optimized out>, 
    aEvent=0x7fffd27977d8, aUseAttachedEvents=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/view/src/nsView.cpp:1084
---Type <return> to continue, or q <return> to quit---
#48 0x00007fe9275dc3fb in nsWindow::DispatchEvent (this=0x1d8b0e0, 
    aEvent=0x7fffd27977d8, aStatus=@0x7fffd279787c: nsEventStatus_eIgnore)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/widget/gtk/nsWindow.cpp:467
#49 0x00007fe9275e068b in nsWindow::OnButtonReleaseEvent (this=0x1d8b0e0, 
    aEvent=0x52a16c10)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/widget/gtk/nsWindow.cpp:2816
#50 0x00007fe9275e06df in button_release_event_cb (widget=<optimized out>, 
    event=0x52a16c10)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/widget/gtk/nsWindow.cpp:5245
#51 0x00007fe924d9ddd8 in _gtk_marshal_BOOLEAN__BOXED (closure=0x1d8b6b0, 
    return_value=0x7fffd2797a60, n_param_values=<optimized out>, 
    param_values=0x7fffd2797ad0, invocation_hint=<optimized out>, 
    marshal_data=<optimized out>)
    at /build/buildd/gtk+2.0-2.24.10/gtk/gtkmarshalers.c:86
#52 0x00007fe9255a5ca2 in g_closure_invoke (closure=0x1d8b6b0, 
    return_value=0x7fffd2797a60, n_param_values=2, 
    param_values=0x7fffd2797ad0, invocation_hint=<optimized out>)
    at /build/buildd/glib2.0-2.32.4/./gobject/gclosure.c:777
#53 0x00007fe9255b6d71 in signal_emit_unlocked_R (node=<optimized out>, 
    detail=0, instance=<optimized out>, emission_return=0x7fffd2797ca0, 
    instance_and_params=0x7fffd2797ad0)
    at /build/buildd/glib2.0-2.32.4/./gobject/gsignal.c:3551
#54 0x00007fe9255bed4e in g_signal_emit_valist (instance=0x10f0360, 
    signal_id=<optimized out>, detail=0, var_args=<optimized out>)
    at /build/buildd/glib2.0-2.32.4/./gobject/gsignal.c:3310
#55 0x00007fe9255bf212 in g_signal_emit (instance=<optimized out>, 
    signal_id=<optimized out>, detail=<optimized out>)
    at /build/buildd/glib2.0-2.32.4/./gobject/gsignal.c:3356
#56 0x00007fe924eb8191 in gtk_widget_event_internal (widget=0x10f0360, 
    event=0x52a16c10) at /build/buildd/gtk+2.0-2.24.10/gtk/gtkwidget.c:4992
#57 0x00007fe924d9bf63 in IA__gtk_propagate_event (widget=0x10f0360, 
    event=0x52a16c10) at /build/buildd/gtk+2.0-2.24.10/gtk/gtkmain.c:2567
#58 0x00007fe924d9c2c3 in IA__gtk_main_do_event (event=0x52a16c10)
    at /build/buildd/gtk+2.0-2.24.10/gtk/gtkmain.c:1757
#59 0x00007fe923da3cac in gdk_event_dispatch (source=<optimized out>, 
    callback=<optimized out>, user_data=<optimized out>)
    at /build/buildd/gtk+2.0-2.24.10/gdk/x11/gdkevents-x11.c:2377
#60 0x00007fe9252e8d13 in g_main_dispatch (context=0xcb8470)
    at /build/buildd/glib2.0-2.32.4/./glib/gmain.c:2539
#61 g_main_context_dispatch (context=0xcb8470)
    at /build/buildd/glib2.0-2.32.4/./glib/gmain.c:3075
#62 0x00007fe9252e9060 in g_main_context_iterate (dispatch=1, 
    block=<optimized out>, context=0xcb8470, self=<optimized out>)
    at /build/buildd/glib2.0-2.32.4/./glib/gmain.c:3146
---Type <return> to continue, or q <return> to quit---
#63 g_main_context_iterate (context=0xcb8470, block=<optimized out>, 
    dispatch=1, self=<optimized out>)
    at /build/buildd/glib2.0-2.32.4/./glib/gmain.c:3083
#64 0x00007fe9252e9124 in g_main_context_iteration (context=0xcb8470, 
    may_block=1) at /build/buildd/glib2.0-2.32.4/./glib/gmain.c:3207
#65 0x00007fe9275d6fd7 in nsAppShell::ProcessNextNativeEvent (
    this=<optimized out>, mayWait=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/widget/gtk/nsAppShell.cpp:138
