426621 - Crashed just after hitting 'r' (reply) in Gmail. [@ XPCConvert::JSObject2NativeInterface]

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[George V. Reilly]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13

I hit 'r' to reply to an email in Gmail -- something I've done thousands of times before -- and Firefox immediately crashed.

Here's the callstack in WinDbg, after setting

.sympath SRV**http://msdl.microsoft.com/download/symbols;http://symbols.mozilla.org/firefox

0:000> k
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f558 0041a705 0x39cf0042
0012f578 0041a392 firefox!XPCConvert::JSObject2NativeInterface+0x110 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcconvert.cpp @ 1254]
0012f5d0 00422c24 firefox!XPCConvert::JSData2Native+0x71a [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcconvert.cpp @ 1006]
0012f794 00420aa6 firefox!XPCWrappedNative::CallMethod+0x3d6 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp @ 2014]
0012f82c 600f18c3 firefox!XPC_WN_CallMethod+0x8e [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp @ 1455]
0012f8e8 600f6ea8 js3250!js_Invoke+0x564 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c @ 1384]
0012fa54 600f191b js3250!js_Interpret+0x4a43 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c @ 3955]
0012fb08 600f1c6f js3250!js_Invoke+0x5bc [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c @ 1403]
0012fb8c 600d5888 js3250!js_InternalInvoke+0x89 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c @ 1478]
0012fbb8 0061cb14 js3250!JS_CallFunctionValue+0x1f [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/jsapi.c @ 4362]
0012fbf8 0062b9ce firefox!nsJSContext::CallEventHandler+0x1bb [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp @ 1493]
0012fcb0 0062befb firefox!nsGlobalWindow::RunTimeout+0x21e [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp @ 6819]
0012fcbc 6038ff4e firefox!nsGlobalWindow::TimerCallback+0x14 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp @ 7193]
0012fccc 6039031b xpcom_core!nsTimerImpl::Fire+0x69 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp @ 394]
0012fcdc 0055d5b2 xpcom_core!nsTimerManager::FireNextIdleTimer+0x65 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp @ 628]
0012fd30 00853c74 firefox!nsAppShell::Run+0xbe [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp @ 142]
0012fd3c 0040272b firefox!nsAppStartup::Run+0x18 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp @ 152]
0012fecc 00401012 firefox!XRE_main+0xaf8 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/toolkit/xre/nsAppRunner.cpp @ 2821]
0012fedc 0040102e firefox!main+0x12 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp @ 61]
0012feec 00969186 firefox!WinMain+0x18 [c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp @ 70]

I'll attach the minidump in a followup.

Reproducible: Didn't try

Comment 1

[George V. Reilly]

Attachment: Windows minidump

Minidump from which I obtained the callstack in the original report.

(Why can't I add an attachment to the original report, dammit!)

Comment 2

[Wayne Mery (:wsmwk)]

were  you able to reproduce crash?

do you see this with latest release candidate?
ftp://ftp.mozilla.org/pub/firefox/nightly/3.0b5-candidates/rc2/

Comment 3

[George V. Reilly]

No, I have not repro'd the crash, or I would have added additional comments to this bug.

Regardless, someone who knows the Firefox codebase should poke around in the attached minidump to see if they can learn something. A crash is serious, after all.

Comment 4

[Wayne Mery (:wsmwk)]

yup, and I'm not one of them. Which is why I asked if you could repo with the beta - the type of information which might help someone who knows the codebase.

Comment 5

[Wayne Mery (:wsmwk)]

confirming the original report.

There are presently 2 crashes per week for XPCConvert::JSObject2NativeInterface(XPCCallContex
but unclear they are the same - almost all are 0 seconds uptime.

for example bp-09517aa1-95ac-11dd-a437-001cc45a2ce4
0  	XUL  	XPCConvert::JSObject2NativeInterface  	 mozilla/js/src/xpconnect/src/xpcconvert.cpp:1325
1 	XUL 	XPCConvert::JSData2Native 	mozilla/js/src/xpconnect/src/xpcconvert.cpp:1034
2 	XUL 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2233
3 	XUL 	XPC_WN_CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1473
4 	libmozjs.dylib 	js_Invoke 	mozilla/js/src/jsinvoke.c:1297
5 	libmozjs.dylib 	js_Interpret 	mozilla/js/src/jsinterp.c:4857
6 	libmozjs.dylib 	js_Invoke 	mozilla/js/src/jsinvoke.c:1313
7 	XUL 	nsXPCWrappedJSClass::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1523
8 	XUL 	PrepareAndDispatch 	mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_ppc_rhapsody.cpp:182
9 	XUL 	SharedStub 	
10 	XUL 	nsComponentManagerImpl::CreateInstance 	mozilla/xpcom/components/nsComponentManager.cpp:1670
11 	XUL 	nsComponentManagerImpl::GetService 	mozilla/xpcom/components/nsComponentManager.cpp:1882
12 	XUL 	nsJSCID::GetService 	mozilla/js/src/xpconnect/src/xpcjsid.cpp:894
13 	XUL 	XUL@0x8bc6b4 	
14 	XUL 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2393
15 	XUL 	XPC_WN_CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1473
16 	libmozjs.dylib 	js_Invoke 	mozilla/js/src/jsinvoke.c:1297
17 	libmozjs.dylib 	js_Interpret 	mozilla/js/src/jsinterp.c:4857
18 	libmozjs.dylib 	js_Invoke 	mozilla/js/src/jsinvoke.c:1313
19 	XUL 	nsXPCWrappedJSClass::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1523
20 	XUL 	PrepareAndDispatch 	mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_ppc_rhapsody.cpp:182
21 	XUL 	SharedStub 	
22 	XUL 	nsObserverList::NotifyObservers 	mozilla/xpcom/ds/nsObserverList.cpp:128

Comment 6

[Jesse Ruderman on Windows]

For infrequent crashes, I think it's better to convince individual developers to search crash-stats for their c++ classes than to leave bugs open on specific signatures at random.