627355 - Crash at 0x12 [@ nsContentPermissionRequestProxy::GetUri ]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It is #44 top crasher in Fennec 4.0b3 for the last week.

Signature	nsContentPermissionRequestProxy::GetUri
UUID	b2f1ce46-d981-4c08-b935-e11412110109
Time 	2011-01-09 03:36:42.178417
Uptime	333
Install Age	60548 seconds (16.8 hours) since version was first installed.
Product	Fennec
Version	4.0b3
Build ID	20101221205132
Branch	1.9
OS	Linux
OS Version	0.0.0 Linux 2.6.32.9 #3 Fri Oct 29 17:45:32 KST 2010 armv7l
CPU	arm
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	samsung SPH-P100
sprint/SPH-P100/SPH-P100/SPH-P100:2.2/FROYO/DJ30:user/release-keys

Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	nsContentPermissionRequestProxy::GetUri 	dom/base/nsContentPermissionHelper.cpp:99
1 	libxul.so 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:199
2 	libxul.so 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:3064
3 	libxul.so 	XPC_WN_GetterSetter 	js/src/xpconnect/src/xpcprivate.h:2631
4 	libxul.so 	js::Invoke 	js/src/jscntxtinlines.h:689
5 	libxul.so 	js::ExternalGetOrSet 	js/src/jsinterp.cpp:858
6 	libxul.so 	js_GetPropertyHelper 	js/src/jsobj.cpp:5054
7 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:4159
8 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:657
9 	libxul.so 	js::ExternalInvoke 	js/src/jsinterp.cpp:858
10 	libxul.so 	JS_CallFunctionValue 	js/src/jsinterp.h:962
11 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1694
12 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:589
13 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:134
14 	libxul.so 	libxul.so@0x956ed4 	
15 	libxul.so 	nsContentPermissionRequestProxy::Init 	nsCOMPtr.h:492
16 		@0x5294f84f 	
17 	libxul.so 	mozilla::dom::ContentPermissionRequestParent::Recvprompt 	dom/base/nsContentPermissionHelper.cpp:158
18 	libxul.so 	mozilla::dom::PContentPermissionRequestParent::OnMessageReceived 	PContentPermissionRequestParent.cpp:107
19 	libxul.so 	mozilla::dom::PContentParent::OnMessageReceived 	PContentParent.cpp:604
20 	libxul.so 	mozilla::ipc::AsyncChannel::OnDispatchMessage 	ipc/glue/AsyncChannel.cpp:262
21 	libxul.so 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:440
22 	libxul.so 	RunnableMethod<mozilla::ipc::RPCChannel, bool , Tuple0>::Run 	ipc/chromium/src/base/task.h:308
23 	libxul.so 	mozilla::ipc::RPCChannel::DequeueTask::Run 	RPCChannel.h:475
24 	libxul.so 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:344
25 	libxul.so 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:354
26 	libxul.so 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:451
27 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run 	ipc/glue/MessagePump.cpp:71
28 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:626
29 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
30 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:134
31 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:220
32 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:512
33 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:198
34 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:192
35 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3693
36 	libxul.so 	GeckoStart 	toolkit/xre/nsAndroidStartup.cpp:131
37 	libc.so 	libc.so@0x111c3 	
38 	libc.so 	libc.so@0x10cb3 	

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsContentPermissionRequestProxy%3A%3AGetUri

Comment 1

[Josh Matthews [:jdm]]

I'm going to reduce the scope of this crash, because there are two that need investigation.  This bug now only is about the crashes at 0x12, which are a different beast from the 0x0 ones.

Comment 2

[Josh Matthews [:jdm]]

Attachment: Don't dangle pointers to dead objects.

Comment 3

[Josh Matthews [:jdm]]

Example stack: http://crash-stats.mozilla.com/report/index/eb360880-45fd-4183-ac15-1b24c2110116

Looks like something is keeping the request object around, while we've already approved the request and destroyed the parent which owns the uri object.

Comment 4

[Jonathan Watt [:jwatt]]

Pushed http://hg.mozilla.org/mozilla-central/rev/b390764cfa3b