286987 - crash [@ nsXULPrototypeCache::WritePrototype(nsXULPrototypeDocument*)], v2 [@ nsXULPrototypeCache::WritePrototype]

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[timeless]

preface:
user = test
os = wxp
fs = ntfs5
quotas = enabled for user test on volume c:, limit: 1mb

+	gFastLoadService	0x00000000	nsIFastLoadService *
+	oldURI	{mRawPtr=0x00000000 }	nsCOMPtr<nsIURI>
+	this	0x01670580 {mRefCnt={mValue=6 } _mOwningThread={mThread=0x00344708 }
mPrototypeTable={...} ...}	nsXULPrototypeCache * const
+	aPrototypeDocument	0x06fefdd0 {mRefCnt={mValue=2 }
_mOwningThread={mThread=0x00344708 } mURI={mRawPtr=0x06e97c50
{mRefCnt={mValue=11 } _mOwningThread={mThread=0x00344708 } mSpec={...} ...} }
...}	nsIXULPrototypeDocument *
	rv	0	unsigned int
+	objectInput	{mRawPtr=0x03daf9e8 {mHeader={mMagic=0x03dafa08 "XPCOM
MozFASL
”ÿù" mChecksum=4194276371 mVersion=4 ...} mFooter={gDummyID={m0=0 m1=0 m2=0
...} gDummySharpObjectEntry={mReadObject={...} mSkipOffset=0 mSaveStrongRefCnt=0
...} mIDMap=0x03e52450 {m0=3734270672 m1=32820 m2=4563 ...} ...}
mCurrentDocumentMapEntry=0x00000000 {mNextSegmentOffset=??? mBytesLeft=???
mNeedToSeek=??? ...} } }	nsCOMPtr<nsIObjectInputStream>
+	objectOutput	{mRawPtr=0x06c8ee90 {mInputStream={mRawPtr=0x03d5aaf8 } } }
nsCOMPtr<nsIObjectOutputStream>
-	protoURI	{mRawPtr=0x06e97c50 {mRefCnt={mValue=11 }
_mOwningThread={mThread=0x00344708 } mSpec={...} ...} }	nsCOMPtr<nsIURI>
\-	mRawPtr	0x06e97c50 {mRefCnt={mValue=11 } _mOwningThread={mThread=0x00344708 }
mSpec={...} ...}	nsIURI *
 |-	[nsStandardURL]	{mRefCnt={mValue=11 } _mOwningThread={mThread=0x00344708 }
mSpec={...} ...}	nsStandardURL
 ||+	nsIFileURL	{...}	nsIFileURL
 ||+	nsIStandardURL	{...}	nsIStandardURL
 ||+	nsISerializable	{...}	nsISerializable
 ||+	nsIClassInfo	{...}	nsIClassInfo
 ||+	mRefCnt	{mValue=11 }	nsAutoRefCnt
 ||+	_mOwningThread	{mThread=0x00344708 }	nsAutoOwningThread
 ||-	mSpec	{...}	nsCString
 ||\-	nsCSubstring	{...}	nsCSubstring
 || \-	nsACString	{mVTable=0x00530828 const nsObsoleteACStringThunk::`vftable'
mData=0x06ceb1a8 "chrome://global/content/console.xul" mLength=35 ...}	const
nsACString
 ||  |	mVTable	0x00530828 const nsObsoleteACStringThunk::`vftable'	const void *
 ||  |+	mData	0x06ceb1a8 "chrome://global/content/console.xul"	char *
 ||  |	mLength	35	unsigned int
 ||  \	mFlags	5	unsigned int
 ||	mDefaultPort	-1	int
 ||	mPort	-1	int
 ||+	mScheme	{mPos=0 mLen=6 }	nsStandardURL::URLSegment
 ||+	mAuthority	{mPos=9 mLen=6 }	nsStandardURL::URLSegment
 ||+	mUsername	{mPos=9 mLen=-1 }	nsStandardURL::URLSegment
 ||+	mPassword	{mPos=9 mLen=-1 }	nsStandardURL::URLSegment
 ||+	mHost	{mPos=9 mLen=6 }	nsStandardURL::URLSegment
 ||+	mPath	{mPos=15 mLen=20 }	nsStandardURL::URLSegment
 ||+	mFilepath	{mPos=15 mLen=20 }	nsStandardURL::URLSegment
 ||+	mDirectory	{mPos=15 mLen=9 }	nsStandardURL::URLSegment
 ||+	mBasename	{mPos=24 mLen=7 }	nsStandardURL::URLSegment
 ||+	mExtension	{mPos=32 mLen=3 }	nsStandardURL::URLSegment
 ||+	mParam	{mPos=15 mLen=-1 }	nsStandardURL::URLSegment
 ||+	mQuery	{mPos=15 mLen=-1 }	nsStandardURL::URLSegment
 ||+	mRef	{mPos=15 mLen=-1 }	nsStandardURL::URLSegment
 ||+	mOriginCharset	{...}	nsCString
 ||+	mParser	{mRawPtr=0x0168d1c8 }	nsCOMPtr<nsIURLParser>
 ||+	mFile	{mRawPtr=0x00000000 }	nsCOMPtr<nsIFile>
 ||+	mHostA	0x00000000 <Bad Ptr>	char *
 ||	mHostEncoding	1	unsigned int
 ||	mSpecEncoding	1	unsigned int
 ||	mURLType	1	unsigned int
 ||	mMutable	1	unsigned int
 ||	mSupportsFileURL	0	unsigned int
 ||+	gIDNService	0x00be50d8 {mRefCnt={mValue=4 }
_mOwningThread={mThread=0x00344708 } mMultilingualTestBed=0 ...}	nsIIDNService *
 ||+	gCharsetMgr	0x00000000	nsICharsetConverterManager *
 ||	gInitialized	1	int
 ||	gEscapeUTF8	1	int
 |\	gAlwaysEncodeInUTF8	1	int
 \+	nsISupports	{...}	nsISupports
	rv2	0	unsigned int
	count	0	int

