804077 - Thunderbird startup crash in mozilla::widget::GfxDriverInfo::GfxDriverInfo via BlacklistEntriesToDriverInfo. @ memcpy | nsCharTraits

Status: RESOLVED WORKSFORME

(Core :: Widget, defect)

Description

[Ludovic Hirlimann [:Usul]]

This bug was filed from the Socorro interface and is 
report bp-2be20840-6611-4be4-8ec6-967282121019 .
============================================================= 
0 	msvcr100.dll 	memcpy 	f:\dd\vctools\crt_bld\SELF_X86\crt\src\INTEL\memcpy.asm:185
1 	xul.dll 	wmemcpy 	wchar.h:1213
2 	xul.dll 	nsAString_internal::Assign 	xpcom/string/src/nsTSubstring.cpp:314
3 	xul.dll 	nsAString_internal::Assign 	xpcom/string/src/nsTSubstring.cpp:386
4 	xul.dll 	nsAString_internal::Assign 	xpcom/string/src/nsTSubstring.cpp:347
5 	xul.dll 	nsString::nsString 	objdir-tb/mozilla/dist/include/nsTString.h:46
6 	xul.dll 	mozilla::widget::GfxDriverInfo::GfxDriverInfo 	widget/xpwidgets/GfxDriverInfo.cpp:29
7 	xul.dll 	nsTArray<mozilla::widget::GfxDriverInfo,nsTArrayDefaultAllocator>::InsertElement 	objdir-tb/mozilla/dist/include/nsTArray.h:1069
8 	xul.dll 	nsTArray<mozilla::widget::GfxDriverInfo,nsTArrayDefaultAllocator>::SetLength 	objdir-tb/mozilla/dist/include/nsTArray.h:1022
9 	xul.dll 	BlacklistEntriesToDriverInfo 	widget/xpwidgets/GfxInfoBase.cpp:456
10 	xul.dll 	mozilla::widget::GfxInfoBase::Observe 	widget/xpwidgets/GfxInfoBase.cpp:486
11 	xul.dll 	nsObserverList::NotifyObservers 	xpcom/ds/nsObserverList.cpp:99
12 	xul.dll 	nsObserverService::NotifyObservers 	xpcom/ds/nsObserverService.cpp:149
13 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
14 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2406
15 	xul.dll 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1478
16 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:352
17 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2414
18 	mozjs.dll 	JSScript::makeAnalysis 	js/src/jsinfer.cpp:5335
19 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:309
20 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:363
21 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:396
22 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5846
23 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1430
24 	mozjs.dll 	JSObject::updateSlotsForSpan 	js/src/jsobj.cpp:3451
25 	xul.dll 	XPCNativeSet::FindMember 	js/xpconnect/src/XPCInlines.h:402
26 	xul.dll 	XPCCallContext::Init 	js/xpconnect/src/XPCCallContext.cpp:160
27 	mozglue.dll 	arena_bin_malloc_easy 	memory/mozjemalloc/jemalloc.c:3912
28 	xul.dll 	nsAString_internal::SetCapacity 	xpcom/string/src/nsTSubstring.cpp:532
29 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:112
30 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
31 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2406
32 	xul.dll 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1478
33 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:352
34 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2414
35 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:309
36 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:363
37 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:396
38 	mozjs.dll 	js::InvokeGetterOrSetter 	js/src/jsinterp.cpp:469
39 	mozjs.dll 	js::Shape::get 	js/src/jsscopeinlines.h:296
40 	mozjs.dll 	js::GetPropertyHelper 	js/src/jsobj.cpp:4625
41 	mozjs.dll 	js::GetPropertyOperation 	js/src/jsinterpinlines.h:270
42 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2293
43 	mozjs.dll 	js::StackFrame::initCallFrame 	js/src/vm/Stack-inl.h:153
44 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:309
45 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:396
46 	mozjs.dll 	js::IndirectProxyHandler::call 	js/src/jsproxy.cpp:477
47 	mozjs.dll 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:736
48 	mozjs.dll 	js::Proxy::call 	js/src/jsproxy.cpp:1320
49 	mozjs.dll 	proxy_Call 	js/src/jsproxy.cpp:1856
50 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:345
51 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2414
52 	mozjs.dll 	mozjs.dll@0x20e977 	
53 	mozjs.dll 	js::StackFrame::initCallFrame 	js/src/vm/Stack-inl.h:153
54 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:301
55 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:363
56 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:396
57 	mozjs.dll 	js::IndirectProxyHandler::call 	js/src/jsproxy.cpp:477
58 	mozjs.dll 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:736
59 	mozjs.dll 	js::Proxy::call 	js/src/jsproxy.cpp:1320
60 	mozjs.dll 	proxy_Call 	js/src/jsproxy.cpp:1856
61 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:345
62 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2414
63 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:301
64 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:363
65 	mozjs.dll 	array_readonlyCommon<ArrayForEachBehavior> 	js/src/jsarray.cpp:3189
66 	mozjs.dll 	array_forEach 	js/src/jsarray.cpp:3226
67 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:352
68 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2414
69 	mozjs.dll 	js::StackFrame::initCallFrame 	js/src/vm/Stack-inl.h:153
70 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:309
71 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:396
72 	mozjs.dll 	js::IndirectProxyHandler::call 	js/src/jsproxy.cpp:477
73 	mozjs.dll 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:736
74 	mozjs.dll 	js::Proxy::call 	js/src/jsproxy.cpp:1320
75 	mozjs.dll 	proxy_Call 	js/src/jsproxy.cpp:1856
76 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:345
77 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2414
78 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:301
79 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:363
80 	mozjs.dll 	array_readonlyCommon<ArrayForEachBehavior> 	js/src/jsarray.cpp:3189
81 	mozjs.dll 	array_forEach 	js/src/jsarray.cpp:3226
82 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:352
83 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2414
84 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:301
85 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:363
86 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:396
87 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5846
88 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1430

