1074119 - Crash [@ @0x0 | RealMsgWaitForMultipleObjectsEx | mozilla::widget::WinUtils::WaitForMessage() | nsAppShell::ProcessNextNativeEvent(bool) ]

Status: RESOLVED WONTFIX

(Core :: Widget: Win32, defect)

Description

[Daniel Gherasim]

Crash: bp-72f97083-2187-47ea-b019-fda382140929

Firefox Aurora (34.0a2 ru) crashed during one of our testruns on Windows 7 x64.
The test where it failed:
https://hg.mozilla.org/qa/mozmill-tests/file/b11bebb332f6/firefox/tests/remote/testSecurity/testSafeBrowsingNotificationBar.js

Testrun report:
http://mozmill-daily.blargon7.com/#/remote/report/f11964362bbc85ebfbc5b36de7bbb308


The lsat 10 threads:
Frame	Module	Signature	Source
0		@0x0	
1	kernel32.dll	WaitForMultipleObjectsExImplementation	
2	user32.dll	RealMsgWaitForMultipleObjectsEx	
3	xul.dll	mozilla::widget::WinUtils::WaitForMessage()	widget/windows/WinUtils.cpp
4	xul.dll	nsAppShell::ProcessNextNativeEvent(bool)	widget/windows/nsAppShell.cpp
5	nss3.dll	PR_IntervalNow	nsprpub/pr/src/misc/prinrval.c
6	xul.dll	nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool, unsigned int)	widget/xpwidgets/nsBaseAppShell.cpp
7	xul.dll	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp
8	xul.dll	NS_InvokeByIndex	xpcom/reflect/xptcall/md/win32/xptcinvoke.cpp
9	xul.dll	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
10		@0x3ee86203

Comment 1

[Andrei Eftimie]

Looks similar with the crashes we've seen last week: bug 1069884 and bug 1072800

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Looks like its a null-deref crash:

Crash Reason 	EXCEPTION_ACCESS_VIOLATION_EXEC
Crash Address 	0x0

Crashes in the last 7 days:

Windows 7 	99.32 %	147
Windows XP 	0.68 %	1 

Looking at the code this looks to be a regression from the latest WaitMessage improvements on bug 937306. There are some crashes, which existed already before. But since mid of September we can see some large spikes. Aaron, can you please have a look at?

Comment 3

[(No longer employed by Mozilla) Aaron Klotz]

This is odd; we still call MsgWaitForMultipleObjectsEx the same way that we did before. To see a null pointer dereference there, it suggests to me that the crashing thread does not yet have a message queue.

Comment 4

[(No longer employed by Mozilla) Aaron Klotz]

On second thought, most of these crashes are EXCEPTION_ACCESS_VIOLATION_EXEC. That couldn't be it.

I don't see how my patch could have caused this. It is very suspicious to me that the guts of a Windows API function would jump to NULL.

Comment 5

[Daniel Gherasim]

Crashed again on another machine of us:
=======================================
bp-8238ec4e-214f-448c-abf9-1fee32140930
=======================================

I tried to reproduce this by manually running the testrun with no success.

Comment 6

[Suburp]

See also
https://bugzilla.mozilla.org/show_bug.cgi?id=789379
for this problem.

Two more crashes yesterday:
https://crash-stats.mozilla.com/report/index/4f062917-612a-4d09-90ff-1c8042141003
https://crash-stats.mozilla.com/report/index/9810fca5-7fbb-4cc0-b4dc-e92f12141003

Comment 7

[(No longer employed by Mozilla) Aaron Klotz]

(In reply to Suburp from comment #6)
> See also
> https://bugzilla.mozilla.org/show_bug.cgi?id=789379
> for this problem.
> 
> Two more crashes yesterday:
> https://crash-stats.mozilla.com/report/index/4f062917-612a-4d09-90ff-
> 1c8042141003
> https://crash-stats.mozilla.com/report/index/9810fca5-7fbb-4cc0-b4dc-
> e92f12141003

That bug involves the same function but it's a different issue.

I have not seen any crashes with this signature on builds newer than September 29, which is when bug 1072752 was uplifted.

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to Aaron Klotz [:aklotz] (please use needinfo) from comment #7)
>...
> I have not seen any crashes with this signature on builds newer than
> September 29, which is when bug 1072752 was uplifted.

Which got fixed in 33, 34 and 35.
Daniel, have you see the crash since this patch landed?

Comment 9

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.