Closed Bug 143118 Opened 23 years ago Closed 23 years ago

Various Trunk crashes [@ nsXULPrototypeCache::GetPrototype]

Categories

(Core :: XUL, defect, P2)

Product:
Core
Component:
XUL
Platform:
x86
Windows 98
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jay, Assigned: bugs)

References

Details

(4 keywords)

Crash Data

Attachments

(1 file, 1 obsolete file)

patch to stop crashing if script deserialization fails
4.86 KB, patch
waterson
: review+
brendan
: superreview+
asa
: approval+
Details | Diff | Splinter Review
Starting with 5/3 builds, there have been A LOT of crashes being reported under the nsXULPrototypeCache::GetPrototype stack signature. The user tasks and stacks might vary, but I have a feeling they are all the result of some root cause. Here are just a few sets of crashes grouped by unique stacks: Count Offset Real Signature [ 13 nsXULPrototypeCache::GetPrototype d6e7f724 - nsXULPrototypeCache::GetPrototype ] Crash date range: 2002-05-04 to 2002-05-07 Min/Max Seconds since last crash: 7 - 63863 Min/Max Runtime: 40195 - 88932 Keyword List : Count Platform List 10 Windows 98 4.90 build 73010104 3 Windows 98 4.10 build 67766222 Count Build Id List 7 2002050308 3 2002050408 3 2002050304 No of Unique Users 3 Stack trace(Frame) nsXULPrototypeCache::GetPrototype [nsXULPrototypeCache.cpp line 271] nsXULDocument::ResumeWalk [nsXULDocument.cpp line 5585] nsXULDocument::CachedChromeStreamListener::OnStopRequest [nsXULDocument.cpp line 6932] nsDocumentOpenInfo::OnStopRequest [nsURILoader.cpp line 255] nsCachedChromeChannel::HandleStopLoadEvent [nsChromeProtocolHandler.cpp line 473] PL_HandleEvent [plevent.c line 597] _md_EventReceiverProc [plevent.c line 1078] 0x778b0c24 (6028941) Comments: unable to send email - keep getting this error mesage gkcontent.dll (5984678) Comments: sending email with Sabre For Windows ver 4.4 (reservations system) running. Shutdown occured ==================================================================================================== Count Offset Real Signature [ 11 nsXULPrototypeCache::GetPrototype b4ad76ef - nsXULPrototypeCache::GetPrototype ] Crash date range: 2002-05-04 to 2002-05-07 Min/Max Seconds since last crash: 21 - 16057 Min/Max Runtime: 1084 - 153707 Keyword List : click(5), Count Platform List 11 Windows NT 5.1 build 2600 Count Build Id List 3 2002050504 3 2002050408 3 2002050308 2 2002050304 No of Unique Users 4 Stack trace(Frame) nsXULPrototypeCache::GetPrototype [nsXULPrototypeCache.cpp line 271] nsXULDocument::ResumeWalk [nsXULDocument.cpp line 5585] nsXULDocument::CachedChromeStreamListener::OnStopRequest [nsXULDocument.cpp line 6932] nsDocumentOpenInfo::OnStopRequest [nsURILoader.cpp line 255] nsCachedChromeChannel::HandleStopLoadEvent [nsChromeProtocolHandler.cpp line 473] PL_HandleEvent [plevent.c line 597] _md_EventReceiverProc [plevent.c line 1078] SHELL32.dll + 0x4e0c24 (0x778b0c24) (6049807) Comments: clicking 'windows' under nightly build on the main page of the mozilla website (6042351) URL: http://www.nero.com/en/download.htm (6042351) Comments: Mozilla crashed at on the first US download link for Nero (Nero5582.exe). (6041268) URL: http://www.karenware.com/powertools/ptprofiler.asp (6041268) Comments: Mozilla crashed at http://www.karenware.com/powertools/ptprofiler.asp again when downloading the link saying "Karen's Computer Profiler." (6030810) URL: http://www.karenware.com/powertools/ptprofiler.asp (6030810) Comments: At http://www.karenware.com/powertools/ptprofiler.asp I clicked the download link for the program and Mozilla crashed. (5982705) URL: slashdot.org (5982705) Comments: Clicked on a build file name at the Mozilla.org "latest builds" site... (5982629) URL: slashdot.org (5982629) Comments: Clicked "Send message now" after having typed in a mail message. (5931926) URL: mozilla.org ftp site of latest builds (5931926) Comments: Clicked on file to ftp (5931891) URL: mozilla.org ftp site of latest builds (5931891) Comments: Looking