Comment 1

[Wayne Mery (:wsmwk)]

All crashes are thunderbird 16.0.2.
For thunderbird, this is either a regression, or morphed signature.

is this at all related to bug 787017, which has similar stack and is also startup crash

Comment 2

[Wayne Mery (:wsmwk)]

(we're using single word "startupcrash" in whiteboard)

Comment 3

[Wayne Mery (:wsmwk)]

Is something missing in Thunderbird blocklist?

topcrash in TB17.0.7. Current sig rank #13 and still rising. was #17 a few days ago. 
very few duplicate crashes.
appnotes vary

memcpy | nsCharTraits<wchar_t>::copy(wchar_t*, wchar_t const*, unsigned int)  
also seen in 22 beta, eg bp-6dd84fd7-c8dc-4964-8925-0a75f2130708
further oddness
1. This crash is almost zero for firefox
2. ~40-50% of crashes occur 120seconds to 240 seconds

bp-a855b4ed-dc8f-4a93-8e0e-123bf2130709
0	msvcr100.dll	memcpy	f:\dd\vctools\crt_bld\SELF_X86\crt\src\INTEL\memcpy.asm:307
1	xul.dll	nsCharTraits<wchar_t>::copy	wchar.h:1213
2	xul.dll	nsAString_internal::Assign	xpcom/string/src/nsTSubstring.cpp:314
3	xul.dll	nsAString_internal::Assign	xpcom/string/src/nsTSubstring.cpp:386
4	xul.dll	nsAString_internal::Assign	xpcom/string/src/nsTSubstring.cpp:347
5	xul.dll	nsString::nsString	objdir-tb/mozilla/dist/include/nsTString.h:46
6	xul.dll	mozilla::widget::GfxDriverInfo::GfxDriverInfo	widget/xpwidgets/GfxDriverInfo.cpp:30
7	xul.dll	nsTArray<mozilla::widget::GfxDriverInfo,nsTArrayDefaultAllocator>::InsertElement	objdir-tb/mozilla/dist/include/nsTArray.h:1081
8	xul.dll	nsTArray<mozilla::widget::GfxDriverInfo,nsTArrayDefaultAllocator>::SetLength	objdir-tb/mozilla/dist/include/nsTArray.h:1034
9	xul.dll	BlacklistEntriesToDriverInfo	widget/xpwidgets/GfxInfoBase.cpp:492
10	xul.dll	mozilla::widget::GfxInfoBase::Observe	widget/xpwidgets/GfxInfoBase.cpp:522 

