429585 - Crash [@ XPCNativeInterface::GetName] or [@ XPCNativeScriptableInfo::~XPCNativeScriptableInfo]

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacktrace 1

I found this bug using Jesse's DOM fuzzer, and he is working on a reduced testcase because this crash is highly unreproducible and fairly inconsistent.

The first type of crash stacktraces occur on yesterday's compiled debug Firefox trunk on the Mac, while the second and third types started occurring on today's build.

Will be attaching 2 stacktraces of each type of crashes.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacktrace 1, second instance

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacktrace 2, first instance

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacktrace 2, second instance

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacktrace 3, first instance

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stacktrace 3, second instance

Comment 6

[Jesse Ruderman]

Attachment: testcase 0: nonsense exception

This testcase does not demonstrate a crash, but just a strange exception.  (It also explains why the subsequent testcases use setTimeout.)

document.getElementById somehow manages to throw NS_ERROR_FILE_NOT_FOUND.

Comment 7

[Jesse Ruderman]

(Only when the testcase is local, I guess.)

Comment 8

[Jesse Ruderman]

Attachment: testcase 1: immediate crash [@ XPCNativeInterface::GetName]

With MallocScribble enabled, this testcase always triggers a crash 
[@ XPCNativeInterface::GetName].  Without MallocScribble, it usually doesn't crash.

Comment 9

[Jesse Ruderman]

Attachment: testcase 2: shutdown crash [@ XPCNativeScriptableInfo::~XPCNativeScriptableInfo]

This crashes if you quit after loading it.  It can crash even without MallocScribble.

Comment 10

[Damon Sicore (:damons)]

Wouldn't hold back the release for this.  Please re-nom if you disagree.

Comment 11

[Brian Crowder]

I can not get the "immediate crash" testcase to crash, even with MallocScribble turned on.  Please reopen if you can.

Comment 12

[Jesse Ruderman]

Still crashes for me.  Note that it must be local in order to request the privileges needed to force a garbage collection.

Comment 13

[Mike Shaver (:shaver emeritus)]

Adding sayrer to help get this scheduled.

Comment 14

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 316337 [details]
testcase 1: immediate crash [@ XPCNativeInterface::GetName]

Can't reproduce on OSX with MallocScribble using a trunk build.

Comment 15

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 316338 [details]
testcase 2: shutdown crash [@ XPCNativeScriptableInfo::~XPCNativeScriptableInfo]

Can't reproduce this either.

Comment 16

[Jesse Ruderman]

WFM using TM branch (with mallocscribble and with JIT off to avoid bug 458857).  I even tried the original testcase and the partially-reduced testcases I saved off while I was reducing it.