21006 - crash in InMemoryAssertionEnumeratorImpl::HasMoreElements

Status: VERIFIED FIXED

(Core Graveyard :: RDF, defect, P3)

Description

[Warren Harris]

I tried to drag one of the items from my personal toolbar to another position
in the personal toolbar and got this crash:

InMemoryAssertionEnumeratorImpl::HasMoreElements(InMemoryAssertionEnumeratorImp
l * const 0x0262f8a0, int * 0x0012b80c) line 359 + 12 bytes
CompositeEnumeratorImpl::HasMoreElements(CompositeEnumeratorImpl * const
0x0262c4f0, int * 0x0012b880) line 232 + 22 bytes
RDFContainerImpl::Renumber(int 0x00000005, int 0xffffffff) line 581 + 27 bytes
RDFContainerImpl::RemoveElement(RDFContainerImpl * const 0x026372b0, nsIRDFNode
* 0x01f3bc50, int 0x00000001) line 269 + 17 bytes
XPTC_InvokeByIndex(nsISupports * 0x026372b0, unsigned int 0x00000009, unsigned
int 0x00000002, nsXPTCVariant * 0x0012ba6c) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x01bca4a0,
nsXPCWrappedNative * 0x025e80f0, const XPCNativeMemberDescriptor * 0x025e3efc,
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 0x00000002, long *
0x00dacdf0, long * 0x0012bc1c) line 894 + 43 bytes
WrappedNative_CallMethod(JSContext * 0x01bca4a0, JSObject * 0x01ced8e8,
unsigned int 0x00000002, long * 0x00dacdf0, long * 0x0012bc1c) line 191 + 34
bytes
js_Invoke(JSContext * 0x01bca4a0, unsigned int 0x00000002, unsigned int
0x00000000) line 665 + 26 bytes
js_Interpret(JSContext * 0x01bca4a0, long * 0x0012c48c) line 2226 + 15 bytes
js_Invoke(JSContext * 0x01bca4a0, unsigned int 0x00000001, unsigned int
0x00000000) line 681 + 13 bytes
js_Interpret(JSContext * 0x01bca4a0, long * 0x0012ccb8) line 2226 + 15 bytes
js_Invoke(JSContext * 0x01bca4a0, unsigned int 0x00000001, unsigned int
0x00000002) line 681 + 13 bytes
js_InternalCall(JSContext * 0x01bca4a0, JSObject * 0x01ced6b8, long 0x01ced6f8,
unsigned int 0x00000001, long * 0x0012ce38, long * 0x0012cde4) line 758 + 15
bytes
JS_CallFunctionValue(JSContext * 0x01bca4a0, JSObject * 0x01ced6b8, long
0x01ced6f8, unsigned int 0x00000001, long * 0x0012ce38, long * 0x0012cde4) line
2752 + 29 bytes
nsJSContext::CallFunctionObject(nsJSContext * const 0x01bca630, void *
0x01ced6b8, void * 0x01ced6f8, unsigned int 0x00000001, void * 0x0012ce38, int
* 0x0012ce34) line 540 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x026336d4) line 128 + 57 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x01f30b90,
nsIDOMEvent * 0x026336d4, unsigned int 0x00000008) line 632 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x01bca9b0, nsEvent *
0x0012d7ac, nsIDOMEvent * * 0x0012d5e0, unsigned int 0x00000002, nsEventStatus
* 0x0012d728) line 1281 + 31 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f30cc0, nsIPresContext *
0x01bca9b0, nsEvent * 0x0012d7ac, nsIDOMEvent * * 0x0012d5e0, unsigned int
0x00000002, nsEventStatus * 0x0012d728) line 2679
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f30960, nsIPresContext *
0x01bca9b0, nsEvent * 0x0012d7ac, nsIDOMEvent * * 0x0012d5e0, unsigned int
0x00000002, nsEventStatus * 0x0012d728) line 2683 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f5a450, nsIPresContext *
0x01bca9b0, nsEvent * 0x0012d7ac, nsIDOMEvent * * 0x0012d5e0, unsigned int
0x00000002, nsEventStatus * 0x0012d728) line 2683 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x02135ad0, nsIPresContext *
0x01bca9b0, nsEvent * 0x0012d7ac, nsIDOMEvent * * 0x0012d5e0, unsigned int
0x00000001, nsEventStatus * 0x0012d728) line 2683 + 39 bytes
PresShell::HandleEvent(PresShell * const 0x00d69fac, nsIView * 0x01bf2ef0,
nsGUIEvent * 0x0012d7ac, nsEventStatus * 0x0012d728) line 2504 + 39 bytes
nsView::HandleEvent(nsView * const 0x01bf2ef0, nsGUIEvent * 0x0012d7ac,
unsigned int 0x0000001c, nsEventStatus * 0x0012d728, int & 0x00000000) line 841
nsViewManager::DispatchEvent(nsViewManager * const 0x01bf1540, nsGUIEvent *
0x0012d7ac, nsEventStatus * 0x0012d728) line 1678
HandleEvent(nsGUIEvent * 0x0012d7ac) line 69
nsWindow::DispatchEvent(nsWindow * const 0x01bf2dc4, nsGUIEvent * 0x0012d7ac,
nsEventStatus & nsEventStatus_eIgnore) line 421 + 10 bytes
nsNativeDragTarget::DispatchDragDropEvent(unsigned int 0x0000057b, _POINTL
{...}) line 171
nsNativeDragTarget::ProcessDrag(unsigned int 0x0000057b, unsigned long
0x00000000, _POINTL {...}, unsigned long * 0x0012d9d0) line 193
nsNativeDragTarget::Drop(nsNativeDragTarget * const 0x01bf2d20, IDataObject *
0x025ac120, unsigned long 0x00000000, _POINTL {...}, unsigned long *
0x0012d9d0) line 306
OLE32! 77ba9068()
