1101769 - crash in nsGlobalWindow::CallerGlobal()

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-5f429575-9acb-4203-8bae-d877c2141112.
=============================================================

This signature has been around for a while, but it spiked around 11/07 and it's been steady after that point. Most of the reports are coming from Windows 7 installations. There are several dupes. No comments in the reports.

More reports at: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=nsGlobalWindow%3A%3ACallerGlobal%28%29

0 	xul.dll 	nsGlobalWindow::CallerGlobal() 	dom/base/nsGlobalWindow.cpp
1 	xul.dll 	nsGlobalWindow::CallerInnerWindow() 	dom/base/nsGlobalWindow.cpp
2 	xul.dll 	nsGlobalWindow::PostMessageMoz(JSContext*, JS::Handle<JS::Value>, nsAString_internal const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) 	dom/base/nsGlobalWindow.cpp
3 	xul.dll 	nsGlobalWindow::PostMessageMoz(JSContext*, JS::Handle<JS::Value>, nsAString_internal const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) 	dom/base/nsGlobalWindow.cpp
4 	xul.dll 	nsGlobalWindow::PostMessageMoz(JSContext*, JS::Handle<JS::Value>, nsAString_internal const&, mozilla::dom::Optional<mozilla::dom::Sequence<JS::Value> > const&, mozilla::ErrorResult&) 	dom/base/nsGlobalWindow.cpp
5 	xul.dll 	mozilla::dom::WindowBinding::postMessage 	obj-firefox/dom/bindings/WindowBinding.cpp
6 	xul.dll 	mozilla::dom::WindowBinding::genericCrossOriginMethod 	obj-firefox/dom/bindings/WindowBinding.cpp
7 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
8 	xul.dll 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
9 	xul.dll 	JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
10 	xul.dll 	mozilla::jsipc::WrapperAnswer::RecvCallOrConstruct(mozilla::jsipc::ObjectId const&, nsTArray<mozilla::jsipc::JSParam> const&, bool const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*, nsTArray<mozilla::jsipc::JSParam>*) 	js/ipc/WrapperAnswer.cpp
11 	xul.dll 	mozilla::jsipc::JavaScriptBase<mozilla::jsipc::PJavaScriptParent>::RecvCallOrConstruct(unsigned __int64 const&, nsTArray<mozilla::jsipc::JSParam> const&, bool const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*, nsTArray<mozilla::jsipc::JSParam>*) 	js/ipc/JavaScriptBase.h
12 	xul.dll 	mozilla::jsipc::PJavaScriptChild::OnMessageReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PJavaScriptChild.cpp
13 	xul.dll 	mozilla::layers::PCompositorChild::OnMessageReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PCompositorChild.cpp
14 	xul.dll 	mozilla::ipc::MessageChannel::DispatchSyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
15 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
16 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
17 	xul.dll 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
18 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
19 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
20 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
21 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
22 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
23 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
24 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
25 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
26 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
27 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
28 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
29 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
30 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
31 	plugin-container.exe 	content_process_main(int, char** const) 	ipc/contentproc/plugin-container.cpp
32 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
33 	plugin-container.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
34 	kernel32.dll 	BaseThreadInitThunk 	
35 	ntdll.dll 	__RtlUserThreadStart 	
36 	ntdll.dll 	_RtlUserThreadStart

0 	xul.dll 	nsGlobalWindow::CallerGlobal() 	dom/base/nsGlobalWindow.cpp
1 	xul.dll 	nsGlobalWindow::CallerInnerWindow() 	dom/base/nsGlobalWindow.cpp
2 	xul.dll 	nsGlobalWindow::PostMessageMoz(JSContext*, JS::Handle<JS::Value>, nsAString_internal const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) 	dom/base/nsGlobalWindow.cpp
3 	xul.dll 	nsGlobalWindow::PostMessageMoz(JSContext*, JS::Handle<JS::Value>, nsAString_internal const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) 	dom/base/nsGlobalWindow.cpp
4 	xul.dll 	nsGlobalWindow::PostMessageMoz(JSContext*, JS::Handle<JS::Value>, nsAString_internal const&, mozilla::dom::Optional<mozilla::dom::Sequence<JS::Value> > const&, mozilla::ErrorResult&) 	dom/base/nsGlobalWindow.cpp
5 	xul.dll 	mozilla::dom::WindowBinding::postMessage 	obj-firefox/dom/bindings/WindowBinding.cpp
6 	xul.dll 	mozilla::dom::WindowBinding::genericCrossOriginMethod 	obj-firefox/dom/bindings/WindowBinding.cpp
7 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
8 	xul.dll 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
9 	xul.dll 	JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
10 	xul.dll 	mozilla::jsipc::WrapperAnswer::RecvCallOrConstruct(mozilla::jsipc::ObjectId const&, nsTArray<mozilla::jsipc::JSParam> const&, bool const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*, nsTArray<mozilla::jsipc::JSParam>*) 	js/ipc/WrapperAnswer.cpp
11 	xul.dll 	mozilla::jsipc::JavaScriptBase<mozilla::jsipc::PJavaScriptParent>::RecvCallOrConstruct(unsigned __int64 const&, nsTArray<mozilla::jsipc::JSParam> const&, bool const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*, nsTArray<mozilla::jsipc::JSParam>*) 	js/ipc/JavaScriptBase.h
12 	xul.dll 	mozilla::jsipc::PJavaScriptChild::OnMessageReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PJavaScriptChild.cpp
13 	xul.dll 	mozilla::layers::PCompositorChild::OnMessageReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PCompositorChild.cpp
14 	xul.dll 	mozilla::ipc::MessageChannel::DispatchSyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
15 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
16 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
17 	xul.dll 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
18 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
19 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
20 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
21 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
22 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
23 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
24 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
25 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
26 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
27 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
28 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
29 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
30 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
31 	plugin-container.exe 	content_process_main(int, char** const) 	ipc/contentproc/plugin-container.cpp
32 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
33 	plugin-container.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
34 	kernel32.dll 	BaseThreadInitThunk 	
35 	ntdll.dll 	__RtlUserThreadStart 	
36 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Boris Zbarsky [:bzbarsky]]

This is fun.  WrapperAnswer::RecvCallOrConstruct just does direct JSAPI stuff to call postMessage; it knows nothing about the entry point stack... but the callee expects all script execution to come via things that know about entry points.

Comment 3

[Bobby Holley (:bholley)]

Yeah, the answer here is to rip out all of the AutoSafeJSContext usage from WrapperAnswer.cpp. I'll write up a patch.

Comment 4

[Bobby Holley (:bholley)]

Attachment: Tests. v1

Comment 5

[Bobby Holley (:bholley)]

(In reply to Bobby Holley (:bholley) from comment #4)
> Created attachment 8526381 [details] [diff] [review]
> Tests. v1

Note that this test only catches the issue with part 1 of bug 1102521. Part 2 fixes it.

Comment 6

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/90d9478a29e2

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/90d9478a29e2

Comment 8

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Socorro [1] shows zero crashes over the past 4 weeks.

[1] - https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=nsGlobalWindow%3A%3ACallerGlobal%28%29