Closed Bug 1449582 Opened 7 years ago Closed 2 years ago

Assertion failure: IsIdle(oldState), at /home/worker/workspace/build/src/xpcom/glue/PLDHashTable.h:132

Categories

(Core :: DOM: Core & HTML, defect, P3)

Product:
Core
Component:
DOM: Core & HTML
Version:
59 Branch
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [bugmon:confirmed])

Attachments

(1 file)

testcase
(deleted), text/html
Details
Attached file testcase (deleted) —
Testcase found while fuzzing esr52 rev d61516b059c1. rax = 0x0000000000625d50 rdx = 0x00007f9f95e83403 rcx = 0x00007f9f90f5d2dd rbx = 0x00007f9f72b373f0 rsi = 0x00007f9f9122c770 rdi = 0x00007f9f9122b540 rbp = 0x00007ffcc54fe7d0 rsp = 0x00007ffcc54fe7c0 r8 = 0x00007f9f9122c770 r9 = 0x00007f9f987e1c00 r10 = 0x0000000000000012 r11 = 0x0000000000000000 r12 = 0x00007f9f72b373f0 r13 = 0x00007ffcc54fe810 r14 = 0x0000000000000000 r15 = 0x00007f9f72b3b950 rip = 0x00007f9f92a5a0c4 OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV|0x0|0 0|0|libxul.so|Checker::StartWriteOp|hg:hg.mozilla.org/releases/mozilla-esr52:xpcom/glue/PLDHashTable.h:d61516b059c1|132|0x0 0|1|libxul.so|PLDHashTable::Remove|hg:hg.mozilla.org/releases/mozilla-esr52:xpcom/glue/PLDHashTable.cpp:d61516b059c1|36|0x5 0|2|libxul.so|nsDOMAttributeMap::DropAttribute|hg:hg.mozilla.org/releases/mozilla-esr52:xpcom/glue/nsTHashtable.h:d61516b059c1|171|0xb 0|3|libxul.so|mozilla::dom::Element::UnsetAttr|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/Element.cpp:d61516b059c1|2716|0xe 0|4|libxul.so|nsGenericHTMLElement::UnsetAttr|hg:hg.mozilla.org/releases/mozilla-esr52:dom/html/nsGenericHTMLElement.cpp:d61516b059c1|876|0x12 0|5|libxul.so|mozilla::dom::HTMLSharedElement::UnsetAttr|hg:hg.mozilla.org/releases/mozilla-esr52:dom/html/HTMLSharedElement.cpp:d61516b059c1|263|0x5 0|6|libxul.so|nsDOMAttributeMap::BlastSubtreeToPieces|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsDocument.cpp:d61516b059c1|7187|0xf 0|7|libxul.so|nsDOMAttributeMap::BlastSubtreeToPieces|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsDocument.cpp:d61516b059c1|7197|0x5 0|8|libxul.so|nsIDocument::AdoptNode|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsDocument.cpp:d61516b059c1|7357|0x8 0|9|libxul.so|nsDocument::AdoptNode|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsDocument.cpp:d61516b059c1|7211|0x16 0|10|libxul.so|AdoptNodeIntoOwnerDoc|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsINode.cpp:d61516b059c1|1539|0x14 0|11|libxul.so|nsINode::ReplaceOrInsertBefore|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsINode.cpp:d61516b059c1|2427|0xf 0|12|libxul.so|mozilla::dom::NodeBinding::appendChild|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/nsINode.h:d61516b059c1|1850|0x12 0|13|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/releases/mozilla-esr52:dom/bindings/BindingUtils.cpp:d61516b059c1|2904|0x9 0|14|libxul.so|js::CallJSNative|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jscntxtinlines.h:d61516b059c1|239|0x9 0|15|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Interpreter.cpp:d61516b059c1|459|0xf 0|16|libxul.so|js::jit::DoCallFallback|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/BaselineIC.cpp:d61516b059c1|6020|0x13 0|17|||||0x32c1806a7111 0|18|||||0x7f9f72bc32f8 0|19|libxul.so|js::jit::IonCannon|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/Ion.cpp:d61516b059c1|2855|0x3a 0|20|libxul.so||||0x3550880 0|21|libnspr4.so|PR_SetThreadPrivate|hg:hg.mozilla.org/releases/mozilla-esr52:nsprpub/pr/src/threads/prtpd.c:d61516b059c1|187|0x13 