469915 - crash [@ xptiInterfaceEntry::HasAncestor]

Status: RESOLVED INACTIVE

(Core :: XPConnect, defect)

Description

[:Gavin Sharp [email: [e-mail]]]

I don't have STR, I just crashed randomly while editing a review on Bugzilla's "edit attachment" page. I was surprised to not find any other bugs covering crashes in this method.

Comment 1

[:Gavin Sharp [email: [e-mail]]]

Thread 0 Crashed:
0   libxpcom_core.dylib           	0x0026fd2c xptiInterfaceEntry::HasAncestor(nsID const*, int*) + 76
1   libxpconnect.dylib            	0x13a60394 nsXPConnect::IsISupportsDescendant(nsIInterfaceInfo*) + 52
2   libxpconnect.dylib            	0x13a8c4dd XPCNativeInterface::NewInstance(XPCCallContext&, nsIInterfaceInfo*) + 141
3   libxpconnect.dylib            	0x13a8cbe0 XPCNativeInterface::GetNewOrUsed(XPCCallContext&, nsID const*) + 320
4   libxpconnect.dylib            	0x13a735a6 XPCConvert::NativeInterface2JSObject(XPCCallContext&, nsIXPConnectJSObjectHolder**, nsISupports*, nsID const*, JSObject*, int, int, unsigned int*) + 182
5   libxpconnect.dylib            	0x13a73f6c XPCConvert::NativeData2JS(XPCCallContext&, long*, void const*, nsXPTType const&, nsID const*, JSObject*, unsigned int*) + 956
6   libxpconnect.dylib            	0x13a8af6e XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 3342
7   libxpconnect.dylib            	0x13a8e5aa XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) + 314
8   libmozjs.dylib                	0x00122088 js_Invoke + 1694
9   libmozjs.dylib                	0x0012229d js_InternalInvoke + 119
10  libmozjs.dylib                	0x000e00f6 JS_CallFunctionValue + 62
11  libxpconnect.dylib            	0x13a95199 XPC_NW_FunctionWrapper(JSContext*, JSObject*, unsigned int, long*, long*) + 233
12  libmozjs.dylib                	0x00122088 js_Invoke + 1694
13  libmozjs.dylib                	0x00114219 js_Interpret + 29849
14  libmozjs.dylib                	0x001220ec js_Invoke + 1794
15  libmozjs.dylib                	0x0012229d js_InternalInvoke + 119
16  libmozjs.dylib                	0x000e00f6 JS_CallFunctionValue + 62
17  libgklayout.dylib             	0x1235793b nsJSContext::CallEventHandler(nsISupports*, void*, void*, nsIArray*, nsIVariant**) + 427
18  libgklayout.dylib             	0x12391030 nsJSEventListener::HandleEvent(nsIDOMEvent*) + 544
19  libgklayout.dylib             	0x12226b0b nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsPIDOMEventTarget*, unsigned int) + 107
20  libgklayout.dylib             	0x122270ee nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsPIDOMEventTarget*, unsigned int, nsEventStatus*) + 1102
21  libgklayout.dylib             	0x122461fc nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int, int) + 140
22  libgklayout.dylib             	0x122463b1 nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*, int) + 305
23  libgklayout.dylib             	0x122471ac nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) + 1068
24  libgklayout.dylib             	0x12190a64 nsXULPopupManager::FirePopupShowingEvent(nsIContent*, nsIContent*, nsPresContext*, nsPopupType, int, int) + 324
25  libgklayout.dylib             	0x12190e4f nsXULPopupManager::ShowPopupAtScreen(nsIContent*, int, int, int, nsIDOMEvent*) + 175
26  libgklayout.dylib             	0x1244657f nsXULPopupListener::LaunchPopup(nsIDOMEvent*, nsIContent*) + 1071
27  libgklayout.dylib             	0x12446cfc nsXULPopupListener::PreLaunchPopup(nsIDOMEvent*) + 940
28  libgklayout.dylib             	0x122270ab nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsPIDOMEventTarget*, unsigned int, nsEventStatus*) + 1035
29  libgklayout.dylib             	0x122461fc nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int, int) + 140
30  libgklayout.dylib             	0x122464df nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*, int) + 607
31  libgklayout.dylib             	0x122471ac nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) + 1068
32  libgklayout.dylib             	0x12036d32 PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*) + 354
33  libgklayout.dylib             	0x12038b9e PresShell::HandlePositionedEvent(nsIView*, nsIFrame*, nsGUIEvent*, nsEventStatus*) + 238
34  libgklayout.dylib             	0x1203bef6 PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*) + 1382
35  libgklayout.dylib             	0x1234b637 nsViewManager::HandleEvent(nsView*, nsPoint, nsGUIEvent*, int) + 71
36  libgklayout.dylib             	0x1234d7d0 nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) + 1472
37  libgklayout.dylib             	0x12346e76 HandleEvent(nsGUIEvent*) + 54
38  libwidget_mac.dylib           	0x139b929b nsChildView::DispatchEvent(nsGUIEvent*, nsEventStatus&) + 91
39  libwidget_mac.dylib           	0x139acd22 nsChildView::DispatchWindowEvent(nsGUIEvent&) + 34
40  libwidget_mac.dylib           	0x139bc1b8 -[ChildView menuForEvent:] + 440
41  com.apple.AppKit              	0x93188f9a -[NSView rightMouseDown:] + 68
42  libwidget_mac.dylib           	0x139bcfbb -[ChildView rightMouseDown:] + 811
43  com.apple.AppKit              	0x92c463a5 -[NSWindow sendEvent:] + 8511
44  libwidget_mac.dylib           	0x139a949c -[NSWindow(MethodSwizzling) nsCocoaWindow_NSWindow_sendEvent:] + 188
45  libwidget_mac.dylib           	0x139a4fa8 -[ToolbarWindow sendEvent:] + 104
46  com.apple.AppKit              	0x92c12311 -[NSApplication sendEvent:] + 2941
47  com.apple.AppKit              	0x92b6fd0f -[NSApplication run] + 847
48  libwidget_mac.dylib           	0x139a207a nsAppShell::Run() + 186
49  libtoolkitcomps.dylib         	0x137d10b7 nsAppStartup::Run() + 71
50  XUL                           	0x00074706 XRE_main + 8982
51  org.mozilla.firefox           	0x00002d17 main + 231
52  org.mozilla.firefox           	0x0000256c _start + 210
53  org.mozilla.firefox           	0x00002499 start + 41

Comment 2

[timeless]

i've hit crashes here before

from memory this is something like:

149 xptiInterfaceEntry::ResolveLocked(xptiWorkingSet* aWorkingSet /* = nsnull */)
199         if(!parent || !parent->EnsureResolvedLocked())
202             mInterface = nsnull;
205             return PR_FALSE;

I think the guard for this is IsFullyResolved() 

if i'm right, the crash is here:
705         current = current->mInterface->mParent)

of course having the ability to use xpt_dump on the typelibs and see the pointers for the ids helps immensely

Comment 3

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.