Closed Bug 550758 Opened 15 years ago Closed 8 years ago

stack overflow crash [@ XPCWrappedNative::GetScope()]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows Vista
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: wsmwk, Unassigned)

Details

(Keywords: crash, Whiteboard: [tbird crash][rare])

Crash Data

crash [@ XPCWrappedNative::GetScope()] #2 crash for 3.1b1pre, but I hesitate to give it topcrash status until after 3.1b1 ships and we get better stats. Also appears in small quantity in 3.0.x builds. all are windows crashes. xref Bug 544610 - crash [@ nsXPConnect::GetPrincipal(JSObject*, int)] - which I thought might be related, until I compared the stacks. So just FYI. bp-4dbdd140-0403-4161-9c09-887e02100225 NG crash again. This time after a clean subscribe 0 thunderbird.exe XPCWrappedNative::GetScope js/src/xpconnect/src/xpcprivate.h:2381 1 thunderbird.exe XPCWrappedNative::GetObjectPrincipal js/src/xpconnect/src/xpcwrappednative.cpp:2950 2 thunderbird.exe nsXPConnect::GetPrincipal js/src/xpconnect/src/nsXPConnect.cpp:2629 3 thunderbird.exe nsScriptSecurityManager::doGetObjectPrincipal caps/src/nsScriptSecurityManager.cpp:2420 4 thunderbird.exe nsScriptSecurityManager::GetFunctionObjectPrincipal caps/src/nsScriptSecurityManager.cpp:2217 5 thunderbird.exe nsScriptSecurityManager::GetFramePrincipal caps/src/nsScriptSecurityManager.cpp:2240 6 thunderbird.exe nsScriptSecurityManager::GetPrincipalAndFrame caps/src/nsScriptSecurityManager.cpp:2285 7 thunderbird.exe nsScriptSecurityManager::GetSubjectPrincipal caps/src/nsScriptSecurityManager.cpp:2345 8 thunderbird.exe nsScriptSecurityManager::CheckPropertyAccessImpl caps/src/nsScriptSecurityManager.cpp:940 9 thunderbird.exe nsScriptSecurityManager::CheckPropertyAccess caps/src/nsScriptSecurityManager.cpp:565 10 thunderbird.exe nsScriptSecurityManager::CheckObjectAccess caps/src/nsScriptSecurityManager.cpp:548 11 js3250.dll InitExnPrivate js/src/jsexn.cpp:284 12 thunderbird.exe nsXPCWrappedJSClass::GetRootJSObject js/src/xpconnect/src/xpcwrappedjsclass.cpp:845 13 js3250.dll ReportError js/src/jscntxt.cpp:1294 14 js3250.dll js_ReportErrorNumberVA js/src/jscntxt.cpp:1622 I've also experienced the crash ... bp-4822382d-4482-449d-b973-b4bd72100222 clikcing on folders while "indexing in progress" and window is "(not responding)" wsmwk and bp-c8ca576e-d3d6-40bf-9381-fe16a2100222 in Add-ons panel looking for viewabout
(In reply to comment #0) > bp-4dbdd140-0403-4161-9c09-887e02100225 > NG crash again. This time after a clean subscribe > 0 thunderbird.exe XPCWrappedNative::GetScope > js/src/xpconnect/src/xpcprivate.h:2381 > 1 thunderbird.exe XPCWrappedNative::GetObjectPrincipal > js/src/xpconnect/src/xpcwrappednative.cpp:2950 > 2 thunderbird.exe nsXPConnect::GetPrincipal > js/src/xpconnect/src/nsXPConnect.cpp:2629 > 3 thunderbird.exe nsScriptSecurityManager::doGetObjectPrincipal > caps/src/nsScriptSecurityManager.cpp:2420 > 4 thunderbird.exe nsScriptSecurityManager::GetFunctionObjectPrincipal > caps/src/nsScriptSecurityManager.cpp:2217 > 5 thunderbird.exe nsScriptSecurityManager::GetFramePrincipal > caps/src/nsScriptSecurityManager.cpp:2240 > 6 thunderbird.exe nsScriptSecurityManager::GetPrincipalAndFrame > caps/src/nsScriptSecurityManager.cpp:2285 > 7 thunderbird.exe nsScriptSecurityManager::GetSubjectPrincipal > caps/src/nsScriptSecurityManager.cpp:2345 > 8 thunderbird.exe nsScriptSecurityManager::CheckPropertyAccessImpl > caps/src/nsScriptSecurityManager.cpp:940 > 9 thunderbird.exe nsScriptSecurityManager::CheckPropertyAccess > caps/src/nsScriptSecurityManager.cpp:565 > 10 thunderbird.exe nsScriptSecurityManager::CheckObjectAccess > caps/src/nsScriptSecurityManager.cpp:548 The above crash is reported by the same dude as this crash nsScriptSecurityManager::GetFunctionObjectPrincipal(JSContext*, JSObject*, JSStackFrame*, unsigned int*) bp-0d1b10e5-6169-4d0c-92c1-0dbde2100225 0 thunderbird.exe nsScriptSecurityManager::GetFunctionObjectPrincipal caps/src/nsScriptSecurityManager.cpp:2168 1 thunderbird.exe nsScriptSecurityManager::GetFramePrincipal caps/src/nsScriptSecurityManager.cpp:2240 2 thunderbird.exe nsScriptSecurityManager::GetPrincipalAndFrame caps/src/nsScriptSecurityManager.cpp:2285 3 thunderbird.exe nsScriptSecurityManager::GetSubjectPrincipal caps/src/nsScriptSecurityManager.cpp:2345 4 thunderbird.exe nsScriptSecurityManager::CheckPropertyAccessImpl caps/src/nsScriptSecurityManager.cpp:940 5 thunderbird.exe nsScriptSecurityManager::CheckPropertyAccess caps/src/nsScriptSecurityManager.cpp:565 6 thunderbird.exe nsScriptSecurityManager::CheckObjectAccess caps/src/nsScriptSecurityManager.cpp:548 7 js3250.dll InitExnPrivate js/src/jsexn.cpp:284 8 thunderbird.exe nsXPCWrappedJSClass::GetRootJSObject js/src/xpconnect/src/xpcwrappedjsclass.cpp:845 9 js3250.dll ReportError js/src/jscntxt.cpp:1294 10 js3250.dll js_ReportErrorNumberVA js/src/jscntxt.cpp:1622
Component: General → Security
QA Contact: general → thunderbird
Assignee: nobody → general
Component: Security → JavaScript Engine
Product: Thunderbird → Core
QA Contact: thunderbird → general
Summary: crash [@ XPCWrappedNative::GetScope()] → stack overflow crash [@ XPCWrappedNative::GetScope()]
at least one of js, caps, or xpconnect needs to avoid this stack overflow. of them, js does the most handling of stacks, so it seems like the best starting point.
Crash Signature: [@ XPCWrappedNative::GetScope()]
about 4 thunderbird crashes per version per month. firefox even less.
Whiteboard: [tbird crash][rare]
Assignee: general → nobody
Crash Signature: [@ XPCWrappedNative::GetScope()] → [@ XPCWrappedNative::GetScope()] [@ XPCWrappedNative::GetScope]
(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #3) > about 4 thunderbird crashes per version per month. > firefox even less. Still the same 5 years later https://crash-stats.mozilla.com/signature/?signature=XPCWrappedNative%3A%3AGetScope&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_sort=-date&page=1#reports The original issue seems to be largely gone, and what's left is not happening at a rate worth keeping an open bug without steps to reproduce.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.