0|22|libxul.so|NS_LogAddRef|hg:hg.mozilla.org/releases/mozilla-esr52:xpcom/base/nsTraceRefcnt.cpp:d61516b059c1|1016|0x5 0|23|libxul.so||||0x3b06f30 0|24|libxul.so|_fini|||0x1d1c7b0 0|25|libxul.so|mozilla::dom::ScriptSettingsStack::Push|hg:hg.mozilla.org/releases/mozilla-esr52:mfbt/ThreadLocal.h:d61516b059c1|198|0xc 0|26|libxul.so|mozilla::dom::AutoJSAPI::InitInternal|hg:hg.mozilla.org/releases/mozilla-esr52:dom/base/ScriptSettings.cpp:d61516b059c1|368|0x5 0|27|libxul.so|_fini|||0x1d1cb98 0|28|libxul.so|js::ThisThread::GetId|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/threading/posix/Thread.cpp:d61516b059c1|134|0x5 0|29|libxul.so|js::CurrentThreadCanAccessRuntime|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Runtime.cpp:d61516b059c1|896|0x1d 0|30|libxul.so|js::jit::OptimizationInfo::compilerWarmUpThreshold|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/Ion.h:d61516b059c1|199|0x8 0|31|libxul.so|js::jit::OptimizationLevelInfo::levelForScript|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/IonOptimizationLevels.cpp:d61516b059c1|168|0x5 0|32|libxul.so|js::jit::Compile|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/Ion.cpp:d61516b059c1|2465|0x10 0|33|libxul.so|JS::Value::toObject|hg:hg.mozilla.org/releases/mozilla-esr52:js/public/Value.h:d61516b059c1|657|0x5 0|34|libxul.so|js::jit::CanEnter|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jit/Ion.cpp:d61516b059c1|2602|0xb 0|35|libxul.so|js::RunScript|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Interpreter.cpp:d61516b059c1|385|0xb 0|36|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/releases/mozilla-esr52:nsprpub/pr/src/threads/prtpd.c:d61516b059c1|204|0x5 0|37|libxul.so|mozilla::dom::Event::QueryInterface|hg:hg.mozilla.org/releases/mozilla-esr52:dom/events/Event.cpp:d61516b059c1|139|0xf 0|38|libxul.so|mozilla::dom::MutationEvent::QueryInterface|hg:hg.mozilla.org/releases/mozilla-esr52:dom/events/MutationEvent.cpp:d61516b059c1|25|0x5 0|39|libxul.so|mozilla::Vector<JS::Value, 8ul, js::TempAllocPolicy>::~Vector|hg:hg.mozilla.org/releases/mozilla-esr52:mfbt/ReentrancyGuard.h:d61516b059c1|44|0x5 0|40|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Interpreter.cpp:d61516b059c1|477|0xb 0|41|libxul.so|_fini|||0x1d08ed8 0|42|libxul.so|js::Call|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/vm/Interpreter.cpp:d61516b059c1|523|0x5 0|43|libxul.so|JS::Call|hg:hg.mozilla.org/releases/mozilla-esr52:js/src/jsapi.cpp:d61516b059c1|2828|0x20 0|44|libxul.so|mozilla::net::RequestContext::RemoveBlockingTransaction|hg:hg.mozilla.org/releases/mozilla-esr52:netwerk/base/RequestContextService.cpp:d61516b059c1|74|0x3 0|45|libxul.so|mozilla::dom::EventListener::HandleEvent|hg:hg.mozilla.org/releases/mozilla-esr52:obj-firefox/dom/bindings/EventListenerBinding.cpp:d61516b059c1|48|0xc 0|46|libxul.so|mozilla::net::RequestContext::RemoveBlockingTransaction|hg:hg.mozilla.org/releases/mozilla-esr52:netwerk/base/RequestContextService.cpp:d61516b059c1|74|0x3 0|47|libxul.so|JS::Value::toObject|hg:hg.mozilla.org/releases/mozilla-esr52:js/public/Value.h:d61516b059c1|657|0x5 0|48|libxul.so|mozilla::dom::TryToOuterize|hg:hg.mozilla.org/releases/mozilla-esr52:dom/bindings/BindingUtils.h:d61516b059c1|943|0x8 0|49|libxul.so|mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>|hg:hg.mozilla.org/releases/mozilla-esr52:obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:d61516b059c1|64|0x1c 0|50|libxul.so|RefPtr<xpc::ErrorReport>::~RefPtr|hg:hg.mozilla.org/releases/mozilla-esr52:mfbt/RefPtr.h:d61516b059c1|80|0x2
Flags: in-testsuite?
That stack has a lot of weird stuff going on.
Component: XPCOM → DOM