#66 0x00007fe92760d8a2 in nsBaseAppShell::DoProcessNextNativeEvent (
    this=0x10eaf80, mayWait=<optimized out>, recursionDepth=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/widget/xpwidgets/nsBaseAppShell.cpp:137
#67 0x00007fe92760d9be in nsBaseAppShell::OnProcessNextEvent (this=0x10eaf80, 
    thr=0xd4dba0, mayWait=<optimized out>, recursionDepth=0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/widget/xpwidgets/nsBaseAppShell.cpp:295
#68 0x00007fe926b03cc3 in ProcessNextEvent (result=0x7fffd27980cf, 
    mayWait=true, this=0xd4dba0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/threads/nsThread.cpp:610
#69 nsThread::ProcessNextEvent (this=0xd4dba0, mayWait=true, 
    result=0x7fffd27980cf)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/threads/nsThread.cpp:568
#70 0x00007fe926a9fd2c in NS_ProcessNextEvent (thread=<optimized out>, 
    mayWait=true)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/glue/nsThreadUtils.cpp:263
#71 0x00007fe926d64ec0 in mozilla::ipc::MessagePump::Run (this=0xd3cf10, 
    aDelegate=0xd4d100)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/ipc/glue/MessagePump.cpp:134
#72 0x00007fe926d4343e in MessageLoop::RunInternal (this=0xd4d100)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/ipc/chromium/src/base/message_loop.cc:226
#73 0x00007fe926d434b2 in RunHandler (this=0xd4d100)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/ipc/chromium/src/base/message_loop.cc:219
#74 MessageLoop::Run (this=0xd4d100)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/ipc/chromium/src/base/message_loop.cc:193
#75 0x00007fe92760502f in nsBaseAppShell::Run (this=0x10eaf80)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/widget/xpwidgets/nsBaseAppShell.cpp:161
#76 0x00007fe9282875da in nsAppStartup::Run (this=0x10e03c0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/components/startu---Type <return> to continue, or q <return> to quit---
p/nsAppStartup.cpp:276
#77 0x00007fe92821112f in XREMain::XRE_mainRun (this=0x7fffd2798450)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/xre/nsAppRunner.cpp:4026
#78 0x00007fe928213a34 in XREMain::XRE_main (this=0x7fffd2798450, argc=5, 
    argv=<optimized out>, aAppData=0x7fffd2798600)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/xre/nsAppRunner.cpp:4094
#79 0x00007fe928213c85 in XRE_main (argc=5, argv=0x7fffd2799968, 
    aAppData=0x7fffd2798600, aFlags=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/toolkit/xre/nsAppRunner.cpp:4334
#80 0x00000000004035bb in do_main (argc=5, argv=0x7fffd2799968, xreDirectory=
    0xc761b0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/browser/app/nsBrowserApp.cpp:280
#81 0x0000000000403a7c in main (argc=5, argv=0x7fffd2799968)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/browser/app/nsBrowserApp.cpp:648
(gdb) f 7
#7  0x00007fe926aaddf6 in nsACString_internal::SizeOfIncludingThisMustBeUnshared (this=0x7fe7c5018128, mallocSizeOf=<optimized out>)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/string/src/nsTSubstring.cpp:971
971       return mallocSizeOf(this) + SizeOfExcludingThisMustBeUnshared(mallocSizeOf);
(gdb) p *this
$1 = {
  mData = 0x7fe7c4083f28 "208.184.214.243", 
  mLength = 15, 
  mFlags = 5
}
(gdb) p this
$2 = (const nsACString_internal * const) 0x7fe7c5018128
(gdb) f 6
#6  __malloc_usable_size (m=<optimized out>) at malloc.c:3411
3411    malloc.c: No such file or directory.
(gdb) f 5
#5  mUSABLe (mem=0x7fe7c5018128) at malloc.c:4686
4686    in malloc.c