gFastLoadService->SelectMuxedDocument(protoURI, getter_AddRefs(oldURI));
//was ok
aPrototypeDocument->Write(objectOutput);
//almost certainly failed
gFastLoadService->EndMuxedDocument(protoURI);
//gFastLoadService null _there_, so we crashed
my bet is that Write did us the favor of releasing fastloadservice :)

 	gklayout.dll!nsXULPrototypeCache::WritePrototype(nsIXULPrototypeDocument *
aPrototypeDocument=0x06fefdd0)  Line 622 + 0xe	C++
 	gklayout.dll!nsXULDocument::ResumeWalk()  Line 3178	C++
 	gklayout.dll!nsXULDocument::OnStreamComplete(nsIStreamLoader *
aLoader=0x00000000, nsISupports * context=0x00000000, unsigned int aStatus=0,
unsigned int stringLen=19278, const unsigned char * string=0x06e7c0e0)  Line
3456 + 0xe	C++
 	necko.dll!nsStreamLoader::OnStopRequest(nsIRequest * request=0x06d77360,
nsISupports * ctxt=0x00000000, unsigned int aStatus=0)  Line 137	C++
 	jar50.dll!nsJARChannel::OnStopRequest(nsIRequest * req=0x06d77798, nsISupports
* ctx=0x00000000, unsigned int status=0)  Line 694	C++
 	necko.dll!nsInputStreamPump::OnStateStop()  Line 507	C++
 	necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *
stream=0x06d77898)  Line 343 + 0xb	C++
 	xpcom_core.dll!nsInputStreamReadyEvent::EventHandler(PLEvent *
plevent=0x06d77824)  Line 119	C++
 	xpcom_core.dll!PL_HandleEvent(PLEvent * self=0x06d77824)  Line 698 + 0xa	C
 	xpcom_core.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x00be3478)  Line
633 + 0x9	C
 	xpcom_core.dll!_md_EventReceiverProc(HWND__ * hwnd=0x00120b18, unsigned int
uMsg=49408, unsigned int wParam=0, long lParam=12465272)  Line 1435 + 0x9	C
 	user32.dll!_InternalCallWinProc@20()  + 0x28	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7	
 	user32.dll!_DispatchMessageWorker@8()  + 0xdc	
 	user32.dll!_DispatchMessageW@4()  + 0xf	
 	gkwidget.dll!nsAppShell::Run()  Line 135	C++
 	appcomps.dll!nsAppStartup::Run()  Line 208	C++
 	mozilla.exe!main1(int argc=1, char * * argv=0x00347930, nsISupports *
nativeApp=0x00c06230)  Line 1325 + 0x20	C++
 	mozilla.exe!main(int argc=1, char * * argv=0x00347930)  Line 1831 + 0x25	C++
 	mozilla.exe!mainCRTStartup()  Line 398 + 0x11	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23

Comment 1

[timeless]

oh, i was of course trying to open the jsconsole

the only interesting message it had for me was:
Error: can't encode principals (failure code 80004005)

the only interesting console output is
WARNING: waaah!, file
r:/mozilla/content/xul/document/src/nsXULPrototypeDocument.cpp, line 869
JavaScript error: , line 0:

if you need access to a quotable account running on w2k, it can be arranged
(rdesktop to raistlin)

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: potential patch

I don't see why this call is here. We don't AbortFastLoads() on any other
Serialization functions, and we don't appear to expect it. Note that
nsXULPrototypeSript::DeserializeOutOfLine() also makes a similar call, but we
seem to expect it (see the comment at the end of
nsXULPrototypeElement::Deserialize()). I also feel that it makes more sense to
avoid the cache if deserialization fails, but I'm not even sure if this fix is
entirely correct.

The alternative would be an early return in WritePrototype().

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 178198 [details] [diff] [review]
potential patch

>-    if (NS_FAILED(rv))
>-        cache->AbortFastLoads();

This removal leaves only one AbortFastLoads call, in the chrome channel when
failing to add a dependency.  That seems arbitrary.

The idea is to abort on serialization error, just as on deserialization, so as
to avoid leaving bad bits in the filesystem.  Fletcher's checksum is good, but
it won't catch all corruptions, although other checks should save us if we fail
to update (extend) a valid file (the footer should be trashed and the header's
fields should be detectably invalid).

Nevertheless, instead of removing serialization-path aborts one by one, I'd
rather see us return early in WritePrototype, if we can.  Generally, falling
through on error is a bad idea; sometimes it's more efficient (see the rv |=
... pattern in nsXULElement.cpp's read and write methods), but if there are
nested data dependencies such as the one here on gFastLoadService, bailing out
wins.

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: patch v2

So, something more like this.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 178260 [details] [diff] [review]
patch v2

brendan says r=him.

Comment 6

[Boris Zbarsky [:bzbarsky]]

So we're guaranteed that if rv is error here that we called AbortFastloads?  If
not, don't we fail to close the stream and release some globals?

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 178260 [details] [diff] [review]
patch v2

sr- pending response to comment 6.

Comment 8

[Siyivan]

Is this really what caused me a crash today? I can hardly believe it has been broken with an available patch for 4 years :O

What happened: Firefox detected an Addon update, but couldn't download it to install.
Then, it crashed when trying to continue.

The pointer gFastLoadService is NULL at line  gFastLoadService->EndMuxedDocument(protoURI); at nsXULPrototypeCache::WritePrototype

Stacktrace:
	xul.dll!nsXULPrototypeCache::WritePrototype(nsXULPrototypeDocument * aPrototypeDocument=0x00000000)  Line 523 + 0x8 bytes	C++
 	xul.dll!nsXULDocument::DoneWalking()  Line 3201	C++
 	xul.dll!nsXULDocument::ResumeWalk()  Line 3143 + 0x7 bytes	C++
 	xul.dll!nsXULDocument::OnStreamComplete(nsIStreamLoader * aLoader=0x02337b60, nsISupports * context=0x00000000, unsigned int aStatus=0, unsigned int stringLen=5166, const unsigned char * string=0x022fa2c8)  Line 3594 + 0xb bytes	C++
 	xul.dll!nsStreamLoader::OnStopRequest(nsIRequest * request=0x021ea398, nsISupports * ctxt=0x00000000, unsigned int aStatus=0)  Line 110	C++
 	xul.dll!nsJARChannel::OnStopRequest(nsIRequest * req=0x021ea778, nsISupports * ctx=0x00000000, unsigned int status=0)  Line 880	C++
 	xul.dll!nsInputStreamPump::OnStateStop()  Line 577	C++
 	xul.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream * stream=0x022fa010)  Line 402	C++
 	xul.dll!nsOutputStreamReadyEvent::Run()  Line 112	C++
 	xul.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012fc70)  Line 511	C++
 	xul.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x00000001, int mayWait=1)  Line 230 + 0xd bytes	C++
 	xul.dll!nsBaseAppShell::Run()  Line 170 + 0x8 bytes	C++
 	xul.dll!nsAppStartup::Run()  Line 194	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x0064a2e8, const nsXREAppData * aAppData=0x0064a698)  Line 3341	C++
 	firefox.exe!NS_internal_main(int argc=1, char * * argv=0x0064a2e8)  Line 157	C++
 	firefox.exe!wmain(int argc=6595304, wchar_t * * argv=0x00648368)  Line 112	C++
 	firefox.exe!__tmainCRTStartup()  Line 583 + 0x17 bytes	C
 	kernel32.dll!RegisterWaitForInputIdle()  + 0x49 bytes

Comment 9

[Boris Zbarsky [:bzbarsky]]

Well, the patch doesn't look correct, and the patch author never responded to the questions about that...

Comment 10

[Wayne Mery (:wsmwk)]

eg. bp-aa9fdc3e-d460-4b99-b0d8-37d002100210

looks like 3/4 of crashes are startup.
tons of email addresses in the crash reports

Comment 11

[Wayne Mery (:wsmwk)]

Gary, does patch still apply? 
Siyivan, would you be able to answer for comment 6?

Comment 12

[Siyivan]

Wayne, I just had a crash with a debugger ready. A quick bugzilla search lead me here.
I don't know anything about AbortFastloads. I don't think it was reproducible, so I could only look at the code and try to figure the code path just with the information available in comment 8.

Comment 13

[Wayne Mery (:wsmwk)]

in past month only 3 version 18 crashes and oeversion 17 crashes
bp-bde0c93e-b28b-45ba-bd38-b2f8e2130131 
bp-9313cfdf-ea51-4684-bd26-fa30c2130131
bp-b99db420-89ab-4f3d-ab9e-c91742130127
bp-e28ea3d4-cb3c-4980-aa5f-ebab92130121 ff17

so whatever the original crash was, it's virtually gone after the still high crash rate for v3.1.x.  or signature has morhped.

WFM