998097 - [OPEN C] crash in DBState::AddRef()

Status: VERIFIED FIXED

(Core :: DOM: Device Interfaces, defect)

Description

[Marcia Knous [:marcia]]

https://crash-stats.mozilla.com/report/index/6418b804-5920-43f2-832d-029942140417

Seen on Open C using:

Gaia   dadf0e60a6421f5b57ee9fc536c6617212805c19
SourceStamp c55dfb01a027
BuildID 20140417040206
Version 31.0a1

STR:
1. Not sure, but it seems when the device goes idle and the screen sleeps, this crash happens for me.

Will try to get better STR but has happened twice.

Frame 	Module 	Signature 	Source
0 	libxul.so 	DBState::AddRef() 	netwerk/cookie/nsCookieService.h
1 	libxul.so 	DeviceStorageUsedSpaceCache::GetCacheEntry(nsAString_internal const&) 	/builds/slave/b2g_m-cen_flame_ntly-000000000/build/objdir-gecko/dom/devicestorage/../../dist/include/nsAutoPtr.h
2 	libxul.so 	DeviceStorageUsedSpaceCache::InvalidateRunnable::Run() 	dom/devicestorage/nsDeviceStorage.h
3 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
4 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
5 	libxul.so 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
6 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
7 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
8 	libxul.so 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp
9 	libnss3.so 	_pt_root 	nsprpub/pr/src/pthreads/ptthread.c
10 	libc.so 	libc.so@0xcb62 	
11 	libc.so 	libc.so@0xccde

Comment 1

[Jason Smith [:jsmith]]

Dave - Any ideas?

Comment 2

[Marcia Knous [:marcia]]

Better STR using today's build on the Open C:

1. Have USB storage on. I have the Device Storage set to use the SD Card and not the internal storage.
2. Attach the device to the computer using a USB cable.
3. Pull the USB cable out and attempt to swipe up the screen.
4. Crash

The second half of Step 3 is probably not always necessary.

Comment 3

[Jason Smith [:jsmith]]

Using comment 2's STR, can we check if this happens on 1.4?

Comment 4

[Jason Smith [:jsmith]]

(In reply to Jason Smith [:jsmith] from comment #3)
> Using comment 2's STR, can we check if this happens on 1.4?

Specifically with an Open C device on 1.4.

Comment 5

[Dave Hylands [:dhylands]]

This looks similar to bug 997242, but its not the same reference count.

I'll have a look at the UsedSpace cache and see if there is a something that needs to be marked as threadsafe.

Comment 6

[Dave Hylands [:dhylands]]

STR:

- Launch DS Test
- Choose "Used Space" from the command drop down
- Touch "Do It"
- wait 45 seconds
- Touch "Do It" again

Comment 7

[Dave Hylands [:dhylands]]

Attachment: Make DeviceStorageFileDescriptor use threadsafe reference count

This patch makes DeviceStorageUsedSpaceCache use a threadsafe reference count since the OS threads used by LazyIdleThread can change from time to time, thus triggering the failure reported in this bug.

Comment 8

[Jason Smith [:jsmith]]

Did you actually reproduce the crash on 1.4?

Comment 9

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Oh oops.  I looked at the report log wrong for this crash 2.0/1.5; not 1.4

Comment 10

[Dave Hylands [:dhylands]]

https://hg.mozilla.org/integration/b2g-inbound/rev/395976994a92

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/395976994a92

Comment 13

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Crashes stop on the 23rd.  Looks like Dave nailed it.