Assertion failure: timeout->mFiringIndex > mLastFiringIndex, at zdom/base/TimeoutManager.cpp:938
Categories
(Core :: DOM: Core & HTML, defect, P2)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr60 | --- | unaffected |
firefox65 | --- | unaffected |
firefox66 | --- | fix-optional |
firefox67 | --- | fix-optional |
firefox68 | --- | fix-optional |
People
(Reporter: bc, Assigned: jesup)
References
Details
(Keywords: assertion)
Attachments
(1 file)
(deleted),
patch
|
ehsan.akhgari
:
review+
|
Details | Diff | Splinter Review |
-
private url.
Assertion failure: timeout->mFiringIndex > mLastFiringIndex, at z:/build/build/src/dom/base/TimeoutManager.cpp:938
#01: mozilla::dom::TimeoutExecutor::Run() [dom/base/TimeoutExecutor.cpp:233]
#02: IdleRunnableWrapper::Run() [xpcom/threads/nsThreadUtils.cpp:319]
#03: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1149]
#04: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:474]
#05: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:88]
#06: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:309]
#07: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:291]
#08: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:139]
#09: nsAppShell::Run() [widget/windows/nsAppShell.cpp:411]
#10: XRE_RunAppShell() [toolkit/xre/nsEmbedFunctions.cpp:908]
#11: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:238]
#12: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:309]
#13: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:291]
#14: XRE_InitChildProcess(int,char * * const,XREChildData const *) [toolkit/xre/nsEmbedFunctions.cpp:750]
#15: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:265]
#16: wmain [toolkit/xre/nsWindowsWMain.cpp:129]
#17: static int __scrt_common_main_seh() [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:288]
#18: KERNEL32.DLL + 0x13dc4
#19: ntdll.dll + 0x73691
Windows and Linux Nightly 67 at least.
Bughunter has seen this on two urls on a video sharing site. One was NSFW and the other was a copyrighted movie so I won't share them here. I'll keep an eye out for better urls but hopefully you can figure it out without them.
Comment 1•6 years ago
|
||
Is this a regression? Bug 1270059 changed this code quite a bit.
Updated•6 years ago
|
Reporter | ||
Comment 2•6 years ago
|
||
Not sure. I wasn't able to reproduce this time on Fedora, Ubuntu or Windows 10. I'll try again later.
Reporter | ||
Comment 3•6 years ago
|
||
After reproducing a couple of times on Ubuntu, I am once again unable to reproduce. The movie url has been taken down. I've set up a reload loop using Nightly to see if it will eventually assert. If I can do that, I'll try with Beta. I've also loaded 204 other mp4 urls from this site that Bughunter has tested in the past to see if this is reproducible elsewhere.
Reporter | ||
Comment 4•6 years ago
|
||
Another stack with this assertion:
Assertion failure: timeout->mFiringIndex > mLastFiringIndex, at z:/build/build/src/dom/base/TimeoutManager.cpp:938
#01: mozilla::dom::TimeoutExecutor::Notify(nsITimer *) [dom/base/TimeoutExecutor.cpp:243]
#02: nsTimerImpl::Fire(int) [xpcom/threads/nsTimerImpl.cpp:571]
#03: nsTimerEvent::Run() [xpcom/threads/TimerThread.cpp:260]
#04: mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() [xpcom/threads/ThrottledEventQueue.cpp:231]
#05: mozilla::ThrottledEventQueue::Inner::Executor::Run() [xpcom/threads/ThrottledEventQueue.cpp:77]
#06: mozilla::SchedulerGroup::Runnable::Run() [xpcom/threads/SchedulerGroup.cpp:292]
#07: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1149]
#08: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:474]
#09: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:88]
#10: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:309]
Reporter | ||
Comment 5•6 years ago
|
||
While the re-test found many examples of the assertion, attempting to reliably reproduce them manually was not possible. Ping me on irc @ bc if you need more information.
Comment 6•6 years ago
|
||
Hi Randell, since you added the assertion there, I'm thinking you may like to take a look.
Updated•6 years ago
|
Assignee | ||
Updated•6 years ago
|
Assignee | ||
Comment 7•6 years ago
|
||
I can finally (2700 runs this last time) repro. Seems to only happen on a multiple of 1 hour since content process startup.... it may just be a bug in the firing order assertion.
