369823 - oom crash [@ nsHandleSSLError]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Security: UI, defect)

Description

[timeless]

alternate thread (ssl) crashed:
ntdll!KiFastSystemCallRet
ntdll!NtRaiseHardError+0xc
kernel32!UnhandledExceptionFilter+0x653
MSVCR80D!_XcptFilter(unsigned long xcptnum = 0xe06d7363, struct _EXCEPTION_POINTERS * pxcptinfoptrs = 0x041cf634)+0x61 [f:\rtm\vctools\crt_bld\self_x86\crt\src\winxfltr.c @ 237]
MSVCR80D!_callthreadstartex(void)+0x7a [f:\rtm\vctools\crt_bld\self_x86\crt\src\threadex.c @ 350]
MSVCR80D!_EH4_CallFilterFunc(void)+0x12
MSVCR80D!_except_handler4_common(unsigned int * CookiePointer = 0x10310974, <function> * CookieCheckFunction = 0x102150b0, struct _EXCEPTION_RECORD * ExceptionRecord = 0x041cf748, struct _EXCEPTION_REGISTRATION_RECORD * EstablisherFrame = 0x041cff98, struct _CONTEXT * ContextRecord = 0x041cf768, void * DispatcherContext = 0x041cf71c)+0xba
MSVCR80D!_except_handler4(struct _EXCEPTION_RECORD * ExceptionRecord = 0x041cf748, struct _EXCEPTION_REGISTRATION_RECORD * EstablisherFrame = 0x041cff98, struct _CONTEXT * ContextRecord = 0x041cf768, void * DispatcherContext = 0x041cf71c)+0x22
ntdll!ExecuteHandler2+0x26
ntdll!ExecuteHandler+0x24
ntdll!KiUserExceptionDispatcher+0xe
kernel32!RaiseException+0x53
MSVCR80D!_CxxThrowException(void * pExceptionObject = 0x041cfad8, struct _s__ThrowInfo * pThrowInfo = 0x103037e4)+0x50 [f:\rtm\vctools\crt_bld\self_x86\crt\prebuild\eh\throw.cpp @ 166]
MSVCR80D!operator new(unsigned int size = 0x28)+0x75 [f:\rtm\vctools\crt_bld\self_x86\crt\src\new.cpp @ 64]
i18n!nsStringBundleService::getStringBundle(char * aURLSpec = 0x03205a0c "chrome://branding/locale/brand.properties", class nsIStringBundle ** aResult = 0x041cfe88)+0x5e [c:\home\mozilla.org\mozilla\intl\strres\src\nsstringbundle.cpp @ 640]
i18n!nsStringBundleService::CreateBundle(char * aURLSpec = 0x03205a0c "chrome://branding/locale/brand.properties", class nsIStringBundle ** aResult = 0x041cfe88)+0x13 [c:\home\mozilla.org\mozilla\intl\strres\src\nsstringbundle.cpp @ 726]
pipnss!nsHandleSSLError(class nsNSSSocketInfo * socketInfo = 0x7243cf58, int err = -12213)+0x1e7 [c:\home\mozilla.org\mozilla\security\manager\ssl\src\nsnssiolayer.cpp @ 560]
pipnss!nsSSLThread::checkHandshake(int bytesTransfered = -1, struct PRFileDesc * ssl_layer_fd = 0x04dfb990, class nsNSSSocketInfo * socketInfo = 0x7243cf58)+0xcc [c:\home\mozilla.org\mozilla\security\manager\ssl\src\nsnssiolayer.cpp @ 1150]
pipnss!nsSSLThread::Run(void)+0x27f [c:\home\mozilla.org\mozilla\security\manager\ssl\src\nssslthread.cpp @ 939]
pipnss!nsPSMBackgroundThread::nsThreadRunner(void * arg = 0x04d1bf20)+0x16 [c:\home\mozilla.org\mozilla\security\manager\ssl\src\nspsmbackgroundthread.cpp @ 45]
nspr4!_PR_NativeRunThread(void * arg = 0x10204767)+0xdb [c:\home\mozilla.org\mozilla\nsprpub\pr\src\threads\combined\pruthr.c @ 436]
nspr4!pr_root(void * arg = 0x10204767)+0xd [c:\home\mozilla.org\mozilla\nsprpub\pr\src\md\windows\w95thred.c @ 120]
MSVCR80D!_callthreadstartex(void)+0x51 [f:\rtm\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348]
MSVCR80D!_threadstartex(void * ptd = 0x04d1ccd8)+0x87 [f:\rtm\vctools\crt_bld\self_x86\crt\src\threadex.c @ 331]
kernel32!BaseThreadStart+0x37

