22648 - mozilla seg faults on NT

Status: VERIFIED DUPLICATE of bug 21556

(Core :: XPCOM, defect, P3)

Description

[Chris Abbey]

launching mozilla.exe on Win NT segfaults with an access error c0000005
immediately if there is an existing profile, after profile generation if there
is not. machine: 2x PII 450, 256MB RAM, NT4 SP5.

H:\m12-fc\bin>mozilla
*** QfaServices is being registered
*** Deferring registration of sample JS components
*** Registering sidebar JS components
*** Registering sample JS components
nNCL: registering deferred (0)
nNCL: registering deferred (0)
WEBSHELL+ = 1
WEBSHELL+ = 2
5758768 : Focus occurred on: Window with a XUL doc (happens twice)
calling loadpage...
startPage:: newProfile1_1
got a request
5758768 : Focus occurred on: A Focusable DOM Element
got a request
5758768 : Blur occurred on: A Focusable DOM Element
5758768 : Focus occurred on: A Focusable DOM Element
WEBSHELL- = 1
WEBSHELL- = 0
WEBSHELL+ = 1
 I am inside the initialize
 Hey : You are in QFA Startup
(QFA)Talkback loaded Ok.
WEBSHELL+ = 2

H:\m12-fc\bin>

I've also recreated with FullCircle and sent the data.

Comment 1

[John Morrison]

[e-mail] : If the the crash report is pointing at JS3250.DLL, then
this is very likely bug #19165.

Can you check the version numbers for MSVCRT.DLL and MSVCIRT.DLL (typically in
C:\WinNT\System32 on NT, but that depends on how your OS was installed).

The version numbers for the Microsoft C Runtime Libraries MSVCRT.DLL and
MSVCIRT.DLL must be (at minimum) 6.0.8168.0.  However, the installer will
update these DLLs as required (but will require a reboot).  Have you run the
installer?

Comment 2

[Chris Abbey]

msvcrt.dll 5.00.7303
msvcirt.dll 5.00.7022

looks like that may be it. I think though there may be a documentation defect
then... as far as I know I did everything correctly:

I downloaded
ftp://ftp.mozilla.org/pub/mozilla/releases/m12/mozilla-win32-M12.zip
(or the fullcircle version) which is labeled as "Win32 Install Zipfile"
unziped it and ran mozilla.exe.

There is a statement in the relnotes that says <blockquote>Important: You must
run the Seamonkey installer at least once when installing M12. The installer
updates some system DLLs that the zip file cannot change. These updated system
DLLs are necessary to prevent a crash on launch of Seamonkey.</blockquote>

However there is no mention of what this installer is, or where it is located.
I've searched the installed tree, and dug though almost every page on
mozilla.org to no avail. Where do I get the updated libs then? (yes I read the
link to micros~1's support page... I'm asking how the generic Mozilla user would
get them, where is this installer?)

Comment 3

[John Morrison]

> However there is no mention of what this installer is, or where it
> is located.

That would be:
 ftp://ftp.mozilla.org/pub/mozilla/releases/m12/mozilla-win32-installer-M12.exe

The above is the Mozilla installer for m12 (and it usually available
in a nightly build directory as well [see

  news://news.mozilla.org/386F89F0.EB39FBD0%40netscape.com

for dveditz comments]) -- it is the same as the .zip file, except that
it will run an install program, and does not include various
test/sample chunks of code. You can run this installer one time, and
then simply copy the contents of the
   '.\bin'
directory (from the .zip file) over top of the contents of the
   '.\Program Files\Netscape\Seamonkey'
directory (which is created by the installer).

However, I agree that the release notes do not make this sufficiently
clear (as evidenced by the many duplicate reports of this crash). So,
I am changing the summary of this bug to:

 'Mnn Release Notes must be clear on MS VC Runtime DLL requirements'

and Assigning to '[e-mail]' as owner for Release Notes (as
far as I know), with a request to 'beef up' this statement in the M13
Release Notes. verah : please ask me (3jrgm) for more information if
you need it (but see bug #19165 for the 'gruesome' history).

[e-mail] : Thanks for looking into this. Can you please update
this bug report if (and when :-]) running the installer clears up this
crash for you. Cheers, John.

