883495 - crash in nsDNSAsyncRequest::OnLookupComplete @ nsXPCWrappedJS::CallMethod

Status: RESOLVED FIXED

(Core :: Networking: DNS, defect)

Description

[Scoobidiver (away)]

With the stack trace below, it first showed up in 24.0a1/20130612. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=86413e921d5d&tochange=0414d6d0f60d
It's likely a regression from bug 770840.

Signature 	nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) More Reports Search
UUID	d18042d9-37ed-40e8-94bc-090482130614
Date Processed	2013-06-14 14:10:48
Uptime	24
Last Crash	1.1 hours before submission
Install Age	24 seconds since version was first installed.
Install Time	2013-06-14 14:10:27
Product	Firefox
Version	24.0a1
Build ID	20130614031100
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 15 model 107 stepping 2
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x611205cf
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x689e, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.2.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor01_phx1_mozilla_com_25518:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x689e
Total Virtual Memory	2147352576
Available Virtual Memory	1656975360
System Memory Use Percentage	61
Available Page File	2796986368
Available Physical Memory	836923392

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:571
1 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:85
2 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:112
3 	xul.dll 	nsDNSAsyncRequest::OnLookupComplete 	netwerk/dns/nsDNSService2.cpp:294

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsXPCWrappedJS%3A%3ACallMethod%28unsigned+short%2C+XPTMethodDescriptor+const*%2C+nsXPTCMiniVariant*%29

Comment 1

[Josh Matthews [:jdm]]

nsDNSAsyncRequest::mListener can be scripted and nsDNSAsyncRequest::OnLookupComplete can be called on a background thread.

Comment 2

[Josh Matthews [:jdm]]

Attachment: Avoid releasing a scriptable DNS listener off the main thread.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fb43bd87db39

Comment 4

[Ryan VanderMeulen [:RyanVM]]

http://mozillamemes.tumblr.com/post/21637966463/yes-i-have-a-condition-that-forces-me-to-insert

Backed out for mass bustage.
https://hg.mozilla.org/integration/mozilla-inbound/rev/cc1118580105

https://tbpl.mozilla.org/php/getParsedLog.php?id=24292731&tree=Mozilla-Inbound et al

Comment 5

[Josh Matthews [:jdm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5a3dc3d31890

Comment 6

[Josh Matthews [:jdm]]

Aaaaaaaaaaaaand leak: https://hg.mozilla.org/integration/mozilla-inbound/rev/2def848b4ed3

https://tbpl.mozilla.org/php/getParsedLog.php?id=24336757&tree=Mozilla-Inbound

Comment 7

[Josh Matthews [:jdm]]

https://tbpl.mozilla.org/?tree=Try&rev=d3fe9fabb1f1

Comment 8

[Josh Matthews [:jdm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c50503ce8669

Comment 9

[Phil Ringnalda (:philor)]

Interesting that it didn't leak on Try - did you push the wrong version of it to inbound? Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/3a85eb8af304 for the same leak as before.

Comment 10

[Josh Matthews [:jdm]]

Third time's the charm (I did, in fact, push the wrong version last time): https://hg.mozilla.org/integration/mozilla-inbound/rev/1c1ae670a995

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1c1ae670a995

Comment 12

[Scoobidiver (away)]

There are still crashes after the fix.

Comment 13

[Josh Matthews [:jdm]]

I'm going to clone this and track the failure there.

Comment 14

[Manuela Muntean [Away]]

Verified as fixed, since there are very few (5-6) crashes in this last month regarding 24.0b5, 25.0a2, 26.0a1.

Details here:

https://crash-stats.mozilla.com/report/list?signature=nsXPCWrappedJS%3A%3ACallMethod%28unsigned+short%2C+XPTMethodDescriptor+const*%2C+nsXPTCMiniVariant*%29