Assignee | ||
Comment 8•6 years ago
|
||
Updated•6 years ago
|
Comment 9•6 years ago
|
||
Comment 10•6 years ago
|
||
Comment 11•6 years ago
|
||
Backed out changeset 93b9c2a8212b (bug 1527414) for causing build bustages on TimeoutManager.cpp CLOSED TREE
Backout revision https://hg.mozilla.org/integration/mozilla-inbound/rev/e2a84fa236ea306b025f92be208b794470f68333
Failure logs https://treeherder.mozilla.org/logviewer.html#?job_id=229495197&repo=mozilla-inbound
https://treeherder.mozilla.org/logviewer.html#?job_id=229495176&repo=mozilla-inbound
:jesup could you please take a look?
Comment 12•6 years ago
|
||
Comment 13•6 years ago
|
||
bugherder |
Assignee | ||
Comment 14•6 years ago
|
||
This is a link that should show if we get any Nightly assertions after the fix is in:
https://crash-stats.mozilla.com/signature/?product=Firefox&build_id=%3E20190221000000&version=67.0a1&signature=mozilla%3A%3Adom%3A%3ATimeoutManager%3A%3ARunTimeout&date=%3E%3D2019-02-14T16%3A19%3A00.000Z&date=%3C2019-02-21T16%3A19%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-date&page=1#reports
Reporter | ||
Comment 15•6 years ago
|
||
Bughunter has hit this on Windows and Linux on a url to a copyrighted movie on the original site where we first reproduced. So far just one url has reproduced. I haven't reproduced yet locally.
mozversion INFO | application_buildid: 20190223041557
mozversion INFO | application_changeset: 6924dd16f7b1e2e6ce71a8eb4cbe330d3e4745dc
Assertion failure: timeout->mFiringIndex > mLastFiringIndex, at z:/build/build/src/dom/base/TimeoutManager.cpp:976
#01: mozilla::dom::TimeoutExecutor::Run() [dom/base/TimeoutExecutor.cpp:233]
#02: IdleRunnableWrapper::Run() [xpcom/threads/nsThreadUtils.cpp:319]
jesup: ping me?
Assignee | ||
Comment 16•6 years ago
|
||
Definitely interested... no hits from the wild in the search above since the landing after updating the dates; the search really should be more like:
Assignee | ||
Comment 17•6 years ago
|
||
Ah, linkers.... the signature is coming in under TimeoutExecutor (due to inlining):
Still getting hits after landing this fix; reopening and trying to repro again. I may back this off ASAP since I don't think the URLs are helping us much.
Updated•6 years ago
|
Assignee | ||
Comment 18•6 years ago
|
||
I've caught it in a local test again (after 1600 runs); it appears to be another case where nested event loops mess up the assertion code, but it does not look like a violation of spec.
Backing out the DIAGNOSTIC back down to DEBUG with r=smaug (and may well just disable entirely after more analysis).
Comment 19•6 years ago
|
||
Comment 20•6 years ago
|
||
bugherder |
Updated•6 years ago
|
Comment 21•5 years ago
|
||
hi jesup, any update on this one? (tracking for 68)
Assignee | ||
Comment 22•5 years ago
|
||
This is DEBUG-only, and it almost certainly a bug in the assertion, not in the functionality.
Comment 23•5 years ago
|
||
The leave-open keyword is there and there is no activity for 6 months.
:jesup, maybe it's time to close this bug?
Comment 24•4 years ago
|
||
The leave-open keyword is there and there is no activity for 6 months.
:jesup, maybe it's time to close this bug?
Assignee | ||
Updated•4 years ago
|
Comment 25•4 years ago
|
||
The leave-open keyword is there and there is no activity for 6 months.
:jesup, maybe it's time to close this bug?
Comment 26•3 years ago
|
||
The leave-open keyword is there and there is no activity for 6 months.
:jesup, maybe it's time to close this bug?
Assignee | ||
Updated•3 years ago
|
Reporter | ||
Comment 27•3 years ago
|
||
no way to reproduce any more. let's close it.
Updated•3 years ago
|
Description
•