OLE32! 77ba916d()
OLE32! 77b8fabd()
OLE32! 77b8f876()
nsDragService::StartInvokingDragSession(nsDragService * const 0x014f73a0,
IDataObject * 0x025ac120, unsigned int 0x00000003) line 125 + 25 bytes
nsDragService::InvokeDragSession(nsDragService * const 0x014f73a0,
nsISupportsArray * 0x02210630, nsIScriptableRegion * 0x00000000, unsigned int
0x00000003) line 94
XPTC_InvokeByIndex(nsISupports * 0x014f73a0, unsigned int 0x00000003, unsigned
int 0x00000003, nsXPTCVariant * 0x0012dbc8) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x01bca4a0,
nsXPCWrappedNative * 0x02198f60, const XPCNativeMemberDescriptor * 0x021a4044,
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 0x00000003, long *
0x00dacd5c, long * 0x0012dd78) line 894 + 43 bytes
WrappedNative_CallMethod(JSContext * 0x01bca4a0, JSObject * 0x00dbd3b0,
unsigned int 0x00000003, long * 0x00dacd5c, long * 0x0012dd78) line 191 + 34
bytes
js_Invoke(JSContext * 0x01bca4a0, unsigned int 0x00000003, unsigned int
0x00000000) line 665 + 26 bytes
js_Interpret(JSContext * 0x01bca4a0, long * 0x0012e5e8) line 2226 + 15 bytes
js_Invoke(JSContext * 0x01bca4a0, unsigned int 0x00000001, unsigned int
0x00000000) line 681 + 13 bytes
js_Interpret(JSContext * 0x01bca4a0, long * 0x0012ee14) line 2226 + 15 bytes
js_Invoke(JSContext * 0x01bca4a0, unsigned int 0x00000001, unsigned int
0x00000002) line 681 + 13 bytes
js_InternalCall(JSContext * 0x01bca4a0, JSObject * 0x01ced6b8, long 0x00dbd2f8,
unsigned int 0x00000001, long * 0x0012ef94, long * 0x0012ef40) line 758 + 15
bytes
JS_CallFunctionValue(JSContext * 0x01bca4a0, JSObject * 0x01ced6b8, long
0x00dbd2f8, unsigned int 0x00000001, long * 0x0012ef94, long * 0x0012ef40) line
2752 + 29 bytes
nsJSContext::CallFunctionObject(nsJSContext * const 0x01bca630, void *
0x01ced6b8, void * 0x00dbd2f8, unsigned int 0x00000001, void * 0x0012ef94, int
* 0x0012ef90) line 540 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x02182034) line 128 + 57 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x01f30b90,
nsIDOMEvent * 0x02182034, unsigned int 0x00000010) line 632 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x01bca9b0, nsEvent *
0x0012f77c, nsIDOMEvent * * 0x0012f73c, unsigned int 0x00000002, nsEventStatus
* 0x0012f7bc) line 1281 + 31 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f30cc0, nsIPresContext *
0x01bca9b0, nsEvent * 0x0012f77c, nsIDOMEvent * * 0x0012f73c, unsigned int
0x00000002, nsEventStatus * 0x0012f7bc) line 2679
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f30960, nsIPresContext *
0x01bca9b0, nsEvent * 0x0012f77c, nsIDOMEvent * * 0x0012f73c, unsigned int
0x00000002, nsEventStatus * 0x0012f7bc) line 2683 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x01f5a450, nsIPresContext *
0x01bca9b0, nsEvent * 0x0012f77c, nsIDOMEvent * * 0x0012f73c, unsigned int
0x00000002, nsEventStatus * 0x0012f7bc) line 2683 + 39 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x02135ad0, nsIPresContext *
0x01bca9b0, nsEvent * 0x0012f77c, nsIDOMEvent * * 0x0012f73c, unsigned int
0x00000001, nsEventStatus * 0x0012f7bc) line 2683 + 39 bytes
nsEventStateManager::GenerateDragGesture(nsIPresContext * 0x01bca9b0,
nsGUIEvent * 0x0012fb5c) line 495
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x021237a0,
nsIPresContext * 0x01bca9b0, nsGUIEvent * 0x0012fb5c, nsIFrame * 0x01cc5f48,
nsEventStatus * 0x0012fa68, nsIView * 0x01bf2ef0) line 184
PresShell::HandleEvent(PresShell * const 0x00d69fac, nsIView * 0x01bf2ef0,
nsGUIEvent * 0x0012fb5c, nsEventStatus * 0x0012fa68) line 2492 + 43 bytes
nsView::HandleEvent(nsView * const 0x01bf2ef0, nsGUIEvent * 0x0012fb5c,
unsigned int 0x0000001c, nsEventStatus * 0x0012fa68, int & 0x00000000) line 841
nsViewManager::DispatchEvent(nsViewManager * const 0x01bf1540, nsGUIEvent *
0x0012fb5c, nsEventStatus * 0x0012fa68) line 1678
HandleEvent(nsGUIEvent * 0x0012fb5c) line 69
nsWindow::DispatchEvent(nsWindow * const 0x01bf2dc4, nsGUIEvent * 0x0012fb5c,
nsEventStatus & nsEventStatus_eIgnore) line 421 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fb5c) line 442
nsWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000
{x=??? y=???}) line 3338 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000
{x=??? y=???}) line 3556
nsWindow::ProcessMessage(unsigned int 0x00000200, unsigned int 0x00000001, long
0x001e0169, long * 0x0012fdc8) line 2620 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x0425045a, unsigned int 0x00000200, unsigned int
0x00000001, long 0x001e0169) line 608 + 27 bytes