bundleCacheEntry_t *
nsStringBundleService::insertIntoCache(nsIStringBundle* aBundle,
                                       nsCStringKey* aHashKey)
{
...
    
  // at this point we have a new cacheEntry that doesn't exist
  // in the hashtable, so set up the cacheEntry
  cacheEntry->mBundle = aBundle;
  NS_ADDREF(cacheEntry->mBundle);

  cacheEntry->mHashKey = (nsCStringKey*)aHashKey->Clone();
/* this can fail */
  // insert the entry into the cache and map, make it the MRU
  mBundleMap.Put(cacheEntry->mHashKey, cacheEntry);
/* this would corrupt the table */
  return cacheEntry;
}



static nsresult
nsHandleSSLError(nsNSSSocketInfo *socketInfo, PRInt32 err)
{
...
  nsCOMPtr<nsIStringBundleService> service = 
                              do_GetService(StringBundleServiceCID, &rv);
/* missing failure check */
  nsCOMPtr<nsIStringBundle> brandBundle;
  service->CreateBundle("chrome://branding/locale/brand.properties",
                        getter_AddRefs(brandBundle));
/* this call *FAILED* and would have crashed if not for our c++ suckiness (some other bug, don't worry, it'll be fixed, and then we can get back to our regularly scheduled crash */
  nsXPIDLString brandShortName;
/* we crash here: */
  brandBundle->GetStringFromName(NS_LITERAL_STRING("brandShortName").get(),
                                 getter_Copies(brandShortName));
...    
      rv = displayAlert(formattedString, socketInfo);

static nsresult
displayAlert(nsAFlatString &formattedString, nsNSSSocketInfo *infoObject)
{
...
  // Finally, get a proxy for the nsIPrompt

  nsCOMPtr<nsIPrompt> proxyPrompt;
/* this could fail: */
  NS_GetProxyForObject(NS_PROXY_TO_MAIN_THREAD,
                       NS_GET_IID(nsIPrompt),
                       prompt,
                       NS_PROXY_SYNC,
                       getter_AddRefs(proxyPrompt));
/* we could crash here */
  proxyPrompt->Alert(nsnull, formattedString.get());
  return NS_OK;
}

and again, as usual, the main thread crashed (this is "bug 367474 comment 0 next, we have")
00 ntdll!KiFastSystemCallRet
01 ntdll!ZwWaitForMultipleObjects+0xc
02 kernel32!WaitForMultipleObjectsEx+0x12c
03 kernel32!WaitForMultipleObjects+0x18
04 faultrep!StartDWException+0x5df
05 faultrep!ReportFault+0x533
06 kernel32!UnhandledExceptionFilter+0x587
07 MSVCR80D!_XcptFilter(unsigned long xcptnum = 0xe06d7363, struct _EXCEPTION_POINTERS * pxcptinfoptrs = 0x0012d050)+0x61 [f:\rtm\vctools\crt_bld\self_x86\crt\src\winxfltr.c @ 237]
08 firefox!__tmainCRTStartup(void)+0x1f2 [f:\rtm\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 603]
09 MSVCR80D!_EH4_CallFilterFunc(void)+0x12
0a MSVCR80D!_except_handler4_common(unsigned int * CookiePointer = 0x00405010, <function> * CookieCheckFunction = 0x00401aa0, struct _EXCEPTION_RECORD * ExceptionRecord = 0x0012d164, struct _EXCEPTION_REGISTRATION_RECORD * EstablisherFrame = 0x0012ffa8, struct _CONTEXT * ContextRecord = 0x0012d184, void * DispatcherContext = 0x0012d138)+0xba
0b firefox!_except_handler4(struct _EXCEPTION_RECORD * ExceptionRecord = 0x0012d164, struct _EXCEPTION_REGISTRATION_RECORD * EstablisherFrame = 0x0012ffa8, struct _CONTEXT * ContextRecord = 0x0012d184, void * DispatcherContext = 0x0012d138)+0x22
0c ntdll!ExecuteHandler2+0x26
0d ntdll!ExecuteHandler+0x24
0e ntdll!KiUserExceptionDispatcher+0xe
0f kernel32!RaiseException+0x53
10 MSVCR80D!_CxxThrowException(void * pExceptionObject = 0x0012d4f4, struct _s__ThrowInfo * pThrowInfo = 0x103037e4)+0x50 [f:\rtm\vctools\crt_bld\self_x86\crt\prebuild\eh\throw.cpp @ 166]
11 MSVCR80D!operator new(unsigned int size = 0x34)+0x75 [f:\rtm\vctools\crt_bld\self_x86\crt\src\new.cpp @ 64]
12 xpc3250!nsXPCException::NewException(char * aMessage = 0x0012d6e8 "", unsigned int aResult = 0x80570021, class nsIStackFrame * aLocation = 0x00000000, class nsISupports * aData = 0x71974778, class nsIException ** exceptn = 0x0012d7f4)+0x4b [c:\home\mozilla.org\mozilla\js\src\xpconnect\src\xpcexception.cpp @ 423]
13 xpc3250!XPCConvert::ConstructException(unsigned int rv = 0x80570021, char * message = 0x0012d6e8 "", char * ifaceName = 0x00000000 "", char * methodName = 0x00000000 "", class nsISupports * data = 0x71974778, class nsIException ** exceptn = 0x0012d7f4)+0x14b [c:\home\mozilla.org\mozilla\js\src\xpconnect\src\xpcconvert.cpp @ 1313]
14 xpc3250!XPCConvert::JSErrorToXPCException(class XPCCallContext * ccx = 0x0012d7f8, char * message = 0x00578e6c "out of memory", char * ifaceName = 0x00000000 "", char * methodName = 0x00000000 "", struct JSErrorReport * report = 0x0012d8a0, class nsIException ** exceptn = 0x0012d7f4)+0x1b6 [c:\home\mozilla.org\mozilla\js\src\xpconnect\src\xpcconvert.cpp @ 1547]
15 xpc3250!xpcWrappedJSErrorReporter(struct JSContext * cx = 0x08e4ec88, char * message = 0x00578e6c "out of memory", struct JSErrorReport * report = 0x0012d8a0)+0xa0 [c:\home\mozilla.org\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp @ 704]
16 js3250!js_ReportOutOfMemory(struct JSContext * cx = 0x08e4ec88)+0x118 [c:\home\mozilla.org\mozilla\js\src\jscntxt.c @ 897]
17 js3250!JS_ReportOutOfMemory(struct JSContext * cx = 0x08e4ec88)+0xc [c:\home\mozilla.org\mozilla\js\src\jsapi.c @ 4726]
18 js3250!NewOrRecycledNode(struct JSContext * cx = 0x08e4ec88, struct JSTreeContext * tc = 0x0012e85c)+0x8c [c:\home\mozilla.org\mozilla\js\src\jsparse.c @ 182]
19 js3250!NewParseNode(struct JSContext * cx = 0x08e4ec88, struct JSTokenStream * ts = 0x71979e50, JSParseNodeArity arity = PN_NULLARY (0), struct JSTreeContext * tc = 0x0012e85c)+0x13 [c:\home\mozilla.org\mozilla\js\src\jsparse.c @ 240]
...
66 js3250!Statement(struct JSContext * cx = 0x08e4ec88, struct JSTokenStream * ts = 0x71979e50, struct JSTreeContext * tc = 0x0012e85c)+0x25ad [c:\home\mozilla.org\mozilla\js\src\jsparse.c @ 3509]
67 js3250!Statements(struct JSContext * cx = 0x08e4ec88, struct JSTokenStream * ts = 0x71979e50, struct JSTreeContext * tc = 0x0012e85c)+0xec [c:\home\mozilla.org\mozilla\js\src\jsparse.c @ 1471]
68 js3250!js_CompileTokenStream(struct JSContext * cx = 0x08e4ec88, struct JSObject * chain = 0x08ef9180, struct JSTokenStream * ts = 0x71979e50, struct JSCodeGenerator * cg = 0x0012e85c)+0x7c [c:\home\mozilla.org\mozilla\js\src\jsparse.c @ 501]
69 js3250!CompileTokenStream(struct JSContext * cx = 0x08e4ec88, struct JSObject * obj = 0x08ef9180, struct JSTokenStream * ts = 0x71979e50, void * tempMark = 0x08e4ece8, int * eofp = 0x00000000)+0xad [c:\home\mozilla.org\mozilla\js\src\jsapi.c @ 3793]
6a js3250!JS_CompileUCScriptForPrincipals(struct JSContext * cx = 0x08e4ec88, struct JSObject * obj = 0x08ef9180, struct JSPrincipals * principals = 0x08ebdbbc, unsigned short * chars = 0x71990548, unsigned int length = 0x92af, char * filename = 0x08f12de1 "https://mail.google.com/mail/?view=page&name=js&ver=lc5ztp6db8dz", unsigned int lineno = 0x49)+0x56 [c:\home\mozilla.org\mozilla\js\src\jsapi.c @ 3888]
6b js3250!obj_eval(struct JSContext * cx = 0x08e4ec88, struct JSObject * obj = 0x08ece460, unsigned int argc = 1, long * argv = 0x71977330, long * rval = 0x0012ea50)+0x411 [c:\home\mozilla.org\mozilla\js\src\jsobj.c @ 1338]
6c js3250!js_Invoke(struct JSContext * cx = 0x08e4ec88, unsigned int argc = 1, unsigned int flags = 0)+0xb3f [c:\home\mozilla.org\mozilla\js\src\jsinterp.c @ 1348]
6d js3250!js_Interpret(struct JSContext * cx = 0x08e4ec88, unsigned char * pc = 0x0903b6fb "y", long * result = 0x0012f0ec)+0xb769 [c:\home\mozilla.org\mozilla\js\src\jsinterp.c @ 4047]
6e js3250!js_Invoke(struct JSContext * cx = 0x08e4ec88, unsigned int argc = 1, unsigned int flags = 2)+0xbb2 [c:\home\mozilla.org\mozilla\js\src\jsinterp.c @ 1367]
6f xpc3250!nsXPCWrappedJSClass::CallMethod(class nsXPCWrappedJS * wrapper = 0x7f4d1068, unsigned short methodIndex = 3, struct XPTMethodDescriptor * info = 0x01d3f538, struct nsXPTCMiniVariant * nativeParams = 0x0012f454)+0xf7f [c:\home\mozilla.org\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp @ 1419]
70 xpc3250!nsXPCWrappedJS::CallMethod(unsigned short methodIndex = 3, struct XPTMethodDescriptor * info = 0x01d3f538, struct nsXPTCMiniVariant * params = 0x0012f454)+0x41 [c:\home\mozilla.org\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp @ 531]
71 xpcom_core!PrepareAndDispatch(class nsXPTCStubBase * self = 0x79ece7f8, unsigned int methodIndex = 3, unsigned int * args = 0x0012f514, unsigned int * stackBytesToPop = 0x0012f504)+0x323 [c:\home\mozilla.org\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp @ 114]
72 xpcom_core!SharedStub(void)+0x16 [c:\home\mozilla.org\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp @ 142]
73 gklayout!nsXMLHttpRequest::NotifyEventListeners(class nsCOMArray<nsIDOMEventListener> * aListeners = 0x79ece7f8, class nsIDOMEvent * aEvent = 0x71922040)+0xe7 [c:\home\mozilla.org\mozilla\content\base\src\nsxmlhttprequest.cpp @ 939]
74 gklayout!nsXMLHttpRequest::NotifyEventListeners(class nsCOMArray<nsIDOMEventListener> * aListeners = 0x0012f578, class nsIDOMEvent * aEvent = 0x71922040)+0xe7 [c:\home\mozilla.org\mozilla\content\base\src\nsxmlhttprequest.cpp @ 939]
75 gklayout!nsXMLHttpRequest::ChangeState(unsigned int aState = 0x10, int aBroadcast = 1, int aClearEventListeners = 1)+0x152 [c:\home\mozilla.org\mozilla\content\base\src\nsxmlhttprequest.cpp @ 1944]
76 gklayout!nsXMLHttpRequest::RequestCompleted(void)+0x14d [c:\home\mozilla.org\mozilla\content\base\src\nsxmlhttprequest.cpp @ 1472]
77 gklayout!nsXMLHttpRequest::OnStopRequest(class nsIRequest * request = 0x71922ba8, class nsISupports * ctxt = 0x00000000, unsigned int status = 0)+0x204 [c:\home\mozilla.org\mozilla\content\base\src\nsxmlhttprequest.cpp @ 1414]
78 necko!nsHTTPCompressConv::OnStopRequest(class nsIRequest * request = 0x71922ba8, class nsISupports * aContext = 0x00000000, unsigned int aStatus = 0)+0x23 [c:\home\mozilla.org\mozilla\netwerk\streamconv\converters\nshttpcompressconv.cpp @ 125]
79 necko!nsStreamListenerTee::OnStopRequest(class nsIRequest * request = 0x71922ba8, class nsISupports * context = 0x00000000, unsigned int status = 0)+0xa8 [c:\home\mozilla.org\mozilla\netwerk\base\src\nsstreamlistenertee.cpp @ 66]
7a necko!nsHttpChannel::OnStopRequest(class nsIRequest * request = 0x71924558, class nsISupports * ctxt = 0x00000000, unsigned int status = 0)+0x34e [c:\home\mozilla.org\mozilla\netwerk\protocol\http\src\nshttpchannel.cpp @ 4041]
7b necko!nsInputStreamPump::OnStateStop(void)+0xde [c:\home\mozilla.org\mozilla\netwerk\base\src\nsinputstreampump.cpp @ 572]
7c necko!nsInputStreamPump::OnInputStreamReady(class nsIAsyncInputStream * stream = 0x71924338)+0x90 [c:\home\mozilla.org\mozilla\netwerk\base\src\nsinputstreampump.cpp @ 396]
7d xpcom_core!nsInputStreamReadyEvent::Run(void)+0x4a [c:\home\mozilla.org\mozilla\xpcom\io\nsstreamutils.cpp @ 112]
7e xpcom_core!nsThread::ProcessNextEvent(int mayWait = 1, int * result = 0x0012f70c)+0x1a0 [c:\home\mozilla.org\mozilla\xpcom\threads\nsthread.cpp @ 483]
7f xpcom_core!NS_ProcessNextEvent_P(class nsIThread * thread = 0x00c00170, int mayWait = 1)+0x56 [c:\home\mozilla.org\mozilla\dbg-firefox-i686-pc-mingw32\xpcom\build\nsthreadutils.cpp @ 225]
80 gkwidget!nsBaseAppShell::Run(void)+0x5d [c:\home\mozilla.org\mozilla\widget\src\xpwidgets\nsbaseappshell.cpp @ 153]
81 tkitcmps!nsAppStartup::Run(void)+0x6b [c:\home\mozilla.org\mozilla\toolkit\components\startup\src\nsappstartup.cpp @ 171]
82 xul!XRE_main(int argc = 1, char ** argv = 0x00b6b798, struct nsXREAppData * aAppData = 0x004036b4)+0x258e [c:\home\mozilla.org\mozilla\toolkit\xre\nsapprunner.cpp @ 2749]
83 firefox!main(int argc = 1, char ** argv = 0x00b6b798)+0x16 [c:\home\mozilla.org\mozilla\browser\app\nsbrowserapp.cpp @ 61]
84 firefox!__tmainCRTStartup(void)+0x1a6 [f:\rtm\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 586]
85 firefox!mainCRTStartup(void)+0xd [f:\rtm\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 403]
86 kernel32!BaseProcessStart+0x23

Comment 1

[Kai Engert [:KaiE:]]

reassign bug owner.
mass-update-kaie-20120918

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

This bug was likely fixed as part of the refactoring of SSL server cert verification. In any case, nsHandleSSLError doesn't even call CreateBundle anymore.