1484999 - Crash in struct mozilla::widget::WindowHook::MessageData* mozilla::widget::WindowHook::LookupOrCreate

Status: RESOLVED DUPLICATE of bug 1485253

(Core :: Widget: Win32, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-7e274dc3-6422-40ba-89f4-e9ad50180821.
=============================================================

Seen while looking at nightly crash data - crashes started using 20180820222055: https://bit.ly/2BI6Eav. 8 crashes/9 installs all on Win 10.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2d1d32212c1e4107bef4d24dbbe2f12adca11837&tochange=d0d2e0f4b33cd28bc05c353c185873256f7f926e

Top 10 frames of crashing thread:

0 xul.dll struct mozilla::widget::WindowHook::MessageData* mozilla::widget::WindowHook::LookupOrCreate widget/windows/WindowHook.cpp:77
1 xul.dll mozilla::widget::WindowHook::AddMonitor widget/windows/WindowHook.cpp:45
2 xul.dll mozilla::widget::TaskbarPreview::Enable widget/windows/TaskbarPreview.cpp:173
3 xul.dll mozilla::widget::TaskbarTabPreview::Enable widget/windows/TaskbarTabPreview.cpp:237
4 xul.dll XPTC__InvokebyIndex xpcom/reflect/xptcall/md/win32/xptcinvoke_asm_x86_64.asm:97
5 xul.dll exp2 
6 xul.dll exp2 
7 xul.dll exp2 
8 xul.dll XPCWrappedNative::CallMethod js/xpconnect/src/XPCWrappedNative.cpp:1201
9 xul.dll static bool XPC_WN_GetterSetter js/xpconnect/src/XPCWrappedNativeJSOps.cpp:923

=============================================================

Comment 1

[Calixte Denizet (:calixte)]

It could be a regression from patch https://hg.mozilla.org/mozilla-central/rev/3d64c00c695a to fix bug 1418793.
The only one comment in reports we've right now is "CTRL+V paste into a Trello card while opening a new tab".

:gijs, could you investigate please ?

Comment 2

[:Gijs (he/him)]

The lack of STR makes this hard for me to understand. If I had to guess this is about windows closing while we're in the middle of enabling the previews or something? I tried opening and quickly closing windows for a while but still can't repro.

As far as I can tell this is triggered from calling TaskbarTabPreview::Enable() from JS. It's not exposed via XPCOM, but mozilla::widget::TaskbarPreview::SetVisible is (ie preview.visible = /* wahtever */ ) and that gets called in a few places (https://searchfox.org/mozilla-central/search?q=preview.visible&redirect=false ).

I don't know which of those callsites it'll be, and how my patch broke it, esp. without STR.

I also don't understand the actual crash. The crash address is the same everywhere (0x2c8) which I assume is a near-null error indicating something's gone missing when we didn't expect it to - but I don't understand what, in this stack:

0 	xul.dll 	struct mozilla::widget::WindowHook::MessageData* mozilla::widget::WindowHook::LookupOrCreate(unsigned int) 	widget/windows/WindowHook.cpp:77
1 	xul.dll 	mozilla::widget::WindowHook::AddMonitor(unsigned int, bool (*)(void*, HWND__*, unsigned int, unsigned __int64, __int64, __int64*), void*) 	widget/windows/WindowHook.cpp:45
2 	xul.dll 	mozilla::widget::TaskbarPreview::Enable() 	widget/windows/TaskbarPreview.cpp:173
3 	xul.dll 	mozilla::widget::TaskbarTabPreview::Enable() 	widget/windows/TaskbarTabPreview.cpp:237

Where the LookupOrCreate() stuff gets passed a uint, and looks like this:

https://hg.mozilla.org/mozilla-central/annotate/d0d2e0f4b33cd28bc05c353c185873256f7f926e/widget/windows/WindowHook.cpp#l75

WindowHook::MessageData *
WindowHook::LookupOrCreate(UINT nMsg) {
  MessageData *data = Lookup(nMsg); // <--- crash here.
  if (!data) {
    data = mMessageData.AppendElement();

    if (!data)
      return nullptr;

    data->nMsg = nMsg;
  }
  return data;
}

Is the WindowHook null? Why would that be the case, and how did we manage to enter WindowHook::AddMonitor, or is that just an optimization lie?

Jim, any chance you have ideas here? All of this code hasn't been touched in ages. :-(

Comment 3

[Marcia Knous [:marcia]]

Here are some URLs that showed up:

*https://www.spigen.com/collections/galaxy-note-9 
*https://www.youtube.com/watch?v=BkaYjdV6wCg&t=9s 
*https://www.tutorialspoint.com/cprogramming/c_environment_setup.htm 

There is only one comment so far, noted in Comment 1.

Comment 4

[Marcia Knous [:marcia]]

It looks as if m_kato is hitting a similar signature in Bug 1485253. Maybe he is able to reproduce it?