425603 - crash [@ xptiInterfaceEntry::ResolveLocked]

Status: RESOLVED DUPLICATE of bug 1444745

(Core :: XPCOM, defect)

Description

[timeless]

this isn't reproducible :(, but it is annoying.

*** loading ISO8601DateUtils
###!!! ASSERTION: bad state!: 'GetResolveState() == PARTIALLY_RESOLVED', file 
mozilla.org/mozilla/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp,
 line 186

0:000> dt this
Local var @ 0x12e914 Type xptiInterfaceEntry*
0x00c07508 
   +0x000 mIID             : nsID
   +0x010 mTypelib         : xptiTypelib
   +0x010 mInterface       : 0xffff0004 xptiInterfaceGuts
   +0x014 mInfo            : 0x00c8aa40 xptiInterfaceInfo
   +0x018 mFlags           : xptiInfoFlags
   +0x019 mName            : [1]  "n"
0:000> dt -b 00c07518 xptiTypelib
xpcom_core!xptiTypelib
   +0x000 mFileIndex       : 4
   +0x002 mZipItemIndex    : 0xffff
0:000> dt -b 0x00c8aa40 xptiInterfaceInfo
xpcom_core!xptiInterfaceInfo
   +0x000 __VFN_table : 0x0052ced8 
   +0x004 mRefCnt          : nsAutoRefCnt
      +0x000 mValue           : 2
   +0x008 _mOwningThread   : nsAutoOwningThread
      +0x000 mThread          : 0x00ad34a0 
   +0x00c mEntry           : 0x00c07508 
   +0x010 mParent          : (null) 
0:000> ?? this->mFlags
class xptiInfoFlags
   +0x000 mData            : 0x4 ''
0:000> da @@(this->mName)
00c07521  "nsIIOService"

    PRUint16 parent_index = mInterface->mDescriptor->parent_interface;
00 xpcom_core!xptiInterfaceEntry::ResolveLocked(class xptiWorkingSet * aWorkingSet = 0x00bd3474)+0xc6 [mozilla.org\mozilla\xpcom\reflect\xptinfo\src\xptiinterfaceinfo.cpp @ 191]
01 xpcom_core!xptiInterfaceEntry::Resolve(class xptiWorkingSet * aWorkingSet = 0x00000000)+0x28 [mozilla.org\mozilla\xpcom\reflect\xptinfo\src\xptiinterfaceinfo.cpp @ 145]
02 xpcom_core!xptiInterfaceEntry::EnsureResolved(class xptiWorkingSet * aWorkingSet = 0x00000000)+0x2a [mozilla.org\mozilla\xpcom\reflect\xptinfo\src\xptiprivate.h @ 590]
03 xpcom_core!xptiInterfaceEntry::GetMethodCount(unsigned short * count = 0x0012eacc)+0x11 [mozilla.org\mozilla\xpcom\reflect\xptinfo\src\xptiinterfaceinfo.cpp @ 295]
04 xpcom_core!xptiInterfaceInfo::GetMethodCount(unsigned short * aMethodCount = 0x0012eacc)+0x25 [mozilla.org\mozilla\xpcom\reflect\xptinfo\src\xptiprivate.h @ 704]
05 xpc3250!XPCNativeInterface::NewInstance(class XPCCallContext * ccx = 0x0012ec08, class nsIInterfaceInfo * aInfo = 0x00c8aa40)+0x9d [mozilla.org\mozilla\js\src\xpconnect\src\xpcwrappednativeinfo.cpp @ 359]
06 xpc3250!XPCNativeInterface::GetNewOrUsed(class XPCCallContext * ccx = 0x0012ec08, struct nsID * iid = 0x00c07508)+0x114 [mozilla.org\mozilla\js\src\xpconnect\src\xpcwrappednativeinfo.cpp @ 239]
07 xpc3250!XPCConvert::NativeInterface2JSObject(class XPCCallContext * ccx = 0x0012ec08, class nsIXPConnectJSObjectHolder ** dest = 0x0012ed2c, class nsISupports * src = 0x00c71a10, struct nsID * iid = 0x00c07508, struct JSObject * scope = 0x01b915a0, int allowNativeWrapper = 0, int isGlobal = 0, unsigned int * pErr = 0x0012ec04)+0xe6 [mozilla.org\mozilla\js\src\xpconnect\src\xpcconvert.cpp @ 1099]
08 xpc3250!nsXPConnect::WrapNative(struct JSContext * aJSContext = 0x00c377b8, struct JSObject * aScope = 0x01b915a0, class nsISupports * aCOMObj = 0x00c71a10, struct nsID * aIID = 0x00c07508, class nsIXPConnectJSObjectHolder ** _retval = 0x0012ed2c)+0x13c [mozilla.org\mozilla\js\src\xpconnect\src\nsxpconnect.cpp @ 1260]
09 xpc3250!nsJSCID::GetService(class nsISupports ** _retval = 0x0012eec4)+0x309 [mozilla.org\mozilla\js\src\xpconnect\src\xpcjsid.cpp @ 901]
0a xpcom_core!NS_InvokeByIndex_P(class nsISupports * that = 0x00c88d78, unsigned int methodIndex = 0xb, unsigned int paramCount = 1, struct nsXPTCVariant * params = 0x0012eec4)+0x27 [mozilla.org\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp @ 102]
0b xpc3250!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x00c88d78, XPCWrappedNative::CallMode mode = 11 (No matching enumerant))+0x1254 [mozilla.org\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2369]
0c xpc3250!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x0012f080, XPCWrappedNative::CallMode mode = CALL_METHOD (0))+0x1254 [mozilla.org\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2369]
0d xpc3250!XPC_WN_CallMethod(struct JSContext * cx = 0x00c377b8, struct JSObject * obj = 0x01b915a0, unsigned int argc = 1, long * argv = 0x00cb9034, long * vp = 0x0012f1a0)+0x181 [mozilla.org\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp @ 1470]
0e js3250!js_Invoke(struct JSContext * cx = 0x00c377b8, unsigned int argc = 1, long * vp = 0x00cb902c, unsigned int flags = 0x800)+0x969 [mozilla.org\mozilla\js\src\jsinterp.c @ 1287]
0f js3250!js_Interpret(struct JSContext * cx = 0x00c377b8)+0xb3f7 [mozilla.org\mozilla\js\src\jsinterp.c @ 4836]
10 js3250!js_Execute(struct JSContext * cx = 0x00c377b8, struct JSObject * chain = 0x017e11e0, struct JSScript * script = 0x00cda028, struct JSStackFrame * down = 0x00000000, unsigned int flags = 0x800, long * result = 0x0012fa6c)+0x306 [mozilla.org\mozilla\js\src\jsinterp.c @ 1526]
11 js3250!JS_ExecuteScript(struct JSContext * cx = 0x00c377b8, struct JSObject * obj = 0x017e11e0, struct JSScript * script = 0x00cda028, long * rval = 0x0012fa6c)+0x57 [mozilla.org\mozilla\js\src\jsapi.c @ 4871]
12 xpc3250!mozJSComponentLoader::GlobalForLocation(class nsILocalFile * aComponent = 0x00c2c780, struct JSObject ** aGlobal = 0x00c79d40, char ** aLocation = 0x00c79d44)+0x147c [mozilla.org\mozilla\js\src\xpconnect\loader\mozjscomponentloader.cpp @ 1265]
13 xpc3250!mozJSComponentLoader::LoadModule(class nsILocalFile * aComponentFile = 0x00c2c780, class nsIModule ** aResult = 0x0012fd30)+0x2ac [mozilla.org\mozilla\js\src\xpconnect\loader\mozjscomponentloader.cpp @ 594]
14 xpcom_core!nsComponentManagerImpl::AutoRegisterComponent(class nsILocalFile * aComponentFile = 0x00c2c780, class nsTArray<DeferredModule> * aDeferred = 0x0012fe7c, int minLoader = 0)+0x34d [mozilla.org\mozilla\xpcom\components\nscomponentmanager.cpp @ 3005]
15 xpcom_core!nsComponentManagerImpl::AutoRegisterDirectory(class nsIFile * inDirSpec = 0x00bbb548, class nsCOMArray<nsILocalFile> * aLeftovers = 0x0012fe78, class nsTArray<DeferredModule> * aDeferred = 0x0012fe7c)+0x1a2 [mozilla.org\mozilla\xpcom\components\nscomponentmanager.cpp @ 2920]
16 xpcom_core!nsComponentManagerImpl::AutoRegisterImpl(class nsIFile * inDirSpec = 0x00bbb548, class nsCOMArray<nsILocalFile> * aLeftovers = 0x0012fe78, class nsTArray<DeferredModule> * aDeferred = 0x0012fe7c)+0x75 [mozilla.org\mozilla\xpcom\components\nscomponentmanager.cpp @ 2879]
17 xpcom_core!nsComponentManagerImpl::AutoRegister(class nsIFile * aSpec = 0x00000000)+0x1a6 [mozilla.org\mozilla\xpcom\components\nscomponentmanager.cpp @ 3288]
18 xpcshell!main(int argc = 1, char ** argv = 0x00ad8358, char ** envp = 0x00ad38b8)+0x121 [mozilla.org\mozilla\js\src\xpconnect\shell\xpcshell.cpp @ 1327]
19 xpcshell!__tmainCRTStartup(void)+0x1a6 [f:\sp\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 597]
1a xpcshell!mainCRTStartup(void)+0xd [f:\sp\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 414]
1b kernel32!BaseProcessStart+0x23

Comment 1

[timeless]

i think this probably relates to the fact that nsIProtocolHandler doesn't seem to be reflected in xpcshell when I don't crash.

Comment 2

[Wayne Mery (:wsmwk)]

same as thunderbird crash?
seen only in 3.0b2 crashes, at a very low rate - about 3/week, linux and windows

bp-a1b93031-7b1e-4c06-a691-fd6ec2090318
0  	xpcom_core.dll  	xptiInterfaceEntry::ResolveLocked  	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:191
1 	xpcom_core.dll 	xptiInterfaceEntry::Resolve 	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:145
2 	xpcom_core.dll 	xptiInterfaceEntry::GetMethodCount 	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:295
3 	xpcom_core.dll 	xptiInterfaceInfo::GetMethodCount 	xpcom/reflect/xptinfo/src/xptiprivate.h:704
4 	thunderbird.exe 	XPCNativeInterface::NewInstance 	js/src/xpconnect/src/xpcwrappednativeinfo.cpp:393
5 	thunderbird.exe 	XPCNativeInterface::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednativeinfo.cpp:273
6 	thunderbird.exe 	nsJSIID::NewResolve 	js/src/xpconnect/src/xpcjsid.cpp:502
7 	thunderbird.exe 	XPC_WN_Helper_NewResolve 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1071
8 	js3250.dll 	js_LookupPropertyWithFlags 	js/src/jsobj.cpp:3507
9 	js3250.dll 	js_GetPropertyHelper 	js/src/jsobj.cpp:3824
10 	js3250.dll 	js_Interpret 	js/src/jsinterp.cpp:4276
11 	js3250.dll 	js_Execute 	js/src/jsinterp.cpp:1562
12 	js3250.dll 	JS_ExecuteScript 	js/src/jsapi.cpp:5101
13 	xpcom_core.dll 	nsQueryInterfaceWithError::operator 	nsCOMPtr.cpp:75

Comment 3

[David Bradley]

xptiInterfaceEntry::PartiallyResolveLocked failure is not checked nor is the resolved state set to failed.

http://mxr.mozilla.org/seamonkey/source/xpcom/reflect/xptinfo/src/xptiInterfaceInfoManager.cpp#599

I've not been able to look at the crash reports to figure out if this is true the case. Need the crash address to know for sure. Just the stack won't tell us for sure why this crashed. This assumes that mInterface is what's causing the crash.

Comment 4

[David Bradley]

Attachment: Set the resolved state to fail on allocation failure

Comment 5

[Wayne Mery (:wsmwk)]

David, is this the detail you need?

bp-96c5c58d-a8ed-415e-aa1b-6029d2110224 Firefox (ramprasdpulipati)
EXCEPTION_ACCESS_VIOLATION_READ
0xffffffffffff0008
0	xul.dll	xptiInterfaceEntry::ResolveLocked	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:191
1	xul.dll	xptiInterfaceEntry::Resolve	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:145
2	xul.dll	xptiInterfaceEntry::EnsureResolved	
3	xul.dll	XPCNativeInterface::GetNewOrUsed	js/src/xpconnect/src/xpcwrappednativeinfo.cpp:273
4	xul.dll	nsXPCComponents::AttachNewComponentsObject	js/src/xpconnect/src/xpccomponents.cpp:4061
5	xul.dll	nsXPConnect::InitClasses	js/src/xpconnect/src/nsXPConnect.cpp:1075
6	xul.dll	XPCJSContextStack::GetSafeJSContext	js/src/xpconnect/src/xpcthreadcontext.cpp:272
7	xul.dll	xul.dll@0x965bab	


bp-0e2ad287-54a4-41ba-882c-ad3f02101222 TB3.1.7 (james.o)
0xffffffffc32b734a
0	xpcom_core.dll	xptiInterfaceEntry::ResolveLocked	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:221
1	xpcom_core.dll	xptiInterfaceEntry::ResolveLocked	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:199
2	xpcom_core.dll	xptiInterfaceEntry::Resolve	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:145
3	xpcom_core.dll	xptiInterfaceEntry::GetMethodCount	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:295
4	xpcom_core.dll	xptiInterfaceInfo::GetMethodCount	xpcom/reflect/xptinfo/src/xptiprivate.h:703
5	thunderbird.exe	XPCNativeInterface::NewInstance	js/src/xpconnect/src/xpcwrappednativeinfo.cpp:393
6	thunderbird.exe	XPCNativeInterface::GetNewOrUsed	js/src/xpconnect/src/xpcwrappednativeinfo.cpp:273

Comment 6

[David Bradley]

Looks like the same issue. I need to get a local build up and running. I'm sure the patch is probably a little stale and needs to be refreshed. I also want to double check to make sure it's the correct solution.

Comment 7

[Ed Morley [:emorley]]

Bug 570488 / http://hg.mozilla.org/mozilla-central/diff/894850aef55c/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp means that the current patch will no longer work, since xptiInterfaceEntry::PartiallyResolveLocked has been removed.

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to Ed Morley [:edmorley UTC+1] from comment #7)
> Bug 570488 /
> http://hg.mozilla.org/mozilla-central/diff/894850aef55c/xpcom/reflect/
> xptinfo/src/xptiInterfaceInfo.cpp means that the current patch will no
> longer work, since xptiInterfaceEntry::PartiallyResolveLocked has been
> removed.

But there still are some crashes...
bp-650f4c1b-af1e-40f9-8015-55e022131030
bp-e412d3f9-2dc5-48f9-aa81-e0c8e2131030
bp-e8c566ae-86a6-4fa6-87ca-c86252131018

(In reply to David Bradley from comment #6)
> Looks like the same issue. I need to get a local build up and running. I'm
> sure the patch is probably a little stale and needs to be refreshed. I also
> want to double check to make sure it's the correct solution.a

Comment 9

[Wayne Mery (:wsmwk)]

bp-8e240b37-4f0a-40e8-9cf3-c2aa82131013 firefox 25

hg@1 89 // Finish out resolution by finding parent and Resolving it so
hg@1 90 // we can set the info we get from it.
hg@1 91
ehsan@108463 92 uint16_t parent_index = mDescriptor->parent_interface;

Comment 10

[Wayne Mery (:wsmwk)]

apparently stack varies. 

bp-1b71e258-1934-48dd-919d-26de22131112 firefox 26
benjamin@43619 107 mMethodBaseIndex =
benjamin@43619 108 parent->mMethodBaseIndex +
benjamin@43619 109 parent->mDescriptor->num_methods;

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'xptiInterfaceEntry::ResolveLocked':
 - nightly(version 50):0 crashes from 2016-06-06.
 - aurora (version 49):2 crashes from 2016-06-07.
 - beta   (version 48):21 crashes from 2016-06-06.
 - release(version 47):57 crashes from 2016-05-31.
 - esr    (version 45):1 crash from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       0       0       0       0       0
 - aurora        2       0       0       0       0       0       0
 - beta          1       2       7       3       5       2       1
 - release       3       8       7       6      11      11       7
 - esr           0       0       0       0       0       1       0

Affected platforms: Windows, Mac OS X, Linux

Comment 12

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.

Comment 13

[Andrew McCreight [:mccr8]]

Dynamic loading of XPT files has been removed.