530447 - startup crash [@ nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow*, char const*, char const*, char const*, int, nsIArray*, int, nsIDOMWindow**)]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow*, char const*, char const*, char const*, int, nsIArray*, int, nsIDOMWindow**)]  
from crash-stats. low crash rate.

FF crashes, vast majority are startup.

bp-fc4ebea3-fdc6-44e2-9e9b-5164b2091119 3.7a1 windows
0	xul.dll	nsWindowWatcher::OpenWindowJSInternal	 embedding/components/windowwatcher/src/nsWindowWatcher.cpp:584
1	xul.dll	nsWindowWatcher::OpenWindow	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:424
2	xul.dll	ShowProfileManager	toolkit/xre/nsAppRunner.cpp:1866
3	xul.dll	xul.dll@0x425b69	

bp-c9c9d302-8594-40f7-a8db-8f4bf2091106 3.7a1 linux
0	libxul.so	nsWindowWatcher::OpenWindowJSInternal	 embedding/components/windowwatcher/src/nsWindowWatcher.cpp:584
1	libxul.so	nsWindowWatcher::OpenWindow	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:424
2	libxul.so	_ZL18ShowProfileManagerP24nsIToolkitProfileServiceP19nsINativeAppSupport	toolkit/xre/nsAppRunner.cpp:1865
3	libxul.so	XRE_main	toolkit/xre/nsAppRunner.cpp:2193 


a rare thunderbird crash, 3.0b3
bp-c7c752b-96e9-453f-8a90-469cd2091010
0	thunderbird.exe	nsWindowWatcher::CalculateChromeFlags	 embedding/components/windowwatcher/src/nsWindowWatcher.cpp:1507
thunderbird.exe	nsWindowWatcher::OpenWindowJSInternal	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:559
nsWindowWatcher::OpenWindow
3	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
4	thunderbird.exe	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2265 

FF 3.b2
bp-07c29a3e-fd01-4fdc-a31b-bbf7a2091114
0  	xul.dll  	nsWindowWatcher::OpenWindowJSInternal  	 embedding/components/windowwatcher/src/nsWindowWatcher.cpp:584
1 	xul.dll 	nsWindowWatcher::OpenWindow 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:424
2 	brwsrcmp.dll 	nsProfileMigrator::Migrate 	browser/components/migration/src/nsProfileMigrator.cpp:144
3 	xul.dll 	xul.dll@0x442162 	
4 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
5 	firefox.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591


** not startup crashes ... bogus stacks? **

bp-759cf7e0-63fd-458a-9aee-5b95d2090719 FF 3.5.1
1	xul.dll	nsWindowWatcher::OpenWindowJSInternal	 embedding/components/windowwatcher/src/nsWindowWatcher.cpp:760
2	xul.dll	nsWindowWatcher::OpenWindow	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:422
3	xul.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
4	xul.dll	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2045
5	xul.dll	XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2454
6	xul.dll	XPC_WN_CallMethod	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1590
7	js3250.dll	js_Invoke	js/src/jsinterp.cpp:1386
8	js3250.dll	js_Interpret	js/src/jsinterp.cpp:5179
9	js3250.dll	js_Invoke	js/src/jsinterp.cpp:1394
10	xul.dll	nsXPCWrappedJSClass::CallMethod	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1697
11	xul.dll	nsXPCWrappedJS::CallMethod	js/src/xpconnect/src/xpcwrappedjs.cpp:561
12	xul.dll	PrepareAndDispatch	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
13	xul.dll	SharedStub	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
14	xul.dll	EnumValidate	toolkit/components/commandlines/src/nsCommandLine.cpp:667
15	xul.dll	nsCommandLine::EnumerateHandlers	toolkit/components/commandlines/src/nsCommandLine.cpp:605 

bp-b0d6b568-b33f-49b8-b906-0da782091018

Comment 1

[Boris Zbarsky [:bzbarsky]]

Line 584 is:

584  rv = sm->GetSubjectPrincipal(getter_AddRefs(callerPrincipal));

We used to null-check |sm| until bug 504862 landed, which was presumably timeless' point.  Sounds like we should go back to doing that.  :(

Comment 2

[Johnny Stenback (:jst)]

We really should always have a security manager. I wonder if the fix for bug 516113 fixed this as well? If not, a similar fix to that may be what we need here as well.

Comment 3

[timeless]

wayne: the non startup crashes are crashing one frame below this function, please give them their own bug.

johnny: this is a startup bug. i see absolutely no sign that it's soon enough for xpcom to be killing itself.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

timeless, are you sure this is a startup crash?
Crash stat stacks are again missing some parts of the stacks.

Bug 516113 fixed a case where xpcom is shutting down (restarting?) pretty
much immediately after starting.

Comment 5

[timeless]

my guess is that nsScriptSecurityManager::Init() is failing. It should be a problem relating to not yet having a profile directory. But I can't find anything that seems to indicate it cares.

Presumably once you have a profile directory nsScriptSecurityManager::Init() doesn't fail, and since we don't blacklist failed contracts, the later attempt to get this service just works which is why we didn't notice the failure.

I'm not absolutely certain, however the stacks seem perfectly valid.

_ZL18ShowProfileManagerP24nsIToolkitProfileServiceP19nsINativeAppSupport is just ShowProfileManager() without demangling.

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Right now this isn't convincing me as a release blocker, though it's obviously something we should fix. Renominate with justification if you disagree!

Comment 7

[Ian Neal]

I've just started hitting this on SM2.x trunk on Windows XP with build 20100509010325 which I updated from build 20100316015827 (that didn't have the issue).
Starting SM from the command line using -profile <profilename> let me start SM okay.
Uninstalling and then re-installing SM build 20100509010325 using downloaded installer exe fixed the issue.

Comment 8

[Ian Neal]

Sorry, ignore that, seems to be same signature but crashing at a different line http://hg.mozilla.org/mozilla-central/annotate/9d44e74ae46c/embedding/components/windowwatcher/src/nsWindowWatcher.cpp#l523
http://crash-stats.mozilla.com/report/index/b0036c89-81a1-468e-9915-cb9882100509

Comment 9

[Robert Kaiser]

Looks like we had a crash similar to this reported in bug 562047 and the reporter said it goes away when he removes the compreg.dat in the application folder (which we're apparently using for initial startup when no profile is selected and loaded, e.g. for profile manager).
Can an outdated component registry have an influence on those other reports as well?

Comment 10

[David Bradley]

We encountered this same crash in Songbird. The security manager was failing to load because eventually nsIXPConnect was referenced and it couldn't find nsIXPConnect interface information from what was listed in the xpti.dat file. This was due to a stale xpti.dat file being left around in the "VirtualStore" area of Vista. We're seeing this crash on XP and Mac as well. So we're trying to figure out if there are other causes as well.

Comment 11

[Michael Kraft [:morac]]

As of the Win32 Minefield 20100811063038 build, I'm getting this anytime I try to load Minefield with the "-p" option.  If I use no options, Minefield exits immediately, but there's no crash dump.

http://crash-stats.mozilla.com/report/index/bp-eb3e7226-1f21-42fc-b971-ee7142100811

Comment 12

[timeless]

it looks like the security manager is null. I've grabbed your .dmp and will try to verify, but if you can consistently reproduce it then, 

https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

i suspect your .xpt files are bad or something similarly interesting. Please visit irc.

Comment 13

[(no longer active)]

I got this with today's mac64 nightly without the crash reporter, and johnath got it (I think on the 32-bit version) with crash reporter.  Both on startup, both before showing the Choose a Profile dialog.

Comment 14

[Michael Kraft [:morac]]

It looks like it was caused by a bad patch for bug 581576.  I ran the latest tinderbox build and it works fine since bug 581576 was fixed.

Comment 15

[Johnathan Nightingale [:johnath]]

Have some crash URLs!

http://crash-stats.mozilla.com/report/index/bp-cd78095e-b46b-42ec-bc43-abc652100811
http://crash-stats.mozilla.com/report/index/bp-98f60da3-ef97-4434-bfd0-fb9272100811
http://crash-stats.mozilla.com/report/index/bp-a2031609-5f52-457e-9175-9adae2100811

Comment 16

[timeless]

comment 11..comment 15/morac/johnath: i think that was bug 586350. This bug is older.

Comment 17

[Benjamin Smedberg]

dbradley is right, this bug is a sign that we aren't loading the core XPT files. That indicates a frankenbuild of one form or another, but not something we can fix here.

Comment 18

[Robert Kaiser]

We get a flood of those crashes in 1.9.1.12 now, apparently in profile manager at least in those cases I checked.

http://crash-stats.mozilla.com/products/SeaMonkey/versions/2.0.7

Comment 19

[Bruno 'Aqualon' Escherl]

All crash reports I looked at show "WARNING: Json file missing Add-ons" in the Processor Notes.

Comment 20

[Mark Banner (:standard8)]

(In reply to comment #18)
> We get a flood of those crashes in 1.9.1.12 now, apparently in profile manager
> at least in those cases I checked.
> 
> http://crash-stats.mozilla.com/products/SeaMonkey/versions/2.0.7

It is a different crash point - I've filed bug 594699 to cover the regression.

Comment 22

[Wayne Mery (:wsmwk)]

morphed to nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow*, char const*, char const*, char const*, bool, nsIArray*, bool, nsIDOMWindow**) 

However, none after version 15/16
https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=nsWindowWatcher%3A%3AOpenWindowJSInternal%28nsIDOMWindow*%2C%20char%20const*%2C%20char%20const*%2C%20char%20const*%2C%20bool%2C%20nsIArray*%2C%20bool%2C%20nsIDOMWindow**%29&reason_type=contains&date=03%2F30%2F2013%2015%3A05%3A42&range_value=4&range_unit=weeks&hang_type=any&process_type=all&do_query=1&admin=1&signature=nsWindowWatcher%3A%3AOpenWindowJSInternal%28nsIDOMWindow*%2C%20char%20const*%2C%20char%20const*%2C%20char%20const*%2C%20bool%2C%20nsIArray*%2C%20bool%2C%20nsIDOMWindow**%29

Ditto Thunderbird.
https://crash-stats.mozilla.com/report/list?product=Thunderbird&query_search=signature&query_type=exact&query=nsWindowWatcher%3A%3AOpenWindowJSInternal%28nsIDOMWindow*%2C%20char%20const*%2C%20char%20const*%2C%20char%20const*%2C%20bool%2C%20nsIArray*%2C%20bool%2C%20nsIDOMWindow**%29&reason_type=contains&date=03%2F30%2F2013%2015%3A05%3A38&range_value=4&range_unit=weeks&hang_type=any&process_type=all&do_query=1&admin=1&signature=nsWindowWatcher%3A%3AOpenWindowJSInternal%28nsIDOMWindow*%2C%20char%20const*%2C%20char%20const*%2C%20char%20const*%2C%20bool%2C%20nsIArray*%2C%20bool%2C%20nsIDOMWindow**%29