    while (mNextAssertion) {
        PRBool foundIt = PR_FALSE;
=>        if ((mProperty == mNextAssertion->mProperty) && (mTruthValue ==
mNextAssertion->mTruthValue)) {
            if (mSource) {
                mValue = mNextAssertion->mTarget;

mNextAssertion has been deleted (0xdddddddd).

Comment 1

[Warren Harris]

Trying it again, I crashed here:

nsEventStateManager::UpdateCursor(nsIPresContext * 0x01bca580, nsPoint &
{x=0x00000f4b y=0x000001e0}, nsIFrame * 0x00dca930, nsEventStatus * 0x0012fa68)
line 969 + 21 bytes
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x02123af0,
nsIPresContext * 0x01bca580, nsGUIEvent * 0x0012fb5c, nsIFrame * 0x00dca930,
nsEventStatus * 0x0012fa68, nsIView * 0x01bf2a50) line 185
PresShell::HandleEvent(PresShell * const 0x00d696c4, nsIView * 0x01bf2a50,
nsGUIEvent * 0x0012fb5c, nsEventStatus * 0x0012fa68) line 2492 + 43 bytes
nsView::HandleEvent(nsView * const 0x01bf2a50, nsGUIEvent * 0x0012fb5c,
unsigned int 0x0000001c, nsEventStatus * 0x0012fa68, int & 0x00000000) line 841
nsViewManager::DispatchEvent(nsViewManager * const 0x01bf10b0, nsGUIEvent *
0x0012fb5c, nsEventStatus * 0x0012fa68) line 1678
HandleEvent(nsGUIEvent * 0x0012fb5c) line 69
nsWindow::DispatchEvent(nsWindow * const 0x01bf2924, nsGUIEvent * 0x0012fb5c,
nsEventStatus & nsEventStatus_eIgnore) line 421 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fb5c) line 442
nsWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000
{x=??? y=???}) line 3338 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000
{x=??? y=???}) line 3556
nsWindow::ProcessMessage(unsigned int 0x00000200, unsigned int 0x00000001, long
0x00200105, long * 0x0012fdc8) line 2620 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x05f404cc, unsigned int 0x00000200, unsigned int
0x00000001, long 0x00200105) line 608 + 27 bytes
USER32! 77e71820()