Comment 4

[John Morrison]

> You can run this installer one time, and then simply copy the contents of
> the '.\bin' directory (from the .zip file) over top of the contents of the
> '.\Program Files\Netscape\Seamonkey' directory (which is created by the
> installer).

Aaargh! My comments above could be inferred as -- "download the installer
and run it; then download the .zip, and copy over .\Seamonkey".

That is not what I meant, and that is not the case.

To be abundantly clear (for future reference) -- if you run the installer, you
will have a fully functioning Mozilla. No further action is required.

However, *if* you want to update the code with the latest nightly build, and/or
add in the test/sample code, you can do the 'copy' operation noted above.

Comment 5

[Chris Abbey]

John: I groked ya the first time ;)

I've downloaded the installer and am now at the requsite levels
(6.00.8168.0) for both dlls. (woohoo! survived the first reboot
of 2000)

This did not solve the problem however! The intial window (anyone know the
command line?) that the installer ran after reboot poped up breifly then bombed
out as follows:
State Dump for Thread Id 0xa4

eax=00000111 ebx=00000000 ecx=00000000 edx=77fa80b0 esi=030bcee0 edi=00000000
eip=77f6cc84 esp=0012f8a0 ebp=0012f8d4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000206


function: RtlDeleteCriticalSection
        77f6cc62 c745e000000000   mov   dword ptr [ebp-0x20],0x0
ss:02eee2da=????????
        77f6cc69 68b080fa77       push    0x77fa80b0
        77f6cc6e e88da8ffff       call    RtlEnterCriticalSection (77f67500)
        77f6cc73 33c9             xor     ecx,ecx
        77f6cc75 894dfc           mov     [ebp-0x4],ecx
ss:02eee2da=????????
        77f6cc78 8b4508           mov     eax,[ebp+0x8]
ss:02eee2da=????????
        77f6cc7b 8b00             mov     eax,[eax]
ds:00000111=????????
        77f6cc7d 8945e4           mov     [ebp-0x1c],eax
ss:02eee2da=????????
        77f6cc80 3bc1             cmp     eax,ecx
        77f6cc82 7417             jz      RtlDeleteCriticalSection+0x71
(77f6cc9b)
FAULT ->77f6cc84 8b4808           mov     ecx,[eax+0x8]
ds:02dbeb17=65007300
        77f6cc87 8b400c           mov     eax,[eax+0xc]
ds:02dbeb17=65007300
        77f6cc8a 8908             mov     [eax],ecx
ds:00000111=????????
        77f6cc8c 894104           mov     [ecx+0x4],eax
ds:02dbea06=00000000
        77f6cc8f 8b7de4           mov     edi,[ebp-0x1c]
ss:02eee2da=????????
        77f6cc92 33c0             xor     eax,eax
        77f6cc94 b908000000       mov     ecx,0x8
        77f6cc99 f3ab             rep     stosd
es:00000000=????????
        77f6cc9b c745fcffffffff
ss:02eee2da=????????
                                  mov     dword ptr [ebp-0x4],0xffffffff
        77f6cca2 68b2ccf677       push    0x77f6ccb2
        77f6cca7 68b080fa77       push    0x77fa80b0
        77f6ccac e81fa9ffff       call    RtlLeaveCriticalSection (77f675d0)

*----> Stack Back Trace <----* [munged by cabbey@home]

 Function Name
 ntdll!RtlDeleteCriticalSection
 nspr3!PR_DestroyCondVar  (FPO: [1,0,1])
 nspr3!PR_DestroyMonitor  (FPO: [1,0,1])
 xpcom!nsAutoMonitor::DestroyMonitor  (FPO: [1,0,0])
 necko!nsProxyObjectCallInfo::operator=  (FPO: [0,0,1])
 necko!nsProxyObjectCallInfo::operator=  (FPO: [1,0,1])
 necko!nsProxyObjectCallInfo::operator=  (FPO: [1,0,0])
 xpcom!operator<< [omap]  (FPO: [0,0,1])
 xpcom!operator<< [omap]  (FPO: [1,0,1])
 xpcom!operator<< [omap]  (FPO: [1,0,1])
 xpcom!operator<< [omap]  (FPO: [1,0,1])
 xpcom!nsCOMPtr_base::~nsCOMPtr_base  (FPO: [0,0,0])
 gkparser!nsExpatTokenizer::HandleExternalEntityRef
 gkparser!NSGetModule
 gkparser!NSGetModule
 gkparser!NSGetModule  (FPO: [4,0,1])
 gkparser!NSGetModule
 gkparser!nsExpatTokenizer::ParseXMLBuffer
 gkparser!nsExpatTokenizer::ConsumeToken  (FPO: [1,0,3])
 gkparser!nsParser::Tokenize  (FPO: [EBP 0x804e03f7] [1,0,4])
 gkparser!nsParser::ResumeParse  (FPO: [2,0,3])
 gkparser!nsParser::OnDataAvailable

just running mozilla.exe after that causes the same failure.

