632833 - Crash [@ nsGlobalWindow::LeaveModalState(nsIDOMWindow*) ]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It is #48 top crasher in 4.0b11. Crashes first appeared in 4.0b11pre/20110202.

Signature	nsGlobalWindow::LeaveModalState(nsIDOMWindow*)
UUID	822aab43-525b-4ac4-92ca-f89142110209
Time 	2011-02-09 04:20:32.860955
Uptime	3381
Last Crash	3384 seconds (56.4 minutes) before submission
Install Age	3706 seconds (1.0 hours) since version was first installed.
Product	Firefox
Version	4.0b11
Build ID	20110203141415
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 6 model 28 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
User Comments	
App Notes 	AdapterVendorID: 8086, AdapterDeviceID: a011, AdapterDriverVersion: 6.14.10.5260

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsGlobalWindow::LeaveModalState 	dom/base/nsGlobalWindow.cpp:6430
1 	xul.dll 	nsDOMWindowUtils::LeaveModalStateWithWindow 	dom/base/nsDOMWindowUtils.cpp:1432
2 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
3 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1593
4 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4784
5 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:661
6 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:741
7 	mozjs.dll 	CallOrConstructBoundFunction 	js/src/jsfun.cpp:2296
8 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:704
9 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:862
10 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5053
11 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1701
12 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:588
13 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
14 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
15 	xul.dll 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1127

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8b5cb26bbb10&tochange=1c2d53a2dcfb

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsGlobalWindow%3A%3ALeaveModalState%28nsIDOMWindow*%29

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This looks like fallout from dolske's recent changes to this code.

Comment 2

[Justin Dolske [:Dolske]]

Hmm. NULL crash at:

6427 if (aCallerWin) {
6428   nsCOMPtr<nsIScriptGlobalObject> sgo(do_QueryInterface(aCallerWin));
6429   nsIScriptContext *scx = sgo->GetContext();
6430   scx->LeaveModalState();
6431 } 

jst, should I just null-check |scx| here, or is this a sign of a deeper problem?

Comment 3

[Scoobidiver (away)]

It is now #19 top crasher in 4.0b11.

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

Please renominate if it continues to climb - for now let's hope Dolske can spend his not-already-on-hardblocker-time putting together a patch that can be approved.

Comment 5

[Justin Dolske [:Dolske]]

Attachment: Patch v.1

Talked with jst, scx can indeed by null here (ie, not a sign of a deeper problem) when the window is being torn down. I'd guess that the fix for bug 613800 might make this harder to hit, but it's should be safe to take anyway.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

FYI, in DOM-land if a method starts with "Get", it usually can return null.
Null-safe methods don't have "Get". e.g. nsINode::NodePrincipal()

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/88204c53761b

Comment 9

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

There's a testcase in Bug 636715 that we should turn into an automated test.