at todays builds on the mozilla ftp site... ==================================================================================================== Count Offset Real Signature [ 8 nsXULPrototypeCache::GetPrototype f9372c3b - nsXULPrototypeCache::GetPrototype ] Crash date range: 2002-05-04 to 2002-05-07 Min/Max Seconds since last crash: 0 - 3 Min/Max Runtime: 1278 - 25994 Keyword List : Count Platform List 8 Windows NT 5.0 build 2195 Count Build Id List 3 2002050608 3 2002050308 1 2002050705 1 2002050508 No of Unique Users 4 Stack trace(Frame) nsXULPrototypeCache::GetPrototype [nsXULPrototypeCache.cpp line 281] nsXULDocument::ResumeWalk [nsXULDocument.cpp line 5588] nsXULDocument::EndLoad [nsXULDocument.cpp line 1797] XULContentSinkImpl::DidBuildModel [nsXULContentSink.cpp line 531] CNavDTD::DidBuildModel [CNavDTD.cpp line 658] nsParser::DidBuildModel [nsParser.cpp line 1253] nsParser::ResumeParse [nsParser.cpp line 1790] nsParser::OnStopRequest [nsParser.cpp line 2419] nsCachedChromeChannel::HandleStopLoadEvent [nsChromeProtocolHandler.cpp line 473] PL_HandleEvent [plevent.c line 597] _md_EventReceiverProc [plevent.c line 1078] 0x778b0c24 (5977337) Comments: LOAD CRASH ==================================================================================================== Count Offset Real Signature [ 7 nsXULPrototypeCache::GetPrototype dd0ed813 - nsXULPrototypeCache::GetPrototype ] Crash date range: 2002-05-04 to 2002-05-07 Min/Max Seconds since last crash: 23 - 45300 Min/Max Runtime: 24 - 1470076 Keyword List : Count Platform List 7 Windows NT 5.0 build 2195 Count Build Id List 4 2002050308 2 2002050408 1 2002050508 No of Unique Users 4 Stack trace(Frame) nsXULPrototypeCache::GetPrototype [nsXULPrototypeCache.cpp line 279] nsXULDocument::ResumeWalk [nsXULDocument.cpp line 5585] nsXULDocument::CachedChromeStreamListener::OnStopRequest [nsXULDocument.cpp line 6932] nsDocumentOpenInfo::OnStopRequest [nsURILoader.cpp line 255] nsCachedChromeChannel::HandleStopLoadEvent [nsChromeProtocolHandler.cpp line 473] PL_HandleEvent [plevent.c line 597] _md_EventReceiverProc [plevent.c line 1078] SETUPAPI.DLL + 0x30c24 (0x778b0c24) (6048675) URL: http://www.ivillage.com/xchannel/javascript/091182700.js (6048675) Comments: sending mail. geez what happened?
Keywords: crash, qawanted, regression, topcrash
*** Bug 142545 has been marked as a duplicate of this bug. ***
worksforme with Linux trunk build 20020507 all the crash data is for Windows - why is this OS: All?
Changing QA Contact
QA Contact: petersen → amar
My bad, changing OS to Win2k (although this is really happening on all flavors of Windows).
OS: All → Windows 2000
i'd prefer to pick the oldest version of windows where we know the problem exists.
OS: Windows 2000 → Windows 98
Changing the priority to P2 since there are lot og crashes with the same stack signature.
Priority: -- → P2
Crashing in XUL:nsXULPrototypeCache, not layout. Reassigning to XPToolkit
Assignee: attinasi → jaggernaut
Component: Layout → XP Toolkit/Widgets
QA Contact: amar → jrgm
I'm tempted to say this is a dupe of bug 142165. Ben?
Assignee: jaggernaut → ben
I don't think this is quite a duplicate of bug 142165, since the fix for that landed evening 05/06 and this is still showing up in 05/07 and 05/08 builds (although only 3 out of 61 crashes in the top 10 on http://climate/ are this crash with 05/08, whereas this was 45 of 504 crashes in the three prior days)
*** Bug 144229 has been marked as a duplicate of this bug. ***
So far today, with build 2002051004, I can duplicate this crash at will when attempting to download headers for newsgroup n.p.m.general from news.mozilla.org. Is anyone else seeing this?
*** Bug 145273 has been marked as a duplicate of this bug. ***
Do these stacks ensure that |GetPrototype| is really the topmost item? I see little opportunity to crash /there/, but plenty in its descendants. I now have a debug build that can reliably crash loading the Address Book window, crashing in memcpy called from nsBufferedStreams::Read. I'm going to see if I can make a finite set of steps to reach this state from a new profile.