  else {
=>    aTargetFrame->GetCursor(aPresContext, aPoint, cursor);
  }

where aTargetFrame is bad. This comes from PresShell::HandleEvent using
mCurrentEventFrame which is null.

Comment 2

[Warren Harris]

Third time produced the first crash above, again. I think it's related to
dragging around the "Channels" list which is a pulldown instead of a button.
Cc'ing Pink.

Comment 3

[Mike Pinkerton (not reading bugmail)]

well don't do that then ;) accepting for m14

Comment 4

[leger]

Adding "crash" keyword to all known open crasher bugs.

Comment 5

[Chris Waterson]

move to M15 when (?) drag and drop will be turned on.

Comment 6

[Chris Waterson]

Attachment: fix to make Assertion objects refcounted.

Comment 7

[Chris Waterson]

There has been a long-standing bug with RDF where the ownership model is broken.
Specifically, it's possible to get an enumerator to a datasource, then
Unassert() some stuff, and leave the enumerator's pointer dangling. (I thought
that this was the case with bug 28640, but it's not. So, anyway, I've got a
"fix" for this design problem, and I thought I'd put it some place for safe
keeping.)

Comment 8

[Steve Lamm]

It looks like 30710 is a duplicate of this bug. It was marked PDT+, so I am
adding beta1 to the keywords of this bug.

Comment 9

[leger]

jar to check with waterson or slamm or someone to try in a local tree before 
approving.  Only to solve 30710!!

Comment 10

[Steve Lamm]

Patch worked for 30710. I ran 5 times and deleted about 20 bookmarks total.

Comment 11

[Chris Waterson]

rjc: *careful* code review required! this is sort of a big-ish change that they 
want to land in the Beta branch to stop Unix crashers. Can you review?

Comment 12

[Chris Waterson]

Attachment: cleaner patch from rjc's review

Comment 13

[Chris Waterson]

Attachment: third time's the charm

Comment 14

[Chris Waterson]

This last patch fixes an ordering problem that was occuring in the previous two 
patches: specifically, an attempt was made to dereference an assertion after it 
was Release()-ed in the enumerator code. Also, patch has cleaned up comments.

I've tested this with search, the customize dialog, bookmarks 
add/reorder/delete, and it seems to be holding up.

warren, rjc? comments?

Comment 15

[Warren Harris]

Why not make Assertion be an nsISupports, use the macros, and get the benefits 
of the bloat/leak tracking, thread-safety checks, etc? 4th time's a charm.

Comment 16

[Chris Waterson]

Yeah, I could do that. But I don't really think these *should* be nsISupports, 
and long term (e.g., for the tip), I think there's a better solution, which is 
to update each cursor that uses a "doomed" assertion.

Comment 17

[Chris Waterson]

Okay, I've checked in patch #3. Yeah, it could be an nsISupports, but I'm just 
not gonna do that now (adds unnecessary vtable, virtual functions, we already 
have Assertion class tracked using the COUNT_CTOR|DTOR macros).

I'm opening a new bug 32460 to account for the fact that this solution will 
"corrupt" an enumerator that is currently pointing to an assertion that gets 
removed from the datasource.

Comment 18

[Tom Everingham]

This cannot be verified right now because drag & drop has been temporarily 
disabled (according to Pinkerton).

Comment 19

[Chris Waterson]

I think if you verify 30710, that it will be sufficient to say this is "fixed".

Comment 20

[Tom Everingham]

 Checked NT 2000040307.  Marking verified.

Comment 21

[Pulsebot]

Pushed by ffxbld-merge:
https://hg.mozilla.org/releases/mozilla-beta/rev/c3edaf16502d
[fenix] For https://github.com/mozilla-mobile/fenix/issues/21006 & https://github.com/mozilla-mobile/fenix/issues/21005: fixed ETP status info display