806175 - crash in mozilla::scache::StartupCache::GetBuffer mainly with IE Tab Plus (IBM Edition) and IBM CCK package

Status: RESOLVED WONTFIX

(Core :: XPCOM, defect)

Description

[Scoobidiver (away)]

With combined signatures, it's #16 top browser crasher in 16.0.2.

It's correlated to Yandex.Bar and Спутник @Mail.Ru:
  PR_JoinThread | mozilla::scache::StartupCache::GetBuffer(char const*, char**, unsigned int*)|EXCEPTION_ACCESS_VIOLATION_READ (78 crashes)
     78% (61/78) vs.   3% (5739/173112) [e-mail] (Yandex.Bar, https://addons.mozilla.org/addon/3495)
     65% (51/78) vs.   2% (3857/173112) {37964A3C-4EE8-47b1-8321-34DE2C39BA4D}

Signature 	PR_JoinThread | mozilla::scache::StartupCache::GetBuffer(char const*, char**, unsigned int*) More Reports Search
UUID	1eec7bd9-c533-4bce-ab52-1dab72121028
Date Processed	2012-10-28 08:31:14
Uptime	51
Last Crash	3.9 days before submission
Install Age	51 seconds since version was first installed.
Install Time	2012-10-28 08:30:19
Product	Firefox
Version	16.0.2
Build ID	20121024073032
Release Channel	release
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 15 model 107 stepping 1
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x65014c
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x0390, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.15.11.8593
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x0390
Total Virtual Memory	2147352576
Available Virtual Memory	1939546112
System Memory Use Percentage	48
Available Page File	3133251584
Available Physical Memory	1096937472

Frame 	Module 	Signature 	Source
0 	nspr4.dll 	PR_JoinThread 	nsprpub/pr/src/threads/combined/pruthr.c:1514
1 	xul.dll 	mozilla::scache::StartupCache::GetBuffer 	startupcache/StartupCache.cpp:292
2 	xul.dll 	nsXULPrototypeCache::GetPrototype 	content/xul/document/src/nsXULPrototypeCache.cpp:149
3 	xul.dll 	nsXULDocument::LoadOverlayInternal 	content/xul/document/src/nsXULDocument.cpp:2675
4 	xul.dll 	nsXULDocument::ResumeWalk 	content/xul/document/src/nsXULDocument.cpp:3064
5 	xul.dll 	nsXULDocument::OnStreamComplete 	content/xul/document/src/nsXULDocument.cpp:3547
6 	nspr4.dll 	nspr4.dll@0x8caf 	
7 	xul.dll 	nsJARChannel::OnStopRequest 	modules/libjar/nsJARChannel.cpp:860
8 	nspr4.dll 	nspr4.dll@0x8caf 	
9 	xul.dll 	nsInputStreamPump::OnStateStop 	netwerk/base/src/nsInputStreamPump.cpp:555
10 	nspr4.dll 	nspr4.dll@0x8caf 	
11 	xul.dll 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:373
12 	xul.dll 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:82
13 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:624
14 	xul.dll 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:217
15 	xul.dll 	nsThread::Shutdown 	xpcom/threads/nsThread.cpp:466
16 	xul.dll 	nsHtml5ParserThreadTerminator::Observe 	parser/html/nsHtml5Module.cpp:101
17 	xul.dll 	nsObserverService::NotifyObservers 	xpcom/ds/nsObserverService.cpp:149
18 	xul.dll 	mozilla::ShutdownXPCOM 	xpcom/build/nsXPComInit.cpp:590
19 	xul.dll 	ScopedXPCOMStartup::~ScopedXPCOMStartup 	toolkit/xre/nsAppRunner.cpp:1105
20 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3893
21 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3947
22 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:100
23 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
24 	kernel32.dll 	BaseThreadInitThunk 	
25 	ntdll.dll 	__RtlUserThreadStart 	
26 	ntdll.dll 	_RtlUserThreadStart

More reports at:
https://crash-stats.mozilla.com/report/list?signature=PR_JoinThread+|+mozilla%3A%3Ascache%3A%3AStartupCache%3A%3AGetBuffer%28char+const*%2C+char**%2C+unsigned+int*%29
https://crash-stats.mozilla.com/report/list?signature=PR_JoinThread+|+PR_GetCurrentThread+|+mozilla%3A%3Ascache%3A%3AStartupCache%3A%3AGetBuffer%28char+const*%2C+char**%2C+unsigned+int*%29

Comment 1

[Honza Bambas (:mayhemer)]

Apparently nsXULPrototypeCache::gStartupCache holds ref to StartupCache::gStartupCache that has been deleted just before call to shudown-thread notification:

http://hg.mozilla.org/releases/mozilla-release/annotate/e0c8343d2809/xpcom/build/nsXPComInit.cpp#l586

nsXULPrototypeCache collects it here:

http://hg.mozilla.org/mozilla-central/annotate/50cd5f7339f6/content/xul/document/src/nsXULPrototypeCache.cpp#l558

This has to be fixed (in a new bug probably).


On the other hand, at this stage we shouldn't load any channels.  Similar bug is bug 700493 that has been fixed.  However, we still open some channels *somewhere* that are probably not added to any load group and thus not stopped much sooner before shutdown.

That *somewhere* is the thing to find and fix in this bug.

Comment 2

[Honza Bambas (:mayhemer)]

Looks like the code has been introduced in bug 592943.

Comment 3

[Scoobidiver (away)]

It's a low volume crash in 17.0 and above.

Comment 4

[Scoobidiver (away)]

It's #3 top browser crasher in 17.0.3esr and still occurs on startup.

It's correlated to IE Tab Plus (IBM Edition) 2.04.20110724.3ibm ([e-mail]) and IBM CCK package 2.1.11 ([e-mail]).
I am not sure those two extensions are still maintained by IBM.

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

Mike, do you know anyone we can contact about this?

Comment 6

[Mike Kaply [:mkaply]]

I've sent email to the folks I know and cced them.

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 8

[Rick Alther]

Just some follow up info.  I am the maintainer for the two IBM add-ons.

1) They're used internally but I've never seen one report of crashes related to either of these internally.
2) more importantly, IE Tab has not been deployed for several years now.  IBM CCK has only recently stopped being deployed now that 60 ESR is available (it's a legacy extension).

At least from my perspective, I'm all for WONTFIX.