Status: NEW → ASSIGNED
I have a bigger & better patch that prevents the crash. Will post it when I start my laptop...
(there are still asserts due to out-of-order deserialization, but no crash).
Attachment #86052 - Attachment is obsolete: true
DeserializeOutOfLineScript can now return an uninit'd value, use this instead: @@ -5287,6 +5298,8 @@ nsXULPrototypeScript::DeserializeOutOfLineScript(nsIObjectInputStream* aInput, nsIScriptContext* aContext) { + nsresult rv = NS_OK; + nsIXULPrototypeCache* cache = GetXULCache(); nsCOMPtr<nsIFastLoadService> fastLoadService; cache->GetFastLoadService(getter_AddRefs(fastLoadService)); @@ -5318,7 +5331,7 @@ if (! mJSObject) { // Keep track of FastLoad failure via rv, so we can // AbortFastLoads if things look bad. - nsresult rv = NS_OK; nsCOMPtr<nsIURI> oldURI; @@
I'd like to see this crash fixed for 1.1alpha. Ben, is that your final patch for this? If so, can we get some reviews?
I suppose I should have said 'why' I think we should get this on 1.1alpha (assuming the patch is good). This is currently the #2 and #8 (bug 146891) crasher in talkback data for the trunk.
Comment on attachment 86300 [details] [diff] [review] patch to stop crashing if script deserialization fails r=waterson
Attachment #86300 - Flags: review+
Can we get this landed before Monday? It would be good to clear this out of the Talkback for 1.1alpha.
Blocks: 148552
My final patch would be what is here, + timeless' comment. I've sent mail to brendan for sr, but will settle for someone else by tomorrow afternoon :-)
Comment on attachment 86300 [details] [diff] [review] patch to stop crashing if script deserialization fails >- // Now rename or remove the file. >- if (file) { >-#ifdef DEBUG >- file->MoveToNative(nsnull, NS_LITERAL_CSTRING("Aborted.mfasl")); >-#else >- file->Remove(PR_FALSE); >-#endif >- } >- > // Flush the XUL cache for good measure, in case we cached a bogus/downrev > // script, somehow. > Flush(); >@@ -606,6 +606,25 @@ > objectInput->Close(); > } > >+ // Now rename or remove the file. >+ if (file) { >+#ifdef DEBUG >+ // Remove any existing Aborted.mfasl files generated in previous runs. >+ nsCOMPtr<nsIFile> existingAbortedFile; >+ file->Clone(getter_AddRefs(existingAbortedFile)); >+ if (existingAbortedFile) { >+ existingAbortedFile->SetLeafName(NS_LITERAL_STRING("Aborted.mfasl")); >+ PRBool fileExists = PR_FALSE; >+ existingAbortedFile->Exists(&fileExists); >+ if (fileExists) >+ existingAbortedFile->Remove(PR_FALSE); >+ } >+ file->MoveToNative(nsnull, NS_LITERAL_CSTRING("Aborted.mfasl")); Why the existence check and the remove conditioned by it? Doesn't nsIFile promise that MoveTo* where the target exists and can be removed will auto-remove (replace), as Unix rename(2) promises? >+#else >+ file->Remove(PR_FALSE); >+#endif >+ } >+ > // If the list is empty now, the FastLoad process is done. > NS_RELEASE(gFastLoadService); > NS_RELEASE(gFastLoadFile); Tell me you really need the exists/remove rigamorole cuz of an nsIFile bug, cite (and file, if needed) the nsIFile bug #, fix the problem timeless noted, and sr=brendan@mozilla.org. /be
Attachment #86300 - Flags: superreview+
Blocks: 1.1a
No longer blocks: 148552
see bug 150156 for the MoveTo problem.
Comment on attachment 86300 [details] [diff] [review] patch to stop crashing if script deserialization fails a=asa (on behalf of drivers) for checkin to the 1.1 trunk.
Attachment #86300 - Flags: approval+
fixed
Status: ASSIGNED → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
verified. Talkback data on climate shows no crashes reported for this signature in builds of 06/09 and 06/10, after showing 43 crashes in builds of 06/08.
Status: RESOLVED → VERIFIED
*** Bug 150482 has been marked as a duplicate of this bug. ***
Crash Signature: [@ nsXULPrototypeCache::GetPrototype]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: