992853 - 1.3T DEBUG build unable to fork any process

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Kan-Ru Chen [:kanru] (UTC+9)]

Crash when trying to launch browser. The code in question looks different in 1.3t and central. Maybe a rebase error?

Program received signal SIGSEGV, Segmentation fault.
nsCOMPtr (this=0x468c12a4, aRawPtr=0x1d8) at ../../dist/include/nsCOMPtr.h:900
900                 NSCAP_ADDREF(this, mRawPtr);
(gdb) bt
#0  nsCOMPtr (this=0x468c12a4, aRawPtr=0x1d8) at ../../dist/include/nsCOMPtr.h:900
#1  0x40caddb0 in ObserverRef (this=0x475c82a0, anObserver=0x1d8, ownsWeak=false) at /home/kanru/zone2/mozilla/B2G/gecko/xpcom/ds/nsObserverList.h:28
#2  Construct<nsIObserver*> (this=0x475c82a0, anObserver=0x1d8, ownsWeak=false) at ../../dist/include/nsTArray.h:527
#3  implementation<nsIObserver*, ObserverRef, unsigned int, unsigned int> (this=0x475c82a0, anObserver=0x1d8, ownsWeak=false) at ../../dist/include/nsTArray.h:558
#4  AssignRange<nsIObserver*> (this=0x475c82a0, anObserver=0x1d8, ownsWeak=false) at ../../dist/include/nsTArray.h:1591
#5  AppendElements<nsIObserver*> (this=0x475c82a0, anObserver=0x1d8, ownsWeak=false) at ../../dist/include/nsTArray.h:1234
#6  AppendElement<nsIObserver*> (this=0x475c82a0, anObserver=0x1d8, ownsWeak=false) at ../../dist/include/nsTArray.h:1248
#7  nsObserverList::AddObserver (this=0x475c82a0, anObserver=0x1d8, ownsWeak=false) at /home/kanru/zone2/mozilla/B2G/gecko/xpcom/ds/nsObserverList.cpp:19
#8  0x40caedb2 in nsObserverService::AddObserver (this=0x40498580, anObserver=0x1d8, aTopic=0x42612558 "xpcom-shutdown", ownsWeak=false) at /home/kanru/zone2/mozilla/B2G/gecko/xpcom/ds/nsObserverService.cpp:252
#9  0x41386610 in mozilla::dom::ContentParent::Init (this=0x0) at /home/kanru/zone2/mozilla/B2G/gecko/dom/ipc/ContentParent.cpp:694
#10 0x41387904 in mozilla::dom::ContentParent::GetNewOrUsed (aForBrowserElement=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/dom/ipc/ContentParent.cpp:449
#11 0x413884be in mozilla::dom::ContentParent::CreateBrowserOrApp (aContext=..., aFrameElement=0x465820f0) at /home/kanru/zone2/mozilla/B2G/gecko/dom/ipc/ContentParent.cpp:527
#12 0x416a77bc in nsFrameLoader::TryRemoteBrowser (this=0x468d3400) at /home/kanru/zone2/mozilla/B2G/gecko/content/base/src/nsFrameLoader.cpp:2099
#13 0x416ab312 in nsFrameLoader::ReallyStartLoadingInternal (this=0x468d3400) at /home/kanru/zone2/mozilla/B2G/gecko/content/base/src/nsFrameLoader.cpp:478
#14 0x416ab394 in nsFrameLoader::ReallyStartLoading (this=0x40498580) at /home/kanru/zone2/mozilla/B2G/gecko/content/base/src/nsFrameLoader.cpp:409
#15 0x4163b73e in nsDocument::MaybeInitializeFinalizeFrameLoaders (this=0x46e6d000) at /home/kanru/zone2/mozilla/B2G/gecko/content/base/src/nsDocument.cpp:6366
#16 0x4163b820 in nsDocument::EndUpdate (this=0x46e6d000, aUpdateType=1) at /home/kanru/zone2/mozilla/B2G/gecko/content/base/src/nsDocument.cpp:4539
#17 0x417ba3de in nsHTMLDocument::EndUpdate (this=0x40498580, aUpdateType=472) at /home/kanru/zone2/mozilla/B2G/gecko/content/html/document/src/nsHTMLDocument.cpp:2399
#18 0x416304e2 in ~mozAutoDocUpdate (this=0xbefa023c, __in_chrg=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/content/base/src/mozAutoDocUpdate.h:38
#19 0x416bc502 in nsINode::ReplaceOrInsertBefore (this=0x468f4460, aReplace=<value optimized out>, aNewChild=0x465820f0, aRefChild=0x4166d519, aError=...) at /home/kanru/zone2/mozilla/B2G/gecko/content/base/src/nsINode.cpp:2109
#20 0x4123ead4 in nsINode::InsertBefore (cx=0x444db110, obj=..., self=0x468f4460, args=...) at ../../dist/include/nsINode.h:1539
#21 nsINode::AppendChild (cx=0x444db110, obj=..., self=0x468f4460, args=...) at ../../dist/include/nsINode.h:1543
#22 appendChild (cx=0x444db110, obj=..., self=0x468f4460, args=...) at /home/kanru/zone2/mozilla/B2G/objdir-gecko-gecko-debug/dom/bindings/NodeBinding.cpp:592
#23 0x41236f7a in genericMethod (cx=0x444db110, argc=<value optimized out>, vp=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/objdir-gecko-gecko-debug/dom/bindings/NodeBinding.cpp:1412
#24 0x422d2e94 in js::CallJSNative (cx=0x444db110, native=0x41236ec1 <genericMethod>, args=...) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/jscntxtinlines.h:220
#25 0x422e66ba in js::Invoke (cx=0x444db110, args=..., construct=js::NO_CONSTRUCT) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:463
#26 0x422d9f78 in Interpret (cx=0x444db110, state=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:2511
#27 0x422e5fc6 in js::RunScript (cx=0x444db110, state=...) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:420
#28 0x422e6650 in js::Invoke (cx=0x444db110, args=..., construct=js::NO_CONSTRUCT) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:482
#29 0x421dd912 in js::CallOrConstructBoundFunction (cx=0x444db110, argc=<value optimized out>, vp=0x444df050) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/jsfun.cpp:1274
#30 0x422d2e94 in js::CallJSNative (cx=0x444db110, native=0x421dd6bd <js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/jscntxtinlines.h:220
#31 0x422e66ba in js::Invoke (cx=0x444db110, args=..., construct=js::NO_CONSTRUCT) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:463
#32 0x422d9f78 in Interpret (cx=0x444db110, state=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:2511
#33 0x422e5fc6 in js::RunScript (cx=0x444db110, state=...) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:420
#34 0x422e6650 in js::Invoke (cx=0x444db110, args=..., construct=js::NO_CONSTRUCT) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:482
#35 0x421dd912 in js::CallOrConstructBoundFunction (cx=0x444db110, argc=<value optimized out>, vp=0xbefa1e38) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/jsfun.cpp:1274
#36 0x422d2e94 in js::CallJSNative (cx=0x444db110, native=0x421dd6bd <js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/jscntxtinlines.h:220
#37 0x422e66ba in js::Invoke (cx=0x444db110, args=..., construct=js::NO_CONSTRUCT) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:463
#38 0x422e6d06 in js::Invoke (cx=0x444db110, thisv=..., fval=..., argc=1, argv=0xbefa1f98, rval=...) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/vm/Interpreter.cpp:519
#39 0x421a9b76 in JS_CallFunctionValue (cx=0x444db110, objArg=<value optimized out>, fval=..., argc=1, argv=0xbefa1f98, rval=0xbefa2020) at /home/kanru/zone2/mozilla/B2G/gecko/js/src/jsapi.cpp:5014
#40 0x411799ec in mozilla::dom::EventHandlerNonNull::Call (this=0x465f8270, cx=0x444db110, aThisObj=..., event=..., aRv=...) at /home/kanru/zone2/mozilla/B2G/objdir-gecko-gecko-debug/dom/bindings/EventHandlerBinding.cpp:35
#41 0x4155c748 in Call<nsISupports*> (this=0x4717e240, aEvent=0x452bfdc0) at ../../../dist/include/mozilla/dom/EventHandlerBinding.h:60
#42 nsJSEventListener::HandleEvent (this=0x4717e240, aEvent=0x452bfdc0) at /home/kanru/zone2/mozilla/B2G/gecko/dom/src/events/nsJSEventListener.cpp:238
#43 0x41749458 in nsEventListenerManager::HandleEventSubType (this=0x46828e80, aListenerStruct=<value optimized out>, aDOMEvent=0x452bfdc0, aCurrentTarget=0x45ba6800, aPusher=0xbefa24e8)
    at /home/kanru/zone2/mozilla/B2G/gecko/content/events/src/nsEventListenerManager.cpp:930
#44 0x41749674 in nsEventListenerManager::HandleEventInternal (this=0x46828e80, aPresContext=<value optimized out>, aEvent=0x46870d80, aDOMEvent=0xbefa2554, aCurrentTarget=0x45ba6800, aEventStatus=0xbefa2558, aPusher=0xbefa24e8)
    at /home/kanru/zone2/mozilla/B2G/gecko/content/events/src/nsEventListenerManager.cpp:1007
#45 0x4174674a in nsEventListenerManager::HandleEvent (this=<value optimized out>, aVisitor=..., aCd=<value optimized out>, aPusher=0xbefa24e8) at /home/kanru/zone2/mozilla/B2G/gecko/content/events/src/nsEventListenerManager.h:326
