10105 - [CRASH]crash in when visiting url

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[Chris Booton]

Using build #199907181999

Go to http://www.microsoft.com/downloads/default.asp and select the appropriate
options on the form that appears and submit.

What happened: As it started to load the new page I got a crash in xpcom.dll as
follows:
APPRUNNER caused an invalid page fault in
module XPCOM.DLL at 0177:608fd2c4.
Registers:
EAX=000007d6 CS=0177 EIP=608fd2c4 EFLGS=00010202
EBX=00bb75e4 SS=017f ESP=0063fac4 EBP=0063faf0
ECX=00c8d000 DS=017f ESI=00c8c054 FS=2e47
EDX=00000061 ES=017f EDI=00bb75e4 GS=0000
Bytes at CS:EIP:
66 8b 11 41 41 66 85 d2 74 03 40 eb f3 c3 56 8b
Stack dump:
608f6209 00c8c054 0063fadc 00000001 00000218 00bb75e0 00000000 00000000 00000001
00000000 00c8c054 0063fb1c 6086c808 00c8c054 00000218 00000000

At the time of the crash the apprunner window displayed the following:

Document: Done (8.95 secs)

 url=http://www.microsoft.com/downloads/default.asp

 data=Content-type: application/x-www-form-urlencoded; charset=windows-1252
Content-Length: 72

Search=Product&LangIDCODE=20%3Ben%2Dus&Value=589&OpSysID=9800&Show=Alpha


what was expected: I expected it to load the next page using the search options
I had selected.

Comment 1

[Suresh Duddi (gone)]

Classic case of one too many Release. Here is what I see:

Breakpoint 1, NS_NewURI (result=0xbffff2c4, spec=0x855d558
"/library/toolbar/toolbar.js", baseURI=0x859bf70) at nsNeckoUtil.cpp:33
	NS_WITH_SERVICE(nsIIOService, serv, kIOServiceCID, &rv);

(gdb) p aClass.ToString()
$5 = 0x85aebc0 "{9ac9e770-18bc-11d3-9337-00104ba0fd40}"

The above function tries to get nsIOService whose refcount has already hit zero.
Eventually this core dumps in xpcom service manager.

(gdb) down
#0  0x400a6910 in nsServiceManagerImpl::GetService (this=0x8055428,
aClass=@0x8050a00, aIID=@0x8051fc0, result=0xbffff210, shutdownListener=0x0) at
nsServiceManager.cpp:229
(gdb) l
224	    nsIDKey key(aClass);
225	    nsServiceEntry* entry = (nsServiceEntry*)mServices->Get(&key);
226
227	    if (entry) {
228	        nsISupports* service;
229  ==>        rv = entry->mService->QueryInterface(aIID, (void**)&service);

So the million dollar question is who is releasing this one too many times. I
will investigate further since the necko group is overburdended already. If not,
feel free to take this over warren.

Changing component to necko.

Comment 2

[Warren Harris]

dp - It would be great if you could track this down. We are a bit overloaded at
the moment. I suggest putting a breakpoint in nsIOService::Release and seeing
who's calling it.

Comment 3

[Suresh Duddi (gone)]

Fixed this. It was some dom functions doing an extra release.

Now got to see if this core dump happens or not.

Comment 4

[Warren Harris]

I don't get a crash. Marking fixed.

Comment 5

[rubydoo123]

I crashed using the 1999080608 build on win95, whether it crashes in xpcom.dll I
do not know.

What I did was this:
1. selected the URI
2. selected an application from the list
3. selected an OS from the list
4. selected 'Find It'

system crashed.
 Incident # 12118938

 Call Stack:    (Signature = 0x10959000 e997a9de)

   0x10959000


   nsHTTPChannel::~nsHTTPChannel

[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPChannel.cpp, line
82]

   nsHTTPChannel::`scalar deleting
   destructor'


   nsHTTPChannel::Release

[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPChannel.cpp, line
139]

   nsDocLoaderImpl::SetDocumentChannel

[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1401]

   nsDocumentBindInfo::Bind

[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1623]

   nsDocumentBindInfo::Bind

[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1623]

   nsDocLoaderImpl::LoadDocument

[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 678]

   nsWebShell::DoLoadURL

[d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2033]

   nsWebShell::LoadURL

[d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2219]

   nsWebShell::LoadURL

[d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 1817]

   refreshData::Notify

[d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 3391]

   TimerImpl::Fire

[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 313]

   TimerImpl::ProcessTimeouts

[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 187]

   FireTimeout

[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 103]

   KERNEL32.DLL + 0x241d (0xbff7241d)


   USER32.DLL + 0x3372 (0xbff63372)



 Registers:
 EAX: 10717274
 EBX: 00af7d70
 ECX: 006f0063
 EDX: 00000002
 ESI: 0f8cd680
 EDI: 00000000
 ESP: 0063f8cc
 EBP: 0063f910
 EIP: 10959000
 cf PF af zf sf of IF df nt RF vm
 IOPL: 0
 CS: 014f
 DS: 0157
 SS: 0157
 ES: 0157
 FS: 112f
 GS: 0000

Comment 6

[Suresh Duddi (gone)]

This is in nsHTTPChannel. Off to you warren.

Comment 7

[Warren Harris]

This might be a dup of one Gagan had...

Comment 8

[Gagan]

beppe: could you verify if the latest checkins from rpotts fixed this? I could
not get it to crash so I am marking this as fixed. If the problem is still there
pls. reopen and assign to rpotts.

Comment 9

[rubydoo123]

I just tried it with build 1999081008 and it works fine, since it is working I
will mark verified.

Comment 10

[leger]

Bulk move of all Necko (to be deleted component) bugs to new Networking

component.