890682 - crash in zzz_AsmCodeRange_Begin | nsBaseURLParser::ParseURL

Status: RESOLVED WORKSFORME

(SeaMonkey :: General, defect)

Description

[Scoobidiver (away)]

It's #2 crasher in SeaMonkey 2.19 with many duplicates and seems a regression in SM 2.19.

Here are some correlations:
     71% (15/21) vs.  16% (62/397) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
     86% (18/21) vs.  46% (181/397) [e-mail] (DOM Inspector, https://addons.mozilla.org/addon/6622)
    100% (21/21) vs.  87% (344/397) {f13b157f-b174-47e7-a34d-4815ddfdfeb8} (JavaScript Debugger, https://addons.mozilla.org/addon/216)
     95% (20/21) vs.  85% (336/397) {972ce4c6-7e08-4474-a285-3208198ce6fd} (Default, https://addons.mozilla.org/addon/8150)
     10% (2/21) vs.   2% (6/397) [e-mail] (Spanish (Spain) ChatZilla, https://addons.mozilla.org/addon/10226)

Signature 	zzz_AsmCodeRange_Begin | nsBaseURLParser::ParseURL(char const*, int, unsigned int*, int*, unsigned int*, int*, unsigned int*, int*) More Reports Search
UUID 	c1ac9e8f-1766-47fc-904e-99b1a2130707
Date Processed	2013-07-07 06:00:01.696726
Uptime	318
Last Crash	124225 seconds before submission
Install Age 	288637 since version was first installed.
Install Time 	2013-07-03 21:49:16
Product 	SeaMonkey
Version 	2.19
Build ID 	20130625001820
Release Channel 	beta
OS 	Windows NT
OS Version 	6.1.7601 Service Pack 1
Build Architecture 	x86
Build Architecture Info 	GenuineIntel family 6 model 42 stepping 7 | None
Crash Reason 	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address 	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0106, AdapterSubsysID: 167e103c, AdapterDriverVersion: 8.15.10.2509
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 

