crash in nsDNSAsyncRequest::OnLookupComplete @ nsXPCWrappedJS::CallMethod

RESOLVED FIXED in Firefox 24

Status

()

Core
Networking: DNS
--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: jdm, Assigned: jdm)

Tracking

({crash, regression})

24 Branch
mozilla25
x86
Windows 7
crash, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox23 unaffected, firefox24+ fixed, firefox25 fixed)

Details

(Whiteboard: [qa-], crash signature)

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
+++ This bug was initially created as a clone of Bug #883495 +++

With the stack trace below, it first showed up in 24.0a1/20130612. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=86413e921d5d&tochange=0414d6d0f60d
It's likely a regression from bug 770840.

Signature 	nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) More Reports Search
UUID	d18042d9-37ed-40e8-94bc-090482130614
Date Processed	2013-06-14 14:10:48
Uptime	24
Last Crash	1.1 hours before submission
Install Age	24 seconds since version was first installed.
Install Time	2013-06-14 14:10:27
Product	Firefox
Version	24.0a1
Build ID	20130614031100
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 15 model 107 stepping 2
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x611205cf
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x689e, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.2.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor01_phx1_mozilla_com_25518:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x689e
Total Virtual Memory	2147352576
Available Virtual Memory	1656975360
System Memory Use Percentage	61
Available Page File	2796986368
Available Physical Memory	836923392

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:571
1 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:85
2 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:112
3 	xul.dll 	nsDNSAsyncRequest::OnLookupComplete 	netwerk/dns/nsDNSService2.cpp:294

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsXPCWrappedJS%3A%3ACallMethod%28unsigned+short%2C+XPTMethodDescriptor+const*%2C+nsXPTCMiniVariant*%29
(Assignee)

Comment 1

5 years ago
I've found extensions calling nsDNSService::AsyncResolve with scripted listeners and a null target, meaning that we skip the DNSListenerProxy code.
(Assignee)

Comment 2

5 years ago
Created attachment 767697 [details] [diff] [review]
Force wrapped JS listeners to proxy callbacks to the main thread if no target is specified.
Attachment #767697 - Flags: review?(mcmanus)
(Assignee)

Updated

5 years ago
Assignee: nobody → josh
Comment on attachment 767697 [details] [diff] [review]
Force wrapped JS listeners to proxy callbacks to the main thread if no target is specified.

Review of attachment 767697 [details] [diff] [review]:
-----------------------------------------------------------------

thanks for chasing the edge cases..
Attachment #767697 - Flags: review?(mcmanus) → review+
https://hg.mozilla.org/mozilla-central/rev/53e925dc3bda
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25

Updated

5 years ago
status-firefox25: affected → fixed
(Assignee)

Comment 6

5 years ago
Comment on attachment 767697 [details] [diff] [review]
Force wrapped JS listeners to proxy callbacks to the main thread if no target is specified.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 770840
User impact if declined: Crashes when using certain extensions
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): No risk. 
String or IDL/UUID changes made by this patch: None.
Attachment #767697 - Flags: approval-mozilla-aurora?
Comment on attachment 767697 [details] [diff] [review]
Force wrapped JS listeners to proxy callbacks to the main thread if no target is specified.

low risk fix for a Fx24 crash regression.Approving on aurora
Attachment #767697 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
(Assignee)

Updated

5 years ago
tracking-firefox24: --- → ?

Updated

5 years ago
tracking-firefox24: ? → +
There are still several crashes on FF 24 beta. Thoughts ?
(In reply to Paul Silaghi [QA] from comment #9)
> There are still several crashes on FF 24 beta. Thoughts ?

Looking at the current status for this signature Firefox 23.0.1 accounts for 36% of the crashes and all current branches still show this signature. Either we're seeing a different crash with the same signature or this is not completely fixed.

Josh, can you please have a look?
Flags: needinfo?(josh)
(Assignee)

Comment 11

4 years ago
Can you link to some of the ones you're talking about? I looked through the top crashers for nightly, aurora, and beta, and didn't see any instances of string "DNS", and none of the ones involving "XPC" looked like they involved DNS code either.
Flags: needinfo?(josh) → needinfo?(anthony.s.hughes)
(Assignee)

Comment 13

4 years ago
Those are all different crashes than this one. This signature is a large umbrella.
(In reply to Josh Matthews [:jdm] from comment #13)
> Those are all different crashes than this one. This signature is a large
> umbrella.

Okay thanks. Given that I don't see a reliable way to verify this is fixed. Marking as [qa-].
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.