743376 - Crash [@ nsXMLHttpRequest::GetInterface]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

I'm guessing this a regression from bug 740069.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Boris Zbarsky [:bzbarsky]]

Reason: KERN_INVALID_ADDRESS at address: 0x80004005

Why are we treating NS_ERROR_FAILURE as an address?  ;)

Comment 3

[Boris Zbarsky [:bzbarsky]]

#1  0x14d2f8e2 in nsXMLHttpRequest::GetInterface (this=0x2312e6b0, aIID=@0x80004005, aResult=0xbfff9688) at nsXMLHttpRequest.cpp:3812
#2  0x14d2ff48 in nsXMLHttpRequest::GetInterface (this=0x2312e6b0, aCx=0x1f0a20, aIID=0x2311e3e0, aRv=@0xbfff9708) at nsXMLHttpRequest.cpp:3873
#3  0x1651cde9 in getInterface (cx=0x1f0a20, argc=1, vp=0x1af3a060) at XMLHttpRequestBinding.cpp:530

(gdb) frame 2
#2  0x14d2ff48 in nsXMLHttpRequest::GetInterface (this=0x2312e6b0, aCx=0x1f0a20, aIID=0x2311e3e0, aRv=@0xbfff9708) at nsXMLHttpRequest.cpp:3873
3873      aRv = GetInterface(*iid, getter_AddRefs(result));
(gdb) list
3868    nsXMLHttpRequest::GetInterface(JSContext* aCx, nsIJSIID* aIID, nsresult& aRv)
3869    {
3870      const nsID* iid = aIID->GetID();
3871      nsCOMPtr<nsISupports> result;
3872      JS::Value v = JSVAL_NULL;
3873      aRv = GetInterface(*iid, getter_AddRefs(result));

(gdb) p iid
$1 = (const nsID *) 0x80004005

Comment 4

[Boris Zbarsky [:bzbarsky]]

Oh, and:

(gdb) p aIID
$2 = (nsXPTCStubBase *) 0x2311e3e0

Comment 5

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Yeah, we're calling a notxpcom method on an xptcall stub.  That can't end well.

Comment 6

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: Patch

PConnect's behavior is insane here ...

That said, its probably worth looking into why this didn't crash before.

Comment 7

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: Patch

Er, that was the wrong diff.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 613035 [details] [diff] [review]
Patch

r=me

We should look into having xpconnect default any interface with notxpcom or noscript methods to builtinclass....

Comment 9

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I started writing that patch but it breaks the world (e.g. nsIClassInfo can no longer be script implemented) so I wrote this instead.

Comment 10

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/mozilla-central/rev/4721cf101ae6

Comment 12

[Daniel Veditz [:dveditz]]

If the regression range is correct this doesn't affect ESR10

Comment 13

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Yes, this definitely does not affect ESR10.

Comment 14

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This only affected Nightlies, and it's been weeks, so we can open this.