joe@60893
18GfxDriverInfo::GfxDriverInfo()
joe@60893
19 : mOperatingSystem(DRIVER_OS_UNKNOWN),
bjacob@109768
20 mOperatingSystemVersion(0),
dsherk@84256
21 mAdapterVendor(GfxDriverInfo::GetDeviceVendor(VendorAll)),
joe@60893
22 mDevices(allDevices),
joe@60893
23 mDeleteDevices(false),
joe@60893
24 mFeature(allFeatures),
joe@60893
25 mFeatureStatus(nsIGfxInfo::FEATURE_NO_INFO),
joe@97333
26 mComparisonOp(DRIVER_COMPARISON_IGNORED),
joe@60893
27 mDriverVersion(0),
bjacob@61594
28 mDriverVersionMax(0),
ayg@106310
29 mSuggestedVersion(nullptr)
joe@60893
30{} 
 
 memcpy | wmemcpy 
bp9280b95a-66b9-4349-b0e6-de1c12120921 TB15
0	msvcr100.dll	memcpy	f:\dd\vctools\crt_bld\SELF_X86\crt\src\INTEL\memcpy.asm:185
1	xul.dll	wmemcpy	objdir-tb/mozilla/dist/include/nsCharTraits.h:185
2	xul.dll	nsAString_internal::Assign	xpcom/string/src/nsTSubstring.cpp:314
3	xul.dll	nsAString_internal::Assign	xpcom/string/src/nsTSubstring.cpp:386
4	xul.dll	nsAString_internal::Assign	xpcom/string/src/nsTSubstring.cpp:347
5	xul.dll	nsString::nsString	objdir-tb/mozilla/dist/include/nsTString.h:45
6	xul.dll	mozilla::widget::GfxDriverInfo::GfxDriverInfo	widget/xpwidgets/GfxDriverInfo.cpp:29
7	xul.dll	nsTArray<mozilla::widget::GfxDriverInfo,nsTArrayDefaultAllocator>::InsertElement	objdir-tb/mozilla/dist/include/nsTArray.h:1067
8	xul.dll	nsTArray<mozilla::widget::GfxDriverInfo,nsTArrayDefaultAllocator>::SetLength	objdir-tb/mozilla/dist/include/nsTArray.h:1020
9	xul.dll	BlacklistEntriesToDriverInfo	widget/xpwidgets/GfxInfoBase.cpp:452
10	xul.dll	mozilla::widget::GfxInfoBase::Observe	widget/xpwidgets/GfxInfoBase.cpp:482
11	xul.dll	nsObserverList::NotifyObservers	xpcom/ds/nsObserverList.cpp:99

Comment 4

[Scoobidiver (away)]

The startupcrash keyword is when more than 50% of crashes happen within one minute while for this one 87% happen between one and five minutes.
It's #16 top crasher in 17.0.7 so a topcrash according to https://wiki.mozilla.org/CrashKill/Topcrash.

(In reply to Wayne Mery (:wsmwk) from comment #1)
> All crashes are thunderbird 16.0.2.
> For thunderbird, this is either a regression, or morphed signature.
It first showed up in TB 8.0

> is this at all related to bug 787017, which has similar stack and is also
> startup crash
No. This one is not a crash on abort.

Comment 5

[Mark Banner (:standard8)]

AFAIK the binary blocklist should be the same for the same versions of FF versus TB. Although they may have moved this to being in the downloaded blocklist, in which case you may be able to examine blocklist.xml in your profile/app directory.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

No crashes on TB >24 in the last 28 days.