#46 nsEventTargetChainItem::HandleEvent (this=<value optimized out>, aVisitor=..., aCd=<value optimized out>, aPusher=0xbefa24e8) at /home/kanru/zone2/mozilla/B2G/gecko/content/events/src/nsEventDispatcher.cpp:197
#47 0x4174689e in nsEventTargetChainItem::HandleEventTargetChain (aChain=..., aVisitor=..., aCallback=0x0, aCd=..., aPusher=0xbefa24e8) at /home/kanru/zone2/mozilla/B2G/gecko/content/events/src/nsEventDispatcher.cpp:292
#48 0x417477b6 in nsEventDispatcher::Dispatch (aTarget=<value optimized out>, aPresContext=0x0, aEvent=0x46870d80, aDOMEvent=<value optimized out>, aEventStatus=0xbefa25f4, aCallback=0x0, aTargets=0x0)
    at /home/kanru/zone2/mozilla/B2G/gecko/content/events/src/nsEventDispatcher.cpp:609
#49 0x4174796e in nsEventDispatcher::DispatchDOMEvent (aTarget=0x45ba6800, aEvent=0x46870d80, aDOMEvent=0x452bfdc0, aPresContext=0x0, aEventStatus=0xbefa25f4)
    at /home/kanru/zone2/mozilla/B2G/gecko/content/events/src/nsEventDispatcher.cpp:676
#50 0x414e9258 in nsWindowRoot::DispatchEvent (this=<value optimized out>, aEvt=<value optimized out>, aRetVal=0xbefa261f) at /home/kanru/zone2/mozilla/B2G/gecko/dom/base/nsWindowRoot.cpp:80
#51 0x415b0752 in mozilla::dom::indexedDB::OpenDatabaseHelper::DispatchSuccessEvent (this=0x46801160) at /home/kanru/zone2/mozilla/B2G/gecko/dom/indexedDB/OpenDatabaseHelper.cpp:2474
#52 0x415b7bf6 in mozilla::dom::indexedDB::OpenDatabaseHelper::Run (this=0x46801160) at /home/kanru/zone2/mozilla/B2G/gecko/dom/indexedDB/OpenDatabaseHelper.cpp:2277
#53 0x40cd4b4c in nsThread::ProcessNextEvent (this=0x40403550, mayWait=<value optimized out>, result=0xbefa26cf) at /home/kanru/zone2/mozilla/B2G/gecko/xpcom/threads/nsThread.cpp:612
#54 0x40c89a00 in NS_ProcessNextEvent (thread=0x40403550, mayWait=false) at /home/kanru/zone2/mozilla/B2G/gecko/xpcom/glue/nsThreadUtils.cpp:263
#55 0x40e85320 in mozilla::ipc::MessagePump::Run (this=0x40402d90, aDelegate=0x4044d0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/glue/MessagePump.cpp:85
#56 0x40e76912 in MessageLoop::RunInternal (this=0x4044d0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:222
#57 0x40e7692a in MessageLoop::RunHandler (this=0x4044d0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:215
#58 MessageLoop::Run (this=0x4044d0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:189
#59 0x413c0992 in nsBaseAppShell::Run (this=0x444c7ac0) at /home/kanru/zone2/mozilla/B2G/gecko/widget/xpwidgets/nsBaseAppShell.cpp:161
#60 0x41d93aa4 in nsAppStartup::Run (this=0x4445bf70) at /home/kanru/zone2/mozilla/B2G/gecko/toolkit/components/startup/nsAppStartup.cpp:276
#61 0x41d5e3d8 in XREMain::XRE_mainRun (this=0xbefa29b4) at /home/kanru/zone2/mozilla/B2G/gecko/toolkit/xre/nsAppRunner.cpp:4059
#62 0x41d6177a in XREMain::XRE_main (this=0xbefa29b4, argc=<value optimized out>, argv=<value optimized out>, aAppData=0x22170) at /home/kanru/zone2/mozilla/B2G/gecko/toolkit/xre/nsAppRunner.cpp:4127
#63 0x41d61914 in XRE_main (argc=1, argv=0xbefa4ba4, aAppData=0x22170, aFlags=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/toolkit/xre/nsAppRunner.cpp:4337
#64 0x00009a44 in do_main (argc=1, argv=0xbefa4ba4) at /home/kanru/zone2/mozilla/B2G/gecko/b2g/app/nsBrowserApp.cpp:163
#65 main (argc=1, argv=0xbefa4ba4) at /home/kanru/zone2/mozilla/B2G/gecko/b2g/app/nsBrowserApp.cpp:256

Comment 1

[Evelyn Hung]

nominate 1.3t? first for triage.

Comment 2

[Cervantes Yu [:cyu] [:cervantes]]

Attachment: Fix the rebase error in bug 968604

This fixes the crash when MOZ_NUWA_PROCESS is on but "dom.ipc.processPrelaunch.enabled" is false and we Init() a nullptr.

Comment 3

[Joe Cheng [:jcheng] (please needinfo)]

triagE: 1.3T+ for regression

Comment 4

[Cervantes Yu [:cyu] [:cervantes]]

https://hg.mozilla.org/releases/mozilla-b2g28_v1_3t/rev/e4459c913023