Here is another stack: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=220616366&repo=try&lineNumber=1137

08:25:03 INFO - GECKO(809) | Assertion failure: IsIdle(oldState), at /builds/worker/workspace/build/src/xpcom/ds/PLDHashTable.h:137
08:26:38 INFO - GECKO(809) | #01: <name omitted> [xpcom/ds/PLDHashTable.cpp:572]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #02: mozilla::dom::TabGroup::AddDocument(nsTSubstring<char> const&, nsIDocument*) [dom/base/TabGroup.cpp:143]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #03: nsIDocument::SetScopeObject(nsIGlobalObject*) [mfbt/AlreadyAddRefed.h:145]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #04: nsIDocument::SetScriptGlobalObject(nsIScriptGlobalObject*) [dom/base/nsDocument.cpp:4423]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #05: nsGlobalWindowOuter::SetNewDocument(nsIDocument*, nsISupports*, bool) [dom/base/nsGlobalWindowOuter.cpp:1895]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #06: nsDocumentViewer::InitInternal(nsIWidget*, nsISupports*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, bool, bool) [layout/base/nsDocumentViewer.cpp:970]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #07: nsDocumentViewer::Init(nsIWidget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) [layout/base/nsDocumentViewer.cpp:716]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #08: nsDocShell::SetupNewViewer(nsIContentViewer*) [docshell/base/nsDocShell.cpp:8451]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #09: nsDocShell::Embed(nsIContentViewer*, char const*, nsISupports*) [docshell/base/nsDocShell.cpp:6346]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #10: nsDocShell::CreateAboutBlankContentViewer(nsIPrincipal*, nsIURI*, bool, bool) [docshell/base/nsDocShell.cpp:7197]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #11: nsDocShell::EnsureContentViewer() [xpcom/base/nsCOMPtr.h:839]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #12: nsDocShell::GetDocument(nsIDocument**) [docshell/base/nsDocShell.cpp:4745]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #13: nsDOMWindowList::EnsureFresh() [xpcom/base/nsCOMPtr.h:823]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #14: nsDOMWindowList::GetLength() [dom/base/nsDOMWindowList.cpp:46]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #15: mozilla::GetTabSizes(nsGlobalWindowOuter*, nsTabSizes*) [toolkit/components/perfmonitoring/PerformanceUtils.cpp:75]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #16: mozilla::GetTabSizes(nsGlobalWindowOuter*, nsTabSizes*) [toolkit/components/perfmonitoring/PerformanceUtils.cpp:0]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #17: mozilla::CollectMemoryInfo(nsCOMPtr<nsPIDOMWindowOuter> const&, RefPtr<mozilla::AbstractThread> const&) [toolkit/components/perfmonitoring/PerformanceUtils.cpp:91]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #18: mozilla::dom::DocGroup::ReportPerformanceInfo() [mfbt/RefPtr.h:296]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #19: mozilla::CollectPerformanceInfo() [xpcom/ds/nsTArray.h:344]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #20: mozilla::dom::ContentChild::RecvRequestPerformanceMetrics(nsID const&) [dom/ipc/ContentChild.cpp:0]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #21: mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) [ipc/glue/ProtocolUtils.h:375]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #22: mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) [ipc/glue/MessageChannel.h:650]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #23: mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) [ipc/glue/MessageChannel.cpp:2086]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #24: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) [ipc/glue/MessageChannel.cpp:0]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #25: mozilla::ipc::MessageChannel::MessageTask::Run() [xpcom/threads/Monitor.h:33]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #26: nsThread::ProcessNextEvent(bool, bool*) [xpcom/threads/nsThread.cpp:1144]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #27: NS_ProcessNextEvent(nsIThread*, bool) [xpcom/threads/nsThreadUtils.cpp:468]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #28: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [ipc/glue/MessagePump.cpp:86]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #29: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:583]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #30: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:139]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #31: nsAppShell::Run() [widget/cocoa/nsAppShell.mm:745]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #32: XRE_RunAppShell() [toolkit/xre/nsEmbedFunctions.cpp:915]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #33: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [ipc/glue/MessagePump.cpp:238]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #34: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:583]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #35: XRE_InitChildProcess(int, char**, XREChildData const*) [toolkit/xre/nsEmbedFunctions.cpp:757]
08:26:38 INFO -
08:26:38 INFO - GECKO(809) | #36: main [ipc/contentproc/plugin-container.cpp:49]

Do we really want GetLength() to create an empty document (via EnsureFresh) ?

https://searchfox.org/mozilla-central/source/dom/base/nsDOMWindowList.cpp#44

The goal of GetLength() is to get the size of the list so if it's empty maybe we could avoid creating a document?
OTHO this logic has been there for ages so I am not sure what is the appropriate fix.

but we should avoid creating new documents just when we want to count the existing ones

adding Baku for advice

Flags: needinfo?(amarchesini)

The issue here is that we write into the hashtable while reading. The reading happens here:

https://searchfox.org/mozilla-central/rev/c43240cef5829b8a2dec118faff8a5e1fec6ae1b/toolkit/components/perfmonitoring/PerformanceUtils.cpp#47-49

https://searchfox.org/mozilla-central/rev/c43240cef5829b8a2dec118faff8a5e1fec6ae1b/dom/base/TabGroup.cpp#141

It's not trivial to know if we can remove the nsDOMWindowList::EnsureFresh() call in nsDOMWindowList::GetLength().
An easy fix is to change PerformanceUtils.cpp to create an array of nsTArray<RefPtr> docGroups (or raw pointers) and use them out of the iterator.

Flags: needinfo?(amarchesini)

Thanks a lot Andrea for the investigation ! I will work on a patch

Assignee: nobody → tarek

Will work on Bug 1519861 since this one is the same kind of failure but unrelated to the one triggered by about:performance

Assignee: tarek → nobody

Sorry, I meant bug 1519038

Component: DOM → DOM: Core & HTML

FWIW, looks like this bug contains many different cases when IsIdle(oldState) is triggered. Those can be totally unrelated.

Attachment #8963130 - Attachment description: trigger.html → testcase

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20210224100119-b3eb91f0b5a7
mozilla-central 20200226092757-7f41334e1044

Whiteboard: [bugmon:confirmed]

I couldn't reproduce this locally.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: