636873 - Starting a javascript timer within autoadmin config url causes crash after a few seconds [@ XPCJSRuntime::AddXPConnectRoots(JSContext*, nsCycleCollectionTraversalCallback&) ]

Status: RESOLVED INACTIVE

(Core :: XPConnect, defect)

Description

[Don Kleppinger]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; rv:2.0b12) Gecko/20100101 Firefox/4.0b12
Build Identifier: Mozilla/5.0 (Windows NT 6.1; rv:2.0b12) Gecko/20100101 Firefox/4.0b12

AdapterDeviceID: 0046
AdapterVendorID: 8086
Add-ons: [e-mail]:2.3.2.0,{be327679-1381-4aaa-93b3-4495c36762c5}:7.1.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:4.0b12
AvailableVirtualMemory: 1949847552
BuildID: 20110222210221
CrashTime: 1298675602
EMCheckCompatibility: true
FramePoisonBase: 00000000f0de0000
FramePoisonSize: 65536
InstallTime: 1298672372
Notes: AdapterVendorID: 8086, AdapterDeviceID: 0046, AdapterDriverVersion: 8.15.10.2057

ProductName: Firefox
ReleaseChannel: beta
StartupTime: 1298675590
SystemMemoryUsePercentage: 84
Theme: classic/1.0
Throttleable: 1
TotalVirtualMemory: 2147352576
URL: 
Vendor: Mozilla
Version: 4.0b12
Winsock_LSP: MSAFD Tcpip [TCP/IP] : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [UDP/IP] : 2 : 2 :  
 MSAFD Tcpip [RAW/IP] : 2 : 3 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [TCP/IPv6] : 2 : 1 :  
 MSAFD Tcpip [UDP/IPv6] : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [RAW/IPv6] : 2 : 3 :  
 MSAFD NetBIOS [\Device\NetBT_Tcpip_{8FCD5BD7-8A58-4CA8-818E-FCD53BC2398F}] SEQPACKET 6 : 2 : 5 : %SystemRoot%\system32\mswsock.dll 
 MSAFD NetBIOS [\Device\NetBT_Tcpip_{8FCD5BD7-8A58-4CA8-818E-FCD53BC2398F}] DATAGRAM 6 : 2 : 2 :  
 MSAFD NetBIOS [\Device\NetBT_Tcpip_{9FBB9B10-F8BB-4EDB-BEE5-A9FE536CA37F}] SEQPACKET 3 : 2 : 5 : %SystemRoot%\system32\mswsock.dll 
 MSAFD NetBIOS [\Device\NetBT_Tcpip_{9FBB9B10-F8BB-4EDB-BEE5-A9FE536CA37F}] DATAGRAM 3 : 2 : 2 :  
 MSAFD NetBIOS [\Device\NetBT_Tcpip_{A6786327-6B74-4329-A312-08FF996BEFA6}] SEQPACKET 1 : 2 : 5 : %SystemRoot%\system32\mswsock.dll 
 MSAFD NetBIOS [\Device\NetBT_Tcpip_{A6786327-6B74-4329-A312-08FF996BEFA6}] DATAGRAM 1 : 2 : 2 :  
 MSAFD NetBIOS [\Device\NetBT_Tcpip_{F253A8FC-012B-4557-8218-41AAEDB99BCC}] SEQPACKET 0 : 2 : 5 : %SystemRoot%\system32\mswsock.dll 
 MSAFD NetBIOS [\Device\NetBT_Tcpip_{F253A8FC-012B-4557-8218-41AAEDB99BCC}] DATAGRAM 0 : 2 : 2 :  
 MSAFD NetBIOS [\Device\NetBT_Tcpip6_{8FCD5BD7-8A58-4CA8-818E-FCD53BC2398F}] SEQPACKET 7 : 2 : 5 : %SystemRoot%\system32\mswsock.dll 
 MSAFD NetBIOS [\Device\NetBT_Tcpip6_{8FCD5BD7-8A58-4CA8-818E-FCD53BC2398F}] DATAGRAM 7 : 2 : 2 :  
 MSAFD NetBIOS [\Device\NetBT_Tcpip6_{9FBB9B10-F8BB-4EDB-BEE5-A9FE536CA37F}] SEQPACKET 4 : 2 : 5 : %SystemRoot%\system32\mswsock.dll 
 MSAFD NetBIOS [\Device\NetBT_Tcpip6_{9FBB9B10-F8BB-4EDB-BEE5-A9FE536CA37F}] DATAGRAM 4 : 2 : 2 :  
 MSAFD NetBIOS [\Device\NetBT_Tcpip6_{A6786327-6B74-4329-A312-08FF996BEFA6}] SEQPACKET 2 : 2 : 5 : %SystemRoot%\system32\mswsock.dll 
 MSAFD NetBIOS [\Device\NetBT_Tcpip6_{A6786327-6B74-4329-A312-08FF996BEFA6}] DATAGRAM 2 : 2 : 2 :  
 MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F253A8FC-012B-4557-8218-41AAEDB99BCC}] SEQPACKET 5 : 2 : 5 : %SystemRoot%\system32\mswsock.dll 
 MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F253A8FC-012B-4557-8218-41AAEDB99BCC}] DATAGRAM 5 : 2 : 2 :  
 RSVP TCPv6 Service Provider : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 RSVP TCP Service Provider : 2 : 1 :  
 RSVP UDPv6 Service Provider : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 RSVP UDP Service Provider : 2 : 2 : 

This report also contains technical information about the state of the application when it crashed.

Reproducible: Always

Steps to Reproduce:
1. Activate mozilla.cfg file
pref('general.config.obscure_value', 0); 
pref('general.config.filename', 'mozilla.cfg'); 
2. In mozilla.cfg add 
3.//
lockPref("autoadmin.global_config_url", "http://myurl.com/eagle-config.cfg");
lockPref("autoadmin.append_emailaddr",false);

Place attached eagle-config.cfg at that url.

Browser will startup and retrieve the file.  Within a minute the browser will crash.  The config file starts a timer that we use to clear the browsers cache at midnight if our web application has been re-versioned.

Comment 1

[Don Kleppinger]

Attachment: config file to be retrieved by autoadmin.global_config_url

Comment 2

[Don Kleppinger]

In the attached config file we start a timer that triggers at midnight to clear the browsers cache if our web application has been updated to a new version.  It's a very long timeout so the call back is never called.  The browser will crash, usually within 30 seconds. I've stripped the file down to contain mostly just the timer code.  The notify function doesn't do anything.  Just the act of setting the timer causes the crash.

Comment 3

[Matthias Versen [:Matti]]

Please post a crash ID from about:crashes
https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Comment 4

[Don Kleppinger]

    bp-3a0e55cc-03cc-475f-b57a-cd6492110228	2/28/2011 	7:51 AM
    b4896123-26bc-47f4-9c74-f3a7fb287bd8	2/28/2011 	7:50 AM
    bp-42c81847-eb10-421c-8b1d-0dba02110228	2/28/2011 	7:50 AM
    bp-b84c4096-ec65-4bf0-b13f-6aa172110228	2/28/2011 	7:50 AM
    bp-d70044aa-bc7c-4624-82ad-57d3b2110225	2/25/2011 	5:16 PM

Comment 5

[Matthias Versen [:Matti]]

0 	xul.dll 	XPCJSRuntime::AddXPConnectRoots 	js/src/xpconnect/src/xpcjsruntime.cpp:578
1 	xul.dll 	nsXPConnect::BeginCycleCollection 	js/src/xpconnect/src/nsXPConnect.cpp:493
2 	xul.dll 	nsCycleCollector::BeginCollection 	xpcom/base/nsCycleCollector.cpp:2582
3 	xul.dll 	nsCycleCollectorRunner::Run 	xpcom/base/nsCycleCollector.cpp:3322
4 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:633
5 	xul.dll 	nsThreadStartupEvent::Run 	xpcom/threads/nsThread.cpp:207
6 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
7 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
8 	mozcrt19.dll 	_callthreadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:348
9 	mozcrt19.dll 	__dllonexit 	obj-firefox/memory/jemalloc/crtsrc/onexit.c:276
10 	mozcrt19.dll 	_threadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:326
11 	ntdll.dll 	ntdll.dll@0x5b428

Comment 6

[Benjamin Smedberg]

On what thread does autoconfig run? I thought that autoconfig could only set prefs and proxy settings, but the fact that we can run chrome-privileged autoconfig files loaded over HTTP seems terribly wrong.

Comment 7

[Don Kleppinger]

Autoconfig is used in controlled corporate environments or in our case on a private network where we provide software as a service (a rich client application) to our franchises.  We absolutely need the ability to set configuration parameters and control browser behavior from the server.  I don't believe it is possible for a web site to set up autoconfig in a stealth manner. Also, we use https so it's a secure connection in addition to being a private network.  We don't even allow the browser to navigate outside of our domain.

Comment 8

[Don Kleppinger]

>>We don't even allow the browser to navigate outside of our domain
We configure FF as a custom application (changed application name in application.ini) so that it doesn't interfere with any other instance of firefox that the user might have installed.

Comment 9

[Don Kleppinger]

Can this be considered a 4.0 blocker?  I'd really need a fix get into 4.0.

Comment 10

[Matthias Versen [:Matti]]

Requesting blocking for Don Kleppinger

Comment 11

[Don Kleppinger]

Here's the minimum script that will cause the crash.  If I set the timeout to a value less than the time before the crash (approx 10 seconds), then the event notify is called and there is no crash.  But if I set it longer the crash occurs.

var prompts = Components.classes["@mozilla.org/embedcomp/prompt-service;1"]
                    .getService(Components.interfaces.nsIPromptService);
var event = { notify: function(timer) {prompts.alert(null,"Alert","test");} }

var event = { notify: function(timer) {} }
var timer = Components.classes["@mozilla.org/timer;1"].
                  createInstance(Components.interfaces.nsITimer);
timer.initWithCallback( event, 
                        200000, 
                        Components.interfaces.nsITimer.TYPE_ONE_SHOT);

Comment 12

[Boris Zbarsky [:bzbarsky]]

Autoconfig runs on the thread the profile-after-change notification is sent on, as far as I can tell.

And nsTimerImpl doesn't participate in CC, fwiw...

Comment 13

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.