Closed Bug 887191 Opened 11 years ago Closed 11 years ago

crash in nsDNSAsyncRequest::OnLookupComplete @ nsXPCWrappedJS::CallMethod

Categories

(Core :: Networking: DNS, defect)

Product:
Core
Component:
Networking: DNS
Version:
24 Branch
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla25
Tracking Flags:
Tracking Status
firefox23 --- unaffected
firefox24 + fixed
firefox25 --- fixed

People

(Reporter: jdm, Assigned: jdm)

References

Details

(Keywords: crash, regression, Whiteboard: [qa-])

Crash Data

Attachments

(1 file)

Force wrapped JS listeners to proxy callbacks to the main thread if no target is specified.
4.71 KB, patch
mcmanus
: review+
bajaj
: approval-mozilla-aurora+
Details | Diff | Splinter Review 
+++ This bug was initially created as a clone of Bug #883495 +++

With the stack trace below, it first showed up in 24.0a1/20130612. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=86413e921d5d&tochange=0414d6d0f60d
It's likely a regression from bug 770840.

Signature 	nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) More Reports Search
UUID	d18042d9-37ed-40e8-94bc-090482130614
Date Processed	2013-06-14 14:10:48
Uptime	24
Last Crash	1.1 hours before submission
Install Age	24 seconds since version was first installed.
Install Time	2013-06-14 14:10:27
Product	Firefox
Version	24.0a1
Build ID	20130614031100
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 15 model 107 stepping 2
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x611205cf
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x689e, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.2.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor01_phx1_mozilla_com_25518:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x689e
Total Virtual Memory	2147352576
Available Virtual Memory	1656975360
System Memory Use Percentage	61
Available Page File	2796986368
Available Physical Memory	836923392

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:571
1 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:85
2 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:112
3 	xul.dll 	nsDNSAsyncRequest::OnLookupComplete 	netwerk/dns/nsDNSService2.cpp:294

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsXPCWrappedJS%3A%3ACallMethod%28unsigned+short%2C+XPTMethodDescriptor+const*%2C+nsXPTCMiniVariant*%29
I've found extensions calling nsDNSService::AsyncResolve with scripted listeners and a null target, meaning that we skip the DNSListenerProxy code.
Assignee: nobody → josh
Comment on attachment 767697 [details] [diff] [review]
Force wrapped JS listeners to proxy callbacks to the main thread if no target is specified.

Review of attachment 767697 [details] [diff] [review]:
-----------------------------------------------------------------

thanks for chasing the edge cases..
Attachment #767697 - Flags: review?(mcmanus) → review+
https://hg.mozilla.org/mozilla-central/rev/53e925dc3bda
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
Comment on attachment 767697 [details] [diff] [review]
Force wrapped JS listeners to proxy callbacks to the main thread if no target is specified.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 770840
User impact if declined: Crashes when using certain extensions
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): No risk. 
String or IDL/UUID changes made by this patch: None.
Attachment #767697 - Flags: approval-mozilla-aurora?
Comment on attachment 767697 [details] [diff] [review]
Force wrapped JS listeners to proxy callbacks to the main thread if no target is specified.

low risk fix for a Fx24 crash regression.Approving on aurora
Attachment #767697 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
tracking-firefox24: --- → ?
There are still several crashes on FF 24 beta. Thoughts ?
(In reply to Paul Silaghi [QA] from comment #9)
> There are still several crashes on FF 24 beta. Thoughts ?

Looking at the current status for this signature Firefox 23.0.1 accounts for 36% of the crashes and all current branches still show this signature. Either we're seeing a different crash with the same signature or this is not completely fixed.

Josh, can you please have a look?
Flags: needinfo?(josh)
Can you link to some of the ones you're talking about? I looked through the top crashers for nightly, aurora, and beta, and didn't see any instances of string "DNS", and none of the ones involving "XPC" looked like they involved DNS code either.
Flags: needinfo?(josh) → needinfo?(anthony.s.hughes)
Those are all different crashes than this one. This signature is a large umbrella.
(In reply to Josh Matthews [:jdm] from comment #13)
> Those are all different crashes than this one. This signature is a large
> umbrella.

Okay thanks. Given that I don't see a reliable way to verify this is fixed. Marking as [qa-].
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: