430354 - Crash at prince-of-persia.us.ubi.com [@ js3250.dll@0x4557b ]

Status: RESOLVED DUPLICATE of bug 421217

(Core :: JavaScript Engine, defect)

Description

[Ryuichi KUBUKI]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008041102 Minefield/3.0pre ID:2008041102

It crashes at the URL 100% reproducible. No add-on installed except for Nightly Tester Tools and RestTest.

http://crash-stats.mozilla.com/report/index/5c136399-10b9-11dd-b603-0013211cbf8a

Comment 1

[timeless]

this report is unfortunately not very useful:

Signature	js3250.dll@0x4557b
UUID	5c136399-10b9-11dd-b603-0013211cbf8a
Time	2008-04-22 15:13:27-07:00
Uptime	114
Product	Firefox
Version	3.0pre
Build ID	2008041102
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	AuthenticAMD family 15 model 107 stepping 1
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x10
Comments	
Crashing Thread
Frame 	Module 	Signature 	Source
0 	js3250.dll 	js3250.dll@0x4557b 	

could you try using:
http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg

attach before crashing, debug>go, once you crash:

!analyze -v -f

Comment 2

[Ryuichi KUBUKI]

OK here's what windbg shows...

---------------------------------------------------------------------------------
0:000> .sympath SRV*c:\symbols*http://symbols.mozilla.org/firefox
Symbol search path is: SRV*c:\symbols*http://symbols.mozilla.org/firefox
0:000> .symfix+ c:\symbols
0:000> .reload /f
Reloading current modules
.*** WARNING: Unable to verify checksum for firefox.exe
*** ERROR: Module load completed but symbols could not be loaded for firefox.exe
.....*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Minefield\js3250.dll - 
......*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Minefield\xul.dll - 
.*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Minefield\xpcom.dll - 
.......................
0:000> g
ModLoad: 5a620000 5a646000   C:\WINDOWS\system32\ShimEng.dll
ModLoad: 60740000 60749000   C:\WINDOWS\system32\LPK.DLL
ModLoad: 6be00000 6be05000   C:\WINDOWS\system32\ctwdm32.dll
ModLoad: 67930000 679d1000   C:\WINDOWS\system32\dbghelp.dll
ModLoad: 58730000 58768000   C:\WINDOWS\system32\uxtheme.dll
ModLoad: 10000000 1000b000   C:\Program Files\VitalSigns\Net.Medic\Program\syshook.dll
ModLoad: 74660000 746ab000   C:\WINDOWS\system32\MSCTF.dll
ModLoad: 76040000 76199000   C:\WINDOWS\system32\SETUPAPI.dll
ModLoad: 76d90000 76db2000   C:\WINDOWS\system32\apphelp.dll
ModLoad: 73620000 7364e000   C:\WINDOWS\system32\msctfime.ime
ModLoad: 5ec20000 5f106000   C:\WINDOWS\system32\ATOK21W.IME
ModLoad: 5f4e0000 5f551000   C:\WINDOWS\system32\ATOK21AE.DLL
ModLoad: 00cd0000 00d7d000   C:\WINDOWS\system32\ATOK21DE.dll
ModLoad: 611f0000 611f8000   C:\Program Files\Minefield\components\browserdirprovider.dll
ModLoad: 71980000 719bf000   C:\WINDOWS\system32\mswsock.dll
ModLoad: 607c0000 60816000   C:\WINDOWS\system32\hnetcfg.dll
ModLoad: 719c0000 719c8000   C:\WINDOWS\System32\wshtcpip.dll
ModLoad: 76d10000 76d29000   C:\WINDOWS\system32\iphlpapi.dll
ModLoad: 76ed0000 76ef7000   C:\WINDOWS\system32\DNSAPI.dll
ModLoad: 76f60000 76f68000   C:\WINDOWS\System32\winrnr.dll
ModLoad: 76f10000 76f3c000   C:\WINDOWS\system32\WLDAP32.dll
ModLoad: 20000000 20560000   C:\WINDOWS\system32\xpsp2res.dll
ModLoad: 61330000 61355000   C:\Program Files\Minefield\softokn3.dll
ModLoad: 61360000 61378000   C:\Program Files\Minefield\nssdbm3.dll
ModLoad: 61490000 614c9000   C:\Program Files\Minefield\freebl3.dll
ModLoad: 612e0000 61328000   C:\Program Files\Minefield\nssckbi.dll
ModLoad: 61200000 61223000   C:\Program Files\Minefield\components\brwsrcmp.dll
ModLoad: 56250000 56257000   C:\WINDOWS\System32\wship6.dll
ModLoad: 76f70000 76f76000   C:\WINDOWS\system32\rasadhlp.dll
ModLoad: 5e320000 5e329000   C:\WINDOWS\system32\mslbui.dll
ModLoad: 7e740000 7e8af000   C:\WINDOWS\system32\shdocvw.dll
ModLoad: 765c0000 76653000   C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 77c40000 77c52000   C:\WINDOWS\system32\MSASN1.dll
ModLoad: 75410000 75485000   C:\WINDOWS\system32\CRYPTUI.dll
ModLoad: 76be0000 76c0e000   C:\WINDOWS\system32\WINTRUST.dll
ModLoad: 76c40000 76c68000   C:\WINDOWS\system32\IMAGEHLP.dll
ModLoad: 59250000 592a4000   C:\WINDOWS\system32\NETAPI32.dll
ModLoad: 431a0000 43270000   C:\WINDOWS\system32\WININET.dll
ModLoad: 02cb0000 02cb9000   C:\WINDOWS\system32\Normaliz.dll
ModLoad: 42f20000 42f65000   C:\WINDOWS\system32\iertutil.dll
ModLoad: 74d70000 74ddc000   C:\WINDOWS\system32\RichEd20.dll
ModLoad: 6cd00000 6cdb2000   C:\Program Files\Microsoft Silverlight\2.0.30226.2\npctrl.1.0.30109.0.dll
ModLoad: 6c900000 6cbbc000   C:\Program Files\Microsoft Silverlight\2.0.30226.2\agcore.dll
ModLoad: 43280000 433a7000   C:\WINDOWS\system32\urlmon.dll
ModLoad: 73e50000 73eac000   C:\WINDOWS\system32\DSOUND.dll
ModLoad: 74bc0000 74bec000   C:\WINDOWS\system32\OLEACC.dll
ModLoad: 75fd0000 76035000   C:\WINDOWS\system32\MSVCP60.dll
(2294.18ac): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000001 ebx=0013fb80 ecx=00000000 edx=00160608 esi=04503918 edi=041f9c80
eip=6118557b esp=0013fb0c ebp=00000000 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210202
js3250!JS_SetPrivate+0xb:
6118557b 894110          mov     dword ptr [ecx+10h],eax ds:0023:00000010=????????
0:000> !analyze -v -f
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
js3250!JS_SetPrivate+b
6118557b 894110          mov     dword ptr [ecx+10h],eax

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 6118557b (js3250!JS_SetPrivate+0x0000000b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 00000010
Attempt to write to address 00000010

FAULTING_THREAD:  000018ac

DEFAULT_BUCKET_ID:  NULL_POINTER_READ

PROCESS_NAME:  firefox.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

WRITE_ADDRESS:  00000010 

NTGLOBALFLAG:  70

APPLICATION_VERIFIER_FLAGS:  0

LAST_CONTROL_TRANSFER:  from 00000000 to 6118557b

STACK_TEXT:  
00000000 00000000 00000000 00000000 00000000 js3250!JS_SetPrivate+0xb


PRIMARY_PROBLEM_CLASS:  NULL_POINTER_READ

BUGCHECK_STR:  APPLICATION_FAULT_NULL_POINTER_READ

FOLLOWUP_IP: 
js3250!JS_SetPrivate+b
6118557b 894110          mov     dword ptr [ecx+10h],eax

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  js3250!JS_SetPrivate+b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: js3250

IMAGE_NAME:  js3250.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  47ff4304

STACK_COMMAND:  ~0s ; kb

FAILURE_BUCKET_ID:  js3250.dll!JS_SetPrivate_c0000005_NULL_POINTER_READ

BUCKET_ID:  APPLICATION_FAULT_NULL_POINTER_READ_js3250!JS_SetPrivate+b

Followup: MachineOwner
---------

Comment 3

[timeless]

ok, that's better.

Signature: [@ JS_SetPrivate]

try this:
attach windbg before you try to crash :)

.logopen /t c:\jssetprivate-430354
bp js3250!JS_SetPrivate "kp 5; g"

debug>go

then click your link to the crashing page.

when you crash,

.logclose

click "add an attachment" to attach the log file.

If my commands are wrong, please read .hh .logopen / .hh .logclose etc. please try to fix the commands, the goal is logging :).

the goal of kp 5 is to get 5 frames of a stack trace (specifically for the one right before the crash, but I don't know enough about what that is yet), instead of just the single frame.

Comment 4

[Brian Polidoro]

This looks like bug 421217.  The page does not crash when I disable Silverlight 2 beta 1.  
bp-8c5245ae-1140-11dd-8768-001cc45a2ce4

Comment 5

[timeless]

thanks, i don't know how i missed that. i did intend to search for plugins :(.