13026 - [blocker] serious error running apprunner under purify, nsArrayEnumerator?

Status: RESOLVED INVALID

(Core :: XPCOM, defect, P3)

Description

[buster]

I cannot run apprunner under purify.  Before the main window displays, I
terminate with a fatal exception.  The log shows hundreds of "FIM: Freeing
invalid memory in free_dbg {1 occurrence}" errors, but I think that's a
separate known problem.

It looks like the offending code is in nsArrayEnumerator via nsAllocator,
triggered by a call from nsString.  I have no idea if nsString is using
nsAllocator correctly or not.

The end of the log is included here:

[E] IPR: Invalid pointer read in set_sbh_threshold {1 occurrence}
        Reading 4 bytes from 0xffffffff (0 bytes at 0xffffffff illegal)
        Address 0xffffffff points into private memory
        Thread ID: 0x108
        Error location
            set_sbh_threshold [MSVCRTD.dll]
            exception::what(void)const [MSVCRTD.dll]
            malloc_dbg     [MSVCRTD.dll]
            malloc_dbg     [MSVCRTD.dll]
            malloc         [MSVCRTD.dll]
            malloc         [MSVCRTD.dll]
            PR_Malloc      [prmem.c:38]
            nsArrayEnumerator::=(nsArrayEnumerator const&) [xpcom.dll]
            nsAllocator::Alloc(UINT) [xpcom.dll]
            nsString::CreateString(eCharSize) [xpcom.dll]
[E] EXU: Unhandled exception in set_sbh_threshold {1 occurrence}
        Exception code: 0xc0000005 [Error: access violation]
        Exception address: set_sbh_threshold [MSVCRTD.dll]
        Filter: ???            [apprunner.exe ip=0x00407809]
        Exception location
            set_sbh_threshold [MSVCRTD.dll]
            RtlConvertUlongToLargeInteger [ntdll.dll]
            RtlRandom      [ntdll.dll]
            KiUserExceptionDispatcher [ntdll.dll]
            exception::what(void)const [MSVCRTD.dll]
            malloc_dbg     [MSVCRTD.dll]
            malloc_dbg     [MSVCRTD.dll]
            malloc         [MSVCRTD.dll]
            malloc         [MSVCRTD.dll]
            PR_Malloc      [prmem.c:38]
[I] Starting thread 0x105
        Call location
            No call stack recorded
[I] Terminating thread 0x105
        Call location
            LocalFree      [KERNEL32.dll]
            ExitThread     [KERNEL32.dll]
            DebugActiveProcess [KERNEL32.dll]
            lstrcmpiW      [KERNEL32.dll]
[E] NPR: NULL pointer read in nsArrayEnumerator::=(nsArrayEnumerator const&) {1
occurrence}
        Reading 4 bytes from 0x00000000 (4 bytes at 0x00000000 illegal)
        Address 0x00000000 points into invalid memory
        Thread ID: 0x108
        Error location
            nsArrayEnumerator::=(nsArrayEnumerator const&) [xpcom.dll]
            ???            [apprunner.exe ip=0x004028cb]
            ???            [apprunner.exe ip=0x004077d7]
            GetProcessPriorityBoost [KERNEL32.dll]
[E] EXU: Unhandled exception in nsArrayEnumerator::=(nsArrayEnumerator const&)
{1 occurrence}
        Exception code: 0xc0000005 [Error: access violation]
        Exception address: nsArrayEnumerator::=(nsArrayEnumerator const&)
[xpcom.dll]
        Filter: ???            [apprunner.exe ip=0x00407809]
        Exception location
            nsArrayEnumerator::=(nsArrayEnumerator const&) [xpcom.dll]
            RtlConvertUlongToLargeInteger [ntdll.dll]
            RtlRandom      [ntdll.dll]
            KiUserExceptionDispatcher [ntdll.dll]
            ???            [apprunner.exe ip=0x004028cb]
            ???            [apprunner.exe ip=0x004077d7]
            GetProcessPriorityBoost [KERNEL32.dll]
[I] Program terminated at 09/02/99 09:28:10

Comment 1

[buster]

until this is resolved, we cannot use purify for apprunner. This is a serious
hinderance to the dev team, to say the least.

Comment 2

[Suresh Duddi (gone)]

Scott is owner of xpcom/ds

Comment 3

[buster]

for fun, and to see if nsString was in any way the cluprit, I changed nsString
to not use nsAllocator and re-ran.  Got the same error in a slightly different
place:

[E] IPR: Invalid pointer read in set_sbh_threshold {1 occurrence}
    Reading 4 bytes from 0xffffffff (0 bytes at 0xffffffff illegal)
    Address 0xffffffff points into private memory
    Thread ID: 0x15a
    Error location
        set_sbh_threshold [MSVCRTD.dll]
        exception::what(void)const [MSVCRTD.dll]
        malloc_dbg     [MSVCRTD.dll]
        malloc_dbg     [MSVCRTD.dll]
        malloc_dbg     [MSVCRTD.dll]
        new(UINT)      [MSVCRTD.dll]
        new(UINT)      [MSVCRTD.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        DllGetClassObject [raptorweb.dll]
        DllGetClassObject [raptorweb.dll]
        NSGetFactory   [necko_file.dll]
        nsProxyObjectCallInfo::=(nsProxyObjectCallInfo const&) [necko.dll]
        nsProxyObjectCallInfo::=(nsProxyObjectCallInfo const&) [necko.dll]
        PL_HandleEvent [plevent.c:509]
        PL_ProcessPendingEvents [plevent.c:470]
        md_EventReceiverProc [plevent.c:938]
        TranslateMessageEx [user32.dll]
        DispatchMessageA [USER32.dll]
        ???            [ip=0x0330f440]
        NSGetFactory   [nsappshell.dll]

followed by


[E] EXU: Unhandled exception in set_sbh_threshold {1 occurrence}
    Exception code: 0xc0000005 [Error: access violation]
    Exception address: set_sbh_threshold [MSVCRTD.dll]
    Filter: ???            [apprunner.exe ip=0x00407809]
    Exception location
        set_sbh_threshold [MSVCRTD.dll]
        RtlConvertUlongToLargeInteger [ntdll.dll]
        RtlRandom      [ntdll.dll]
        KiUserExceptionDispatcher [ntdll.dll]
        exception::what(void)const [MSVCRTD.dll]
        malloc_dbg     [MSVCRTD.dll]
        malloc_dbg     [MSVCRTD.dll]
        malloc_dbg     [MSVCRTD.dll]
        new(UINT)      [MSVCRTD.dll]
        new(UINT)      [MSVCRTD.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        CNavDTD::UpdateStyleStackForOpenTag(nsHTMLTag,nsHTMLTag)
[raptorhtmlpars.dll]
        DllGetClassObject [raptorweb.dll]
        DllGetClassObject [raptorweb.dll]
        NSGetFactory   [necko_file.dll]
        nsProxyObjectCallInfo::=(nsProxyObjectCallInfo const&) [necko.dll]
        nsProxyObjectCallInfo::=(nsProxyObjectCallInfo const&) [necko.dll]
        PL_HandleEvent [plevent.c:509]
        PL_ProcessPendingEvents [plevent.c:470]
        md_EventReceiverProc [plevent.c:938]
        TranslateMessageEx [user32.dll]
        DispatchMessageA [USER32.dll]
        ???            [ip=0x0330f440]
        NSGetFactory   [nsappshell.dll]

Comment 4

[Scott Collins]

querying buster for the current status of this.  Marking M11 unless I hear from
him that it's already resolved.

Comment 5

[Scott Collins]

based on buster's email, he is no longer experiencing this bug, though it may be
masked by another bug.  No one else reports seeing this bug.  Putting this bug on
hold until after he re-installs Purify and re-tests.

Comment 6

[Blake Ross]

is this bug valid anymore?  if not, please mark invalid...

Comment 7

[Christopher Hoess (gone)]

REMIND is deprecated per bug 35839

Comment 8

[Christopher Hoess (gone)]

INVALID, then.