The only explanation I can come up with is that there's some sort of threading issue here, since the data look good.  But maybe I'm missing something.
Oh, and when I January 26, I mean I finished debugging the crash at Sun, 26 Jan 2014 00:55:43 -0800.  I'd launched that build at Mon Jan 13 2014 11:56:40 -0800, though, so the build dates to that date or earlier.
Attached file another crash — 
Hit it again a few minutes ago, in a build started at Sat Feb  8 15:00:23 PST 2014, built off 0d8d69a33ac2, which is my local patches on top of e931763f41b5.
Doesn't seem to be an XPCOM issue, this is something in nsDNSResolver or maybe nsDNSService. I'm a little suspicious that there is no locking in nsDNSService::SizeOfIncludingThis, although the stack doesn't seem to indicate that is the actual problem.

http://mxr.mozilla.org/mozilla-central/source/netwerk/dns/nsDNSService2.cpp#899
Component: XPCOM → Networking: DNS
Blocks: 893857
This one's my fault. In the DNS reporting added by bug 893857, I used a
SizeOfIncluding* function where I should have used a SizeOfExcluding* function.
I would expect this to crash pretty reliably when hit, so I conclude that
mBlackListedItems[] is normally empty (and some brief local testing agreed with
that.) sworkman, does that sound right?

This will need to be backported to Aurora and Beta, because bug 893857 landed
in FF28.
Attachment #8384323 - Flags: review?(sworkman)
Assignee: nobody → n.nethercote
Status: NEW → ASSIGNED
BTW, dbaron, frames #5 and #6 in comment 0 look non-standard. Was this a --disable-jemalloc build? Just curious...
Flags: needinfo?(dbaron)
Whoops, let me remove that debugging printf statement...
Attachment #8384324 - Flags: review?(sworkman)
Attachment #8384323 - Attachment is obsolete: true
Attachment #8384323 - Flags: review?(sworkman)
It's an --enable-trace-malloc build, which implicitly disables jemalloc, IIRC.
Flags: needinfo?(dbaron)
(In reply to Nicholas Nethercote [:njn] from comment #4)
> Created attachment 8384323 [details] [diff] [review]
> Fix a problem with DNS memory reporting measurement.
> 
> This one's my fault. In the DNS reporting added by bug 893857, I used a
> SizeOfIncluding* function where I should have used a SizeOfExcluding*
> function.
> I would expect this to crash pretty reliably when hit, so I conclude that
> mBlackListedItems[] is normally empty (and some brief local testing agreed
> with
> that.) sworkman, does that sound right?

That wouldn't surprise me. mBlacklistedItems should only be populated if a DNS record contains addresses that don't connect, and that shouldn't happen a whole lot.
Attachment #8384324 - Flags: review?(sworkman) → review+
Comment on attachment 8384324 [details] [diff] [review]
Fix a problem with DNS memory reporting measurement.

[Approval Request Comment]

Bug caused by (feature/regressing bug #): bug 893857

User impact if declined: occasional crashes when viewing about:memory.

Testing completed (on m-c, etc.): just landed on m-i.

Risk to taking this patch (and alternatives if risky): negligible. Patch is trivial.

String or IDL/UUID changes made by this patch: None.
Attachment #8384324 - Flags: approval-mozilla-beta?
Attachment #8384324 - Flags: approval-mozilla-aurora?
Summary: crash in about:memory calling __malloc_usable_size on apparently good data (maybe threading issue?) → Crash in about:memory calling __malloc_usable_size on apparently good data due to bug in DNS memory reporter
https://hg.mozilla.org/mozilla-central/rev/33dfbb13ab63
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
Attachment #8384324 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Comment on attachment 8384324 [details] [diff] [review]
Fix a problem with DNS memory reporting measurement.

too late for FF28 beta, will have to ride the trains from 29
Attachment #8384324 - Flags: approval-mozilla-beta? → approval-mozilla-beta-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: