HTML Validator extension before 0.845 crashes browser on startup because it doesn't use nsMemory for xpcom methods [@ ntdll!RtlpValidateHeapEntry][@ MSVCR80!free]

RESOLVED FIXED

Status

()

Product:
Firefox
Component:
Extension Compatibility
--
critical
RESOLVED FIXED
Reported:
9 years ago
Modified:
6 years ago

People

(Reporter: mgueury, Assigned: mgueury)

Tracking

({crash})

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

(Assignee)

Description

•
9 years ago 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3

I am the extension developer and I got a report in the forums of some people with some Vista version seems to have some crash at startup when they used:

- OS: Vista 32 or 64 ultimate
- Firefox version 3 beta 3
- Extension HTML Validator 0.844
  (see here : http://users.skynet.be/mgueury/mozilla/download.html)

The same works on Win 2000, Win XP, Win 2003
It works too if Firefox is downgraded to 2.0.
I had the impression but need confirmation that it was working too with
Firefox version 3 beta 2.

I do not have any vista ultimate to see or test this.

The extension used a C library and XPCOM.
I guess that something is wrong with XPCOM on this platform.


Reproducible: Always

Steps to Reproduce:
1. Use vista 32/64 ultimate
2. Install Firefox 3 beta 3
3. Install Extension HTML Validator 0.844
  (see here : http://users.skynet.be/mgueury/mozilla/download.html)
4. Restart Firefox -> crach
Actual Results:  
Crash at startup

Expected Results:  
Do not crash

-

Comment 1

•
9 years ago 
typically this is caused by a bug in your extension.

if you can get a .dmp from them (see windbg: .hh .dump), that'd be great, if not you'll need to provide a pdb to them (or us).

http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg
(Assignee)

Comment 2

•
9 years ago 
I asked to an user to downgrade to Firefox 2 and use the same extension version and it works. I asked to confirm that the same worked in Firefox 3 beta 2. And it seems so, since some users spoke about it in the forum.

I do not have any vista or vista utimate to make the test myself.

Comment 3

•
9 years ago 
When starting Firefox 3b3 with HTMLValidator 0.844 on Vista 32bit (SP1) using WinDBG the following appears:
Executable search path is: 
ModLoad: 00400000 0044b000   firefox.exe
ModLoad: 77bd0000 77cf7000   ntdll.dll
ModLoad: 76450000 7652b000   D:\Windows\system32\kernel32.dll
ModLoad: 603e0000 60c4f000   D:\Program Files\Mozilla Firefox\xul.dll
ModLoad: 60160000 601c7000   D:\Program Files\Mozilla Firefox\sqlite3.dll
ModLoad: 72e30000 72ecb000   D:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.1434_none_d08b6002442c891f\MSVCR80.dll
ModLoad: 77870000 7791a000   D:\Windows\system32\msvcrt.dll
ModLoad: 60050000 600dd000   D:\Program Files\Mozilla Firefox\js3250.dll
ModLoad: 60000000 60030000   D:\Program Files\Mozilla Firefox\nspr4.dll
ModLoad: 76a80000 76b46000   D:\Windows\system32\ADVAPI32.dll
ModLoad: 765e0000 766a3000   D:\Windows\system32\RPCRT4.dll
ModLoad: 71250000 71257000   D:\Windows\system32\WSOCK32.dll
ModLoad: 77db0000 77ddd000   D:\Windows\system32\WS2_32.dll
ModLoad: 76a70000 76a76000   D:\Windows\system32\NSI.dll
ModLoad: 74e30000 74e62000   D:\Windows\system32\WINMM.dll
ModLoad: 769d0000 76a6d000   D:\Windows\system32\USER32.dll
ModLoad: 77920000 7796b000   D:\Windows\system32\GDI32.dll
ModLoad: 766b0000 767f4000   D:\Windows\system32\ole32.dll
ModLoad: 76930000 769bd000   D:\Windows\system32\OLEAUT32.dll
ModLoad: 74df0000 74e29000   D:\Windows\system32\OLEACC.dll
ModLoad: 60380000 60398000   D:\Program Files\Mozilla Firefox\smime3.dll
ModLoad: 60290000 60336000   D:\Program Files\Mozilla Firefox\nss3.dll
ModLoad: 60340000 60354000   D:\Program Files\Mozilla Firefox\nssutil3.dll
ModLoad: 60040000 60047000   D:\Program Files\Mozilla Firefox\plc4.dll
ModLoad: 60030000 60037000   D:\Program Files\Mozilla Firefox\plds4.dll
ModLoad: 60360000 6037e000   D:\Program Files\Mozilla Firefox\ssl3.dll
ModLoad: 76b50000 7765f000   D:\Windows\system32\SHELL32.dll
ModLoad: 76530000 76588000   D:\Windows\system32\SHLWAPI.dll
ModLoad: 75ae0000 75ae8000   D:\Windows\system32\VERSION.dll
ModLoad: 70d10000 70d52000   D:\Windows\system32\WINSPOOL.DRV
ModLoad: 77660000 776d3000   D:\Windows\system32\COMDLG32.dll
ModLoad: 75150000 752ee000   D:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\COMCTL32.dll
ModLoad: 77d00000 77d1e000   D:\Windows\system32\IMM32.dll
ModLoad: 777a0000 77868000   D:\Windows\system32\MSCTF.dll
ModLoad: 75710000 75715000   D:\Windows\system32\MSIMG32.dll
ModLoad: 77d20000 77d9d000   D:\Windows\system32\USP10.dll
ModLoad: 72da0000 72e27000   D:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.1434_none_d08b6002442c891f\MSVCP80.dll
ModLoad: 60c50000 60c57000   D:\Program Files\Mozilla Firefox\xpcom.dll
(bcc.e14): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=0012fb08 edx=77c29a94 esi=fffffffe edi=77c2b6f8
eip=77c17dfe esp=0012fb20 ebp=0012fb50 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77c17dfe cc              int     3


I will attempt to get firefox to crash via the validator (once the debugger symbols are loaded)

Comment 4

•
9 years ago 
I reproduced the error (see below for trace) - however, everything ran fine (including the Validator extension) once I resumed Firefox
0:000> g
ModLoad: 769c0000 769c9000   D:\Windows\system32\LPK.DLL
ModLoad: 723e0000 724bc000   D:\Windows\system32\dbghelp.dll
ModLoad: 75450000 7548f000   D:\Windows\system32\uxtheme.dll
ModLoad: 762d0000 762ee000   D:\Windows\system32\USERENV.dll
ModLoad: 762b0000 762c4000   D:\Windows\system32\Secur32.dll
ModLoad: 749e0000 74a9a000   D:\Windows\system32\PROPSYS.dll
ModLoad: 776e0000 77764000   D:\Windows\system32\CLBCatQ.DLL
ModLoad: 77a40000 77bca000   D:\Windows\system32\SETUPAPI.dll
ModLoad: 600e0000 600f4000   D:\Program Files\Mozilla Firefox\components\browserdirprovider.dll
ModLoad: 60100000 6013e000   D:\Program Files\Mozilla Firefox\components\brwsrcmp.dll
ModLoad: 10000000 10016000   D:\Users\vidmes\AppData\Roaming\Mozilla\Firefox\Profiles\ify0c45s.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
ModLoad: 02b40000 02c87000   D:\Users\vidmes\AppData\Roaming\Mozilla\Firefox\Profiles\ify0c45s.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
ModLoad: 75930000 7596b000   D:\Windows\system32\mswsock.dll
ModLoad: 75700000 75705000   D:\Windows\System32\wshtcpip.dll
ModLoad: 75cb0000 75cc9000   D:\Windows\system32\iphlpapi.dll
ModLoad: 75c70000 75ca5000   D:\Windows\system32\dhcpcsvc.DLL
ModLoad: 75ef0000 75f1c000   D:\Windows\system32\DNSAPI.dll
ModLoad: 75c60000 75c67000   D:\Windows\system32\WINNSI.DLL
ModLoad: 75c30000 75c51000   D:\Windows\system32\dhcpcsvc6.DLL
ModLoad: 756e0000 756ef000   D:\Windows\system32\NLAapi.dll
ModLoad: 71ff0000 71fff000   D:\Windows\system32\napinsp.dll
ModLoad: 71e10000 71e22000   D:\Windows\system32\pnrpnsp.dll
ModLoad: 71fe0000 71fec000   D:\Windows\system32\wshbth.dll
ModLoad: 71e40000 71e48000   D:\Windows\System32\winrnr.dll
ModLoad: 77de0000 77e2a000   D:\Windows\system32\WLDAP32.dll
ModLoad: 76440000 76447000   D:\Windows\system32\PSAPI.DLL
ModLoad: 73f00000 73fb3000   D:\Windows\system32\WindowsCodecs.dll
ModLoad: 76250000 7627c000   D:\Windows\system32\apphelp.dll
ModLoad: 04680000 04704000   TORTOISESVN.dll
ModLoad: 04360000 043e4000   D:\Program Files\TortoiseSVN\bin\tortoisesvn.dll
ModLoad: 77970000 77a40000   D:\Windows\system32\WININET.dll
ModLoad: 77da0000 77da3000   D:\Windows\system32\Normaliz.dll
ModLoad: 76800000 7692e000   D:\Windows\system32\urlmon.dll
ModLoad: 76590000 765d5000   D:\Windows\system32\iertutil.dll
ModLoad: 76380000 763a6000   D:\Windows\system32\IESetting.dll
ModLoad: 6eec0000 6eee2000   D:\Program Files\TortoiseSVN\bin\libapr_tsvn.dll
ModLoad: 6ee60000 6ee89000   D:\Program Files\TortoiseSVN\bin\libaprutil_tsvn.dll
ModLoad: 6ee50000 6ee5e000   D:\Program Files\TortoiseSVN\bin\libapriconv_tsvn.dll
ModLoad: 03650000 0365c000   D:\Program Files\TortoiseSVN\bin\intl3_svn.dll
ModLoad: 73440000 73445000   D:\Windows\system32\SHFOLDER.dll
ModLoad: 6e060000 6e067000   D:\Program Files\TortoiseSVN\iconv\windows-1252.so
ModLoad: 6ee40000 6ee46000   D:\Program Files\TortoiseSVN\iconv\_tbl_simple.so
ModLoad: 6e060000 6e067000   D:\Program Files\TortoiseSVN\iconv\windows-1252.so
ModLoad: 6ed50000 6ed56000   D:\Program Files\TortoiseSVN\iconv\utf-8.so
ModLoad: 6e060000 6e067000   D:\Program Files\TortoiseSVN\iconv\windows-1252.so
ModLoad: 6ee40000 6ee46000   D:\Program Files\TortoiseSVN\iconv\_tbl_simple.so
ModLoad: 6e060000 6e067000   D:\Program Files\TortoiseSVN\iconv\windows-1252.so
ModLoad: 6ed50000 6ed56000   D:\Program Files\TortoiseSVN\iconv\utf-8.so
ModLoad: 04770000 0498d000   GrooveShellExtensions.DLL
ModLoad: 04450000 0466d000   D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
ModLoad: 6ebc0000 6ecb1000   D:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL
ModLoad: 75d50000 75e41000   D:\Windows\system32\CRYPT32.dll
ModLoad: 75eb0000 75ec2000   D:\Windows\system32\MSASN1.dll
ModLoad: 71060000 71067000   D:\Program Files\Microsoft Office\Office12\GrooveNew.DLL
ModLoad: 6fe60000 6fe7b000   D:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_none_11ecb0ab9b2caf3c\ATL80.DLL
ModLoad: 757e0000 7581b000   D:\Windows\system32\rsaenh.dll
ModLoad: 60240000 60264000   D:\Program Files\Mozilla Firefox\softokn3.dll
ModLoad: 60270000 60288000   D:\Program Files\Mozilla Firefox\nssdbm3.dll
ModLoad: 603a0000 603d9000   D:\Program Files\Mozilla Firefox\freebl3.dll
ModLoad: 601f0000 60234000   D:\Program Files\Mozilla Firefox\nssckbi.dll
ModLoad: 75ad0000 75ad5000   D:\Windows\System32\wship6.dll
ModLoad: 720f0000 720f6000   D:\Windows\system32\rasadhlp.dll
HEAP[firefox.exe]: Invalid address specified to RtlFreeHeap( 00330000, 00D3B8C0 )
(e68.87c): Break instruction exception - code 80000003 (first chance)
eax=00d3b8b8 ebx=00d3b8b8 ecx=77bf385a edx=0012e5c1 esi=00330000 edi=00330000
eip=77c17dfe esp=0012e804 ebp=0012e808 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!DbgBreakPoint:
77c17dfe cc              int     3
0:000> kp
ChildEBP RetAddr  
0012e800 77c81c93 ntdll!DbgBreakPoint
0012e808 77c52b26 ntdll!RtlpBreakPointHeap+0x28
0012e824 77c82cf3 ntdll!RtlpValidateHeapEntry+0x16d
0012e86c 77c4bfe8 ntdll!RtlDebugFreeHeap+0x9a
0012e960 77c38652 ntdll!RtlpFreeHeap+0x5f
0012e97c 7649c56f ntdll!RtlFreeHeap+0x14e
0012e990 72e34c39 kernel32!HeapFree+0x14
0012e9dc 604057dc MSVCR80!free+0xcd
0012eb9c 60409148 xul!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x77bf385a, XPCWrappedNative::CallMode mode = CALL_METHOD (0))+0x114b [e:\fx19rel\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2509]
0012ec64 6007bcb3 xul!XPC_WN_CallMethod(struct JSContext * cx = 0x02ae19a8, struct JSObject * obj = 0x034b30c0, unsigned int argc = 1, long * argv = 0x03a96790, long * vp = 0x0012ecdc)+0xcc [e:\fx19rel\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp @ 1470]
0012ed28 60082030 js3250!js_Invoke+0x4c3
0012eebc 6007bcfb js3250!js_Interpret+0x5640
0012ef78 60413f39 js3250!js_Invoke+0x50b
0012f100 60416dc8 xul!nsXPCWrappedJSClass::CallMethod(class nsXPCWrappedJS * wrapper = 0x050b3390, unsigned short methodIndex = 3, struct XPTMethodDescriptor * info = 0x0297c1b0, struct nsXPTCMiniVariant * nativeParams = 0x0012f13c)+0x91e [e:\fx19rel\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp @ 1473]
0012f118 6096282d xul!nsXPCWrappedJS::CallMethod(unsigned short methodIndex = 0x33e0, struct XPTMethodDescriptor * info = 0x00000003, struct nsXPTCMiniVariant * params = 0x0012f1f4)+0x27 [e:\fx19rel\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp @ 557]
0012f1cc 60962894 xul!PrepareAndDispatch(class nsXPTCStubBase * self = 0x050b33e0, unsigned int methodIndex = 3, unsigned int * args = 0x0012f1f4, unsigned int * stackBytesToPop = 0x0012f1e4)+0xe7 [e:\fx19rel\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp @ 114]
0012f1e8 6092c6fb xul!SharedStub(void)+0x16 [e:\fx19rel\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp @ 142]
0012f20c 60924254 xul!nsObserverList::NotifyObservers(class nsISupports * aSubject = 0x041139f4, char * aTopic = 0x050b3408 "EndDocumentLoad", wchar_t * someData = 0x052d5bf8 "http://www.google.com.au/ig?hl=en")+0x3f [e:\fx19rel\winnt_5.2_depend\mozilla\xpcom\ds\nsobserverlist.cpp @ 128]
0012f22c 60962742 xul!nsObserverService::NotifyObservers(class nsISupports * aSubject = 0x041139f4, char * aTopic = 0x050b3408 "EndDocumentLoad", wchar_t * someData = 0x052d5bf8 "http://www.google.com.au/ig?hl=en")+0x57 [e:\fx19rel\winnt_5.2_depend\mozilla\xpcom\ds\nsobserverservice.cpp @ 184]
0012f250 60405236 xul!NS_InvokeByIndex_P(class nsISupports * that = 0x02044b38, unsigned int methodIndex = 5, unsigned in

Comment 5

•
9 years ago 
ok.

mozilla_tidy_source/mozilla/extensions/tidy/src josh$ grep out nsITidy.idl |perl -ne 's/\s+void //;s/[(]/:\n /;s/,/\n/g; s/  / /g; print'|grep -v 'in '

is a list of things that worry me.

for starters, generally you shouldn't use inouts unless you have a good reason, and I don't think you do in most cases.

change your getLibraryVersion declaration to:
long libraryVersion;
it won't require you to change the C++ code (you'll obviously have to change the js code, but that's ok).

I believe the problem is nsTidyImpl::AnalyzeLine

        *aText = TY_(tmbstrdup)( TALLOC, sError );

where you're using the wrong allocator. You must use nsMemory::/NS_Alloc. I'd suggest you move away from 'string' and use AString instead.

Note: using inout requires reading the documentation, please don't use it.
Severity: major → critical
Component: General → Extension Compatibility
Keywords: crash
QA Contact: general → extension.compatibility
Summary: Browser crashes on startup on Vista 32/64 ultimate with HTML Validator extension installed → Browser crashes on startup on Vista 32/64 ultimate with HTML Validator extension installed [@ ntdll!RtlpValidateHeapEntry][@ MSVCR80!free]

Comment 6

•
9 years ago 
On Vista Ultimate 64 SP1 Firefox 3 b2 and extension 0.844 crashes as well once verification starts. Exactly the same as with b3.

This what I get debugging with b3 (I hope I did it right)

DEBUG->GO
CommandLine: "C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\firefox.exe"
Symbol search path is: SRV*c:\symbols*http://symbols.mozilla.org/firefox;SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
ModLoad: 00000000`00400000 00000000`0044b000   firefox.exe
ModLoad: 00000000`77840000 00000000`779c0000   ntdll.dll
ModLoad: 00000000`779e0000 00000000`77b40000   ntdll32.dll
ModLoad: 00000000`75b30000 00000000`75b75000   C:\Windows\system32\wow64.dll
ModLoad: 00000000`75ae0000 00000000`75b2e000   C:\Windows\system32\wow64win.dll
ModLoad: 00000000`75a30000 00000000`75a39000   C:\Windows\system32\wow64cpu.dll
(16d8.1628): Break instruction exception - code 80000003 (first chance)
ntdll!DbgBreakPoint:
00000000`77884ea0 cc              int     3
0:000> .sympath SRV*c:\symbols*http://symbols.mozilla.org/firefox
Symbol search path is: SRV*c:\symbols*http://symbols.mozilla.org/firefox
0:000> .symfix+ c:\symbols
0:000> .reload /f
Reloading current modules
......
0:000> g
ModLoad: 00000000`77710000 00000000`7783b000   WOW64_IMAGE_SECTION
ModLoad: 00000000`75cc0000 00000000`75dd0000   WOW64_IMAGE_SECTION
ModLoad: 00000000`77710000 00000000`7783b000   NOT_AN_IMAGE
ModLoad: 00000000`77640000 00000000`7770d000   NOT_AN_IMAGE
ModLoad: 00000000`75cc0000 00000000`75dd0000   C:\Windows\syswow64\kernel32.dll
ModLoad: 00000000`603e0000 00000000`60c4f000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\xul.dll
ModLoad: 00000000`60160000 00000000`601c7000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\sqlite3.dll
ModLoad: 00000000`752e0000 00000000`7537b000   C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.1434_none_d08b6002442c891f\MSVCR80.dll
ModLoad: 00000000`75f30000 00000000`75fda000   C:\Windows\syswow64\msvcrt.dll
ModLoad: 00000000`60050000 00000000`600dd000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\js3250.dll
ModLoad: 00000000`60000000 00000000`60030000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\nspr4.dll
ModLoad: 00000000`77270000 00000000`77336000   C:\Windows\syswow64\ADVAPI32.dll
ModLoad: 00000000`76f20000 00000000`77010000   C:\Windows\syswow64\RPCRT4.dll
ModLoad: 00000000`75b90000 00000000`75bf0000   C:\Windows\syswow64\Secur32.dll
ModLoad: 00000000`75a40000 00000000`75a47000   C:\Windows\SysWOW64\WSOCK32.dll
ModLoad: 00000000`75e80000 00000000`75ead000   C:\Windows\syswow64\WS2_32.dll
ModLoad: 00000000`75c80000 00000000`75c86000   C:\Windows\syswow64\NSI.dll
ModLoad: 00000000`74da0000 00000000`74dd2000   C:\Windows\SysWOW64\WINMM.dll
ModLoad: 00000000`77520000 00000000`775f0000   C:\Windows\syswow64\USER32.dll
ModLoad: 00000000`75df0000 00000000`75e80000   C:\Windows\syswow64\GDI32.dll
ModLoad: 00000000`773d0000 00000000`77514000   C:\Windows\syswow64\ole32.dll
ModLoad: 00000000`77340000 00000000`773cd000   C:\Windows\syswow64\OLEAUT32.dll
ModLoad: 00000000`751f0000 00000000`75229000   C:\Windows\SysWOW64\OLEACC.dll
ModLoad: 00000000`60380000 00000000`60398000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\smime3.dll
ModLoad: 00000000`60290000 00000000`60336000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\nss3.dll
ModLoad: 00000000`60340000 00000000`60354000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\nssutil3.dll
ModLoad: 00000000`60040000 00000000`60047000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\plc4.dll
ModLoad: 00000000`60030000 00000000`60037000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\plds4.dll
ModLoad: 00000000`60360000 00000000`6037e000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\ssl3.dll
ModLoad: 00000000`76330000 00000000`76e3f000   C:\Windows\syswow64\SHELL32.dll
ModLoad: 00000000`76e40000 00000000`76e98000   C:\Windows\syswow64\SHLWAPI.dll
ModLoad: 00000000`75940000 00000000`75948000   C:\Windows\SysWOW64\VERSION.dll
ModLoad: 00000000`75290000 00000000`752d2000   C:\Windows\SysWOW64\WINSPOOL.DRV
ModLoad: 00000000`75eb0000 00000000`75f23000   C:\Windows\syswow64\COMDLG32.dll
ModLoad: 00000000`756b0000 00000000`7584e000   C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\COMCTL32.dll
ModLoad: 00000000`77140000 00000000`771a0000   C:\Windows\syswow64\IMM32.dll
ModLoad: 00000000`760d0000 00000000`76198000   C:\Windows\syswow64\MSCTF.dll
ModLoad: 00000000`74810000 00000000`74815000   C:\Windows\SysWOW64\MSIMG32.dll
ModLoad: 00000000`76ea0000 00000000`76f1d000   C:\Windows\syswow64\USP10.dll
ModLoad: 00000000`75620000 00000000`756a7000   C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.1434_none_d08b6002442c891f\MSVCP80.dll
ModLoad: 00000000`60c50000 00000000`60c57000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\xpcom.dll
(16d8.1628): WOW64 breakpoint - code 4000001f (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
ntdll32!DbgBreakPoint:
00000000`779f0004 cc              int     3

DEBUG->GO
ModLoad: 00000000`77710000 00000000`7783b000   WOW64_IMAGE_SECTION
ModLoad: 00000000`75cc0000 00000000`75dd0000   WOW64_IMAGE_SECTION
ModLoad: 00000000`77710000 00000000`7783b000   NOT_AN_IMAGE
ModLoad: 00000000`77640000 00000000`7770d000   NOT_AN_IMAGE
ModLoad: 00000000`75cc0000 00000000`75dd0000   C:\Windows\syswow64\kernel32.dll
ModLoad: 00000000`603e0000 00000000`60c4f000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\xul.dll
ModLoad: 00000000`60160000 00000000`601c7000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\sqlite3.dll
ModLoad: 00000000`752e0000 00000000`7537b000   C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.1434_none_d08b6002442c891f\MSVCR80.dll
ModLoad: 00000000`75f30000 00000000`75fda000   C:\Windows\syswow64\msvcrt.dll
ModLoad: 00000000`60050000 00000000`600dd000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\js3250.dll
ModLoad: 00000000`60000000 00000000`60030000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\nspr4.dll
ModLoad: 00000000`77270000 00000000`77336000   C:\Windows\syswow64\ADVAPI32.dll
ModLoad: 00000000`76f20000 00000000`77010000   C:\Windows\syswow64\RPCRT4.dll
ModLoad: 00000000`75b90000 00000000`75bf0000   C:\Windows\syswow64\Secur32.dll
ModLoad: 00000000`75a40000 00000000`75a47000   C:\Windows\SysWOW64\WSOCK32.dll
ModLoad: 00000000`75e80000 00000000`75ead000   C:\Windows\syswow64\WS2_32.dll
ModLoad: 00000000`75c80000 00000000`75c86000   C:\Windows\syswow64\NSI.dll
ModLoad: 00000000`74da0000 00000000`74dd2000   C:\Windows\SysWOW64\WINMM.dll
ModLoad: 00000000`77520000 00000000`775f0000   C:\Windows\syswow64\USER32.dll
ModLoad: 00000000`75df0000 00000000`75e80000   C:\Windows\syswow64\GDI32.dll
ModLoad: 00000000`773d0000 00000000`77514000   C:\Windows\syswow64\ole32.dll
ModLoad: 00000000`77340000 00000000`773cd000   C:\Windows\syswow64\OLEAUT32.dll
ModLoad: 00000000`751f0000 00000000`75229000   C:\Windows\SysWOW64\OLEACC.dll
ModLoad: 00000000`60380000 00000000`60398000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\smime3.dll
ModLoad: 00000000`60290000 00000000`60336000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\nss3.dll
ModLoad: 00000000`60340000 00000000`60354000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\nssutil3.dll
ModLoad: 00000000`60040000 00000000`60047000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\plc4.dll
ModLoad: 00000000`60030000 00000000`60037000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\plds4.dll
ModLoad: 00000000`60360000 00000000`6037e000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\ssl3.dll
ModLoad: 00000000`76330000 00000000`76e3f000   C:\Windows\syswow64\SHELL32.dll
ModLoad: 00000000`76e40000 00000000`76e98000   C:\Windows\syswow64\SHLWAPI.dll
ModLoad: 00000000`75940000 00000000`75948000   C:\Windows\SysWOW64\VERSION.dll
ModLoad: 00000000`75290000 00000000`752d2000   C:\Windows\SysWOW64\WINSPOOL.DRV
ModLoad: 00000000`75eb0000 00000000`75f23000   C:\Windows\syswow64\COMDLG32.dll
ModLoad: 00000000`756b0000 00000000`7584e000   C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\COMCTL32.dll
ModLoad: 00000000`77140000 00000000`771a0000   C:\Windows\syswow64\IMM32.dll
ModLoad: 00000000`760d0000 00000000`76198000   C:\Windows\syswow64\MSCTF.dll
ModLoad: 00000000`74810000 00000000`74815000   C:\Windows\SysWOW64\MSIMG32.dll
ModLoad: 00000000`76ea0000 00000000`76f1d000   C:\Windows\syswow64\USP10.dll
ModLoad: 00000000`75620000 00000000`756a7000   C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.1434_none_d08b6002442c891f\MSVCP80.dll
ModLoad: 00000000`60c50000 00000000`60c57000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\xpcom.dll
(16d8.1628): WOW64 breakpoint - code 4000001f (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
ntdll32!DbgBreakPoint:
00000000`779f0004 cc              int     3
0:000:x86> g
ModLoad: 00000000`75dd0000 00000000`75dd9000   C:\Windows\syswow64\LPK.DLL
ModLoad: 00000000`10000000 00000000`10022000   C:\Windows\SysWOW64\guard32.dll
ModLoad: 00000000`75a20000 00000000`75a27000   C:\Windows\SysWOW64\fltLib.dll
ModLoad: 00000000`759f0000 00000000`75a15000   C:\Windows\SysWOW64\winsta.dll
ModLoad: 00000000`003b0000 00000000`003cb000   C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
ModLoad: 00000000`6aee0000 00000000`6afbc000   C:\Windows\SysWOW64\dbghelp.dll
ModLoad: 00000000`75070000 00000000`750f0000   C:\Windows\SysWOW64\uxtheme.dll
ModLoad: 00000000`75870000 00000000`758d0000   C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll
ModLoad: 00000000`74af0000 00000000`74b0e000   C:\Windows\SysWOW64\USERENV.dll
ModLoad: 00000000`73790000 00000000`7384a000   C:\Windows\SysWOW64\PROPSYS.dll
ModLoad: 00000000`75fe0000 00000000`76064000   C:\Windows\syswow64\CLBCatQ.DLL
ModLoad: 00000000`761a0000 00000000`7632a000   C:\Windows\syswow64\SETUPAPI.dll
ModLoad: 00000000`600e0000 00000000`600f4000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\components\browserdirprovider.dll
ModLoad: 00000000`75150000 00000000`7518b000   C:\Windows\SysWOW64\mswsock.dll
ModLoad: 00000000`751c0000 00000000`751c5000   C:\Windows\SysWOW64\wshtcpip.dll
ModLoad: 00000000`74aa0000 00000000`74ab9000   C:\Windows\SysWOW64\iphlpapi.dll
ModLoad: 00000000`74a60000 00000000`74a95000   C:\Windows\SysWOW64\dhcpcsvc.DLL
ModLoad: 00000000`75040000 00000000`7506c000   C:\Windows\SysWOW64\DNSAPI.dll
ModLoad: 00000000`74a50000 00000000`74a57000   C:\Windows\SysWOW64\WINNSI.DLL
ModLoad: 00000000`74a20000 00000000`74a41000   C:\Windows\SysWOW64\dhcpcsvc6.DLL
ModLoad: 00000000`73760000 00000000`7376f000   C:\Windows\SysWOW64\NLAapi.dll
ModLoad: 00000000`73750000 00000000`7375f000   C:\Windows\SysWOW64\napinsp.dll
ModLoad: 00000000`73710000 00000000`73722000   C:\Windows\SysWOW64\pnrpnsp.dll
ModLoad: 00000000`73740000 00000000`73748000   C:\Windows\SysWOW64\winrnr.dll
ModLoad: 00000000`775f0000 00000000`7763a000   C:\Windows\syswow64\WLDAP32.dll
ModLoad: 00000000`75de0000 00000000`75de7000   C:\Windows\syswow64\PSAPI.DLL
ModLoad: 00000000`16080000 00000000`160a5000   C:\Program Files (x86)\Bonjour\mdnsNSP.dll
ModLoad: 00000000`6ee70000 00000000`6ef23000   C:\Windows\SysWOW64\WindowsCodecs.dll
ModLoad: 00000000`759b0000 00000000`759eb000   C:\Windows\SysWOW64\rsaenh.dll
ModLoad: 00000000`60240000 00000000`60264000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\softokn3.dll
ModLoad: 00000000`60270000 00000000`60288000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\nssdbm3.dll
ModLoad: 00000000`603a0000 00000000`603d9000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\freebl3.dll
ModLoad: 00000000`601f0000 00000000`60234000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\nssckbi.dll
ModLoad: 00000000`60100000 00000000`6013e000   C:\Program Files (x86)\Mozilla Firefox 3 Beta 3\components\brwsrcmp.dll
ModLoad: 00000000`057b0000 00000000`058f7000   C:\Users\cm\AppData\Roaming\Mozilla\Firefox\Profiles\301qxait.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
ModLoad: 00000000`75950000 00000000`759af000   C:\Windows\SysWOW64\SXS.DLL
ModLoad: 00000000`751b0000 00000000`751b5000   C:\Windows\SysWOW64\wship6.dll
ModLoad: 00000000`73770000 00000000`73776000   C:\Windows\SysWOW64\rasadhlp.dll
HEAP[firefox.exe]: Invalid address specified to RtlFreeHeap( 00F80000, 00DD8D50 )
(16d8.1628): WOW64 breakpoint - code 4000001f (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
ntdll32!DbgBreakPoint:
00000000`779f0004 cc              int     3

Comment 7

•
9 years ago 
mail.eraserhead@gmail.com: you need to at least get stack traces (kp), however atm I don't think we need more stack traces until mgueury@skynet.be fixes the extension.

Comment 8

•
9 years ago 
ups, sorry. thanks for letting me know!

Updated

•
9 years ago
Assignee: nobody → mgueury
 (Assignee)

Comment 9

•
9 years ago 
Hi Timeless, 

You should know that this C code of the extension has not been touched since Firefox version 1.5. The extension works on all platform I know (Win 95/95/XP/2000/2003, Linux 32/64 bits, Linux PPC, MacOS Intel, PPC, FreeBSD 5 and 6)

And not in Vista ultimate :/ That I do not have...

An user to run the extension diagnostic logging: 
> see here:
http://users.skynet.be/mgueury/mozilla/faq.html#DIAGLOG

And got this:
What you see in the logs is a line before and after each call of a C function.

----------------------------------------------------------
Wed Mar 05 20:27:35 2008: Library version: 20070302
Wed Mar 05 20:27:35 2008: <BEGIN> nsTidyImpl::ResetFilter
Wed Mar 05 20:27:35 2008: <END> nsTidyImpl::ResetFilter
Wed Mar 05 20:27:36 2008: <JAVASCRIPT>onStatusChange
Wed Mar 05 20:27:36 2008: <JAVASCRIPT>onLocationChange : true
Wed Mar 05 20:27:36 2008: <JAVASCRIPT>onStatusChange
Wed Mar 05 20:27:36 2008: <JAVASCRIPT>onStatusChange
Wed Mar 05 20:27:36 2008: <JAVASCRIPT>onProgressChange
Wed Mar 05 20:27:37 2008: <JAVASCRIPT>onStatusChange
Wed Mar 05 20:27:37 2008: <JAVASCRIPT>onProgressChange
Wed Mar 05 20:27:37 2008: <JAVASCRIPT>tidyEndDocumentLoadObserver
Wed Mar 05 20:27:37 2008: <JAVASCRIPT>getHtmlFromCache: http://www.google.fr/
Wed Mar 05 20:27:37 2008: <JAVASCRIPT>onStatusChange
Wed Mar 05 20:27:37 2008: </JAVASCRIPT>getHtmlFromCache
Wed Mar 05 20:27:37 2008: <BEGIN> nsTidyImpl::InitTranslation
Wed Mar 05 20:27:37 2008: <END> nsTidyImpl::InitTranslation
Wed Mar 05 20:27:37 2008: <BEGIN> nsTidyImpl::SpInit
Wed Mar 05 20:27:37 2008: <END> nsTidyImpl::SpInit C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\sbwm7re0.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\sgml-lib\sgml.soc
Wed Mar 05 20:27:37 2008: <BEGIN> nsTidyImpl::GetIdOfAllErrors
Wed Mar 05 20:27:37 2008: <END> nsTidyImpl::GetIdOfAllErrors
----------------------------------------------------------

GetIdOfAllErrors is a XPCOM call from Javascript. It is called just once !

---------------------------------------------------------------------
          var id_list ={value:""};
-->       this.tidy.getIdOfAllErrors( id_list );
          var id_array = id_list.value.split(',');
          var t = "";
          for (var id in id_array) 
          {
            t += this.getString("tidy_"+id_array[id]) + "\n";
          }
          this.tidy.addTranslations( t );
          var prefix = this.getString("tidy_prefix") ;
          var linecol = this.getString("tidy_linecol")+" ";
---------------------------------------------------------------------

The log shows too that the function "this.tidy.addTranslations" is never called.
Else the log would contains a line about it. 
The XPCOM functions we speak about here are defined like this:


Also the last line of the logs shows too is that the crash is not appearing during the extension C part but during the javascript execution.

In the idl
-----------------------------------------------------------
    void getIdOfAllErrors( inout string aErrorList );
-----------------------------------------------------------

The C function is this:

-----------------------------------------------------------
/**
 * GetIdOfAllErrors
 *
 * @param aErrorId    : Id of the error
 * @param aErrorList  : a comma separated list with all message id in tidy
 */
NS_IMETHODIMP nsTidyImpl::GetIdOfAllErrors( char ** aErrorList )
{
  mDiagLog.log( "<BEGIN> nsTidyImpl::GetIdOfAllErrors" );

  char s[4096];
  char num[128];

  sprintf( s, "%d\0", (int)msgFormat[0].code );
  for( int i=1; msgFormat[i].fmt; ++i)
  {
    sprintf( num, ",%d\0", (int)msgFormat[i].code );
    strcat( s, num );
  }
  *aErrorList = TY_(tmbstrdup)( TALLOC, s );

  mDiagLog.log( "<END> nsTidyImpl::GetIdOfAllErrors" );
  return NS_OK;
}
-----------------------------------------------------------

It seems to crash afterward maybe because for example, the desalloc used in Firefox 3 is different on Vista ??? than in all other platforms ??? I have no idea of what to do to correct this since I do not have any machine to test this.

Thanks by advance

Comment 10

•
9 years ago 
buggy extensions can work until behaviors in the engine which they rely on change. we recently enabled jemalloc which means that any violations of the nsMemory contract result in death. It should crash on any version of windows or any other platform, but only recently (b4?).

anyway. you aren't implementing inout correctly and don't need inout, you should switch to out or returns. And you should switch to AString which has obvious getter/setter methods which you do use correctly.

TY_(tmbstrdup) is *not* the right allocator for xpcom. NS_Alloc or nsMemory::Alloc are.

http://developer.mozilla.org/en/docs/nsMemory:Alloc

I can't find a document for inout, but trust me, you're using it wrong and you don't need to use it. out or returns are sufficient for your needs.
 (Assignee)

Comment 11

•
9 years ago 
Due that I always copy data in a newly fresh memory buffer before to return strings to Mozilla, I understand that I should do something like this:

*newString = (char*) nsMemory::Clone(s, strlen((const char*)oldString)+1);

in place of this:

*newString = TY_(tmbstrdup)( TALLOC, oldString );

Due to the way the memory is freed now in Firefox. (I must say I read a lot
and a lot of doc and never seen this, even if I think that you are probably right).

If it is just that, it seems to be easy to do. But I will need to find a machine to test this and I do not have one :-/ ...

Comment 12

•
9 years ago 
that's correct. and sorry about the machine bit.
 (Assignee)

Comment 13

•
9 years ago 
After trying with Firefox 3 beta 4, I got exactly the same problem on XP SP2.
Good news :) So, I can work on the problem now !

I replaced the tmbstrdup calls to copy the string sent back to Firefox 
by:

char * nsTidyImpl::MozStrdup( const char * utf8_str )
{
  return (char*)nsMemory::Clone(utf8_str, strlen(utf8_str) + 1);
}

And it works !! 

Thanks a lot, 

Marc

Ps: This will be in version 0.845 of the extension.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 14

•
9 years ago 
cool. but please do look into fixing your interface decls to use attributes, returns, and simple outs.

fwiw, an out can be used like this:

interface myIBar { void foo(out string x); }

obj.myIBar.foo(x={});
x.value;

which is no different from:
interface myIBbr { void foo(out string x); }
obj.myIBbr.foo(x={value:""});
x.value;

(less code on both sides).

it's of course better if you can do:
interface myIBcr { readonly string foo; }
x=obj.myIBcr.foo;
Summary: Browser crashes on startup on Vista 32/64 ultimate with HTML Validator extension installed [@ ntdll!RtlpValidateHeapEntry][@ MSVCR80!free] → HTML Validator extension before 0.845 crashes browser on startup because it doesn't use nsMemory for xpcom methods [@ ntdll!RtlpValidateHeapEntry][@ MSVCR80!free]
Crash Signature: [@ ntdll!RtlpValidateHeapEntry] [@ MSVCR80!free]
You need to log in before you can comment on or make changes to this bug.