John: you seem to have more of a feel for mozilla.org than I, your
opinion please,
idea 1. let this defect go as a documentation defect and open a new one
for the crash.
idea 2. let this defe go and reopen 19165.
idea 3. continue to pursue this under this defe.

I'm leaning twoard #1 myself....

Comment 6

[John Morrison]

Man, I was so sure that you would just sail through after updating the DLLs.

On first reading your last message, I initially agreed that opening a new bug
for this new crash was the right thing. But, after a re-think, it's probably
better to keep all your history here, and I'll open a new bug for the release
note issue.

Can you try the following, and then try the install again. (You may be
crashing on some left over cruft from the previous attempts at installation).

1. Delete the directory where you installed Seamonkey
2. Delete c:\windows\mozregistry.dat (c:\winnt\mozregistry.dat)
3. Delete the user profile directory, \users50

[By the way, I think the command line is 'mozilla.exe -installer' but if you
really want to be sure, after running the installer, but before rebooting,
search the windows registry for 'Seamonkey' and look at the one you find under
'RunOnce' -- however, the reason for the reboot is so that the new runtime
DLLs can be put in place (since the old versions are likely locked in memory
until you shutdown).]

verah: I'm going to pull this bug back, and I'll file a nice, shiny, new bug
report for the release notes issue.

Comment 7

[verah (gone)]

Thanks, and sorry the the m12 release notes didn't sufficiently explain the
problem. Since I suffered from this bug myself (for several days), I should have
gotten it right in the release notes!

Comment 8

[Chris Abbey]

I had done those three steps each attempt (like I said, I read every blasted
page on mozilla.org I could find that might have helped ;) I'll take another
shot at the installer tommorow night - but seeing as how I did those three very
steps I don't see as how the results are going to change. (I'll also copy down
the runonce key, I figured that's where it was, but it deleted itself before I
knew it was there.)

I hate to ask, but do you know if any of the developers are using SMP boxes? I'm
an engineer myself and I was alarmed the first time our performance team ran our
product on an SMP machine, the underlying system (Sun's JVM) fell apart in that
environment... that's one of the reasons I got SMP for my new machine at home,
and why our product test teams are now equiped with 1/3 to 1/2 SMP machines...
stuff just breaks in an SMP environment.

Comment 9

[John Morrison]

[e-mail] : My bad. You did say that you had cleaned up the cruft, and
still had a crash on startup.

I also missed the fact that you are running SMP. To answer your question: I
believe that some of the developers run on SMP, but they would rarely try to
install a nightly build onto a Mozilla-virgin system. (They'd just build and
run).

Looking again at the stack trace, and considering SMP, I note that it dies as:

  ntdll!RtlDeleteCriticalSection
  nspr3!PR_DestroyCondVar  (FPO: [1,0,1])
  nspr3!PR_DestroyMonitor  (FPO: [1,0,1])
  xpcom!nsAutoMonitor::DestroyMonitor  (FPO: [1,0,0])

Hmmm. Passing on to dp as default XPCOM owner, cc: rpotts for Threading (but
this stuff is way beyond my tiny brain).

(One small question: [e-mail] : you're running off H:\ ... is that a
network drive?  That shouldn't ultimately make a difference, but may be
relevant to reproducing this crash.)

[NOTE for others: This bug initially had a problem with running with
MSVC?RT.DLL < 6.0.8186.0 but that is no longer an active issue. DLLs have been
updated to 6.0.8186.0].

Comment 10

[Suresh Duddi (gone)]

Doug, this seems to be so proxy releated. Can you check if something smells
funny here.

Comment 11

[Doug Turner (:dougt)]

yup, it is mine and a sounds like a dup of 21556 & 18110.

Comment 12

[Chris Abbey]

John: H:\ (aka hell drive) is a big fast ntfs stripe set used for builds and
other large temporary storage needs.

doug et al: I have similar network setup to user in 21556 - linux ip masq
firewall as a gateway. Ran the testcase listed there and got five out of five
failures; the first one took "forever" to fail (and since it was the first time
I'd seen the new interface I was putzin' around when it blew... looks good
though) did a scratch install from there and captured these four failures
without touching anyting. Note the pattern of fully loading the page and
crashing after two or three minutes versus crashing before finishing the page
load....

H:\SEAMON~1>mozilla
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=3954
nNCL: registering deferred (0)
WEBSHELL+ = 1
WEBSHELL+ = 2
nsXULKeyListenerImpl::Init()
WEBSHELL+ = 3
Setting content window
browser.startup.page = 1
startpage = http://www.mozilla.org/projects/seamonkey/release-notes/m12.html
failed to set the page title.
45076288 : Focus occurred on: Window with an HTML doc (happens twice)
45076288 : Focus occurred on: Window with an HTML doc (happens twice)
45076288 : Focus occurred on: Window with an HTML doc (happens twice)
WEBSHELL+ = 4
failed to set the page title.
Document http://bugzilla.mozilla.org/showattachment.cgi?attach_id=3954 loaded
successfully
Document: Done (5 secs)

H:\SEAMON~1>mozilla
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=3954
nNCL: registering deferred (0)
WEBSHELL+ = 1
WEBSHELL+ = 2
nsXULKeyListenerImpl::Init()
WEBSHELL+ = 3
Setting content window
browser.startup.page = 1
startpage = http://www.mozilla.org/projects/seamonkey/release-notes/m12.html
failed to set the page title.
45061392 : Focus occurred on: Window with an HTML doc (happens twice)
45061392 : Focus occurred on: Window with an HTML doc (happens twice)
45061392 : Focus occurred on: Window with an HTML doc (happens twice)
WEBSHELL+ = 4
failed to set the page title.

H:\SEAMON~1>mozilla
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=3954
nNCL: registering deferred (0)
WEBSHELL+ = 1
WEBSHELL+ = 2
nsXULKeyListenerImpl::Init()
WEBSHELL+ = 3
Setting content window
browser.startup.page = 1
startpage = http://www.mozilla.org/projects/seamonkey/release-notes/m12.html
failed to set the page title.
45061328 : Focus occurred on: Window with an HTML doc (happens twice)
45061328 : Focus occurred on: Window with an HTML doc (happens twice)
45061328 : Focus occurred on: Window with an HTML doc (happens twice)
WEBSHELL+ = 4
failed to set the page title.
Document http://bugzilla.mozilla.org/showattachment.cgi?attach_id=3954 loaded
successfully
Document: Done (5.344 secs)

H:\SEAMON~1>mozilla
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=3954
nNCL: registering deferred (0)
WEBSHELL+ = 1
WEBSHELL+ = 2
nsXULKeyListenerImpl::Init()
WEBSHELL+ = 3
Setting content window
browser.startup.page = 1
startpage = http://www.mozilla.org/projects/seamonkey/release-notes/m12.html
failed to set the page title.
45061248 : Focus occurred on: Window with an HTML doc (happens twice)
45061248 : Focus occurred on: Window with an HTML doc (happens twice)
45061248 : Focus occurred on: Window with an HTML doc (happens twice)
WEBSHELL+ = 4
failed to set the page title.

H:\SEAMON~1>

a quick look in the dr watson log shows that each failure was in a different
stack trace. Do you want them all appended? some subset?

anyway, let me know what you need... I'll get it.

Comment 13

[John Morrison]

Hey [e-mail] : I just want to say -- Thanks for all your hard work on
this bug (and for your tolerance with my (sometimes) pedantic queries (aka
stupid questions :-?). You got the right guys now. (I'm outta here, but hope
to see you again, on another bug, another day.) Cheers, John.
(sidenote: dougt & rpotts -- sorry for the spam ...)

Comment 14

[Doug Turner (:dougt)]

marking as dup.

*** This bug has been marked as a duplicate of 21556 ***

Comment 15

[Brent Metzler]

This is verified as an smp bug as described by <a
href="http://bugzilla.mozilla.org/show_bug.cgi?id=21556">21556</a>.