Frame 	Module 	Signature 	Source
0 	msvcr100.dll 	zzz_AsmCodeRange_Begin 	f:\\dd\\vctools\\crt_bld\\SELF_X86\\crt\\src\\INTEL\\strlen.asm
1 	xul.dll 	nsBaseURLParser::ParseURL(char const *,int,unsigned int *,int *,unsigned int *,int *,unsigned int *,int *) 	netwerk/base/src/nsURLParsers.cpp
2 	xul.dll 	NS_InvokeByIndex 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
3 	xul.dll 	XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
4 	xul.dll 	XPC_WN_CallMethod(JSContext *,unsigned int,JS::Value *) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
5 	mozjs.dll 	js::InvokeKernel(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/jsinterp.cpp
6 	mozjs.dll 	js::Interpret(JSContext *,js::StackFrame *,js::InterpMode) 	js/src/jsinterp.cpp
7 	mozjs.dll 	js::ion::CanEnter(JSContext *,JSScript *,js::AbstractFramePtr,bool) 	js/src/ion/Ion.cpp
8 	mozjs.dll 	js::RunScript(JSContext *,js::StackFrame *) 	js/src/jsinterp.cpp
9 	mozjs.dll 	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::Value *) 	js/src/jsinterp.cpp
10 	mozjs.dll 	JS_CallFunctionValue(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::Value *) 	js/src/jsapi.cpp
11 	xul.dll 	mozilla::dom::EventHandlerNonNull::Call(JSContext *,JSObject *,nsDOMEvent &,mozilla::ErrorResult &) 	objdir/mozilla/dom/bindings/EventHandlerBinding.cpp
12 	xul.dll 	mozilla::dom::EventHandlerNonNull::Call<nsISupports *>(nsISupports * const &,nsDOMEvent &,mozilla::ErrorResult &,mozilla::dom::CallbackObject::ExceptionHandling) 	objdir/mozilla/dist/include/mozilla/dom/EventHandlerBinding.h
13 	xul.dll 	nsJSEventListener::HandleEvent(nsIDOMEvent *) 	dom/src/events/nsJSEventListener.cpp
14 	xul.dll 	nsEventListenerManager::HandleEventSubType(nsListenerStruct *,nsIDOMEventListener *,nsIDOMEvent *,nsIDOMEventTarget *,nsCxPusher *) 	content/events/src/nsEventListenerManager.cpp
15 	xul.dll 	nsEventListenerManager::HandleEventInternal(nsPresContext *,nsEvent *,nsIDOMEvent * *,nsIDOMEventTarget *,nsEventStatus *,nsCxPusher *) 	content/events/src/nsEventListenerManager.cpp
16 	xul.dll 	nsEventListenerManager::HandleEvent(nsPresContext *,nsEvent *,nsIDOMEvent * *,nsIDOMEventTarget *,nsEventStatus *,nsCxPusher *) 	content/events/src/nsEventListenerManager.h
17 	xul.dll 	nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor &,bool,nsCxPusher *) 	content/events/src/nsEventDispatcher.cpp
18 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor &,nsDispatchingCallback *,bool,nsCxPusher *) 	content/events/src/nsEventDispatcher.cpp
19 	xul.dll 	nsEventDispatcher::Dispatch(nsISupports *,nsPresContext *,nsEvent *,nsIDOMEvent *,nsEventStatus *,nsDispatchingCallback *,nsCOMArray<nsIDOMEventTarget> *) 	content/events/src/nsEventDispatcher.cpp
20 	xul.dll 	nsEventDispatcher::DispatchDOMEvent(nsISupports *,nsEvent *,nsIDOMEvent *,nsPresContext *,nsEventStatus *) 	content/events/src/nsEventDispatcher.cpp
21 	xul.dll 	PresShell::HandleDOMEventWithTarget(nsIContent *,nsIDOMEvent *,nsEventStatus *) 	layout/base/nsPresShell.cpp
22 	xul.dll 	nsContentUtils::DispatchXULCommand(nsIContent *,bool,nsIDOMEvent *,nsIPresShell *,bool,bool,bool,bool) 	content/base/src/nsContentUtils.cpp
23 	xul.dll 	nsButtonBoxFrame::DoMouseClick(nsGUIEvent *,bool) 	layout/xul/base/src/nsButtonBoxFrame.cpp
24 	xul.dll 	nsScrollbarButtonFrame::MouseClicked(nsPresContext *,nsGUIEvent *) 	layout/xul/base/src/nsButtonBoxFrame.h
25 	xul.dll 	nsButtonBoxFrame::HandleEvent(nsPresContext *,nsGUIEvent *,nsEventStatus *) 	layout/xul/base/src/nsButtonBoxFrame.cpp
26 	xul.dll 	nsPresShellEventCB::HandleEvent(nsEventChainPostVisitor &) 	layout/base/nsPresShell.cpp
27 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor &,nsDispatchingCallback *,bool,nsCxPusher *) 	content/events/src/nsEventDispatcher.cpp
28 	xul.dll 	nsEventDispatcher::Dispatch(nsISupports *,nsPresContext *,nsEvent *,nsIDOMEvent *,nsEventStatus *,nsDispatchingCallback *,nsCOMArray<nsIDOMEventTarget> *) 	content/events/src/nsEventDispatcher.cpp
29 	xul.dll 	PresShell::HandleEventInternal(nsEvent *,nsEventStatus *) 	layout/base/nsPresShell.cpp
30 	xul.dll 	PresShell::HandleEventWithTarget(nsEvent *,nsIFrame *,nsIContent *,nsEventStatus *) 	layout/base/nsPresShell.cpp
31 	xul.dll 	nsEventStateManager::CheckForAndDispatchClick(nsPresContext *,nsMouseEvent *,nsEventStatus *) 	content/events/src/nsEventStateManager.cpp
32 	xul.dll 	nsEventStateManager::PostHandleEvent(nsPresContext *,nsEvent *,nsIFrame *,nsEventStatus *) 	content/events/src/nsEventStateManager.cpp
33 	xul.dll 	PresShell::HandleEventInternal(nsEvent *,nsEventStatus *) 	layout/base/nsPresShell.cpp
34 	xul.dll 	PresShell::HandlePositionedEvent(nsIFrame *,nsGUIEvent *,nsEventStatus *) 	layout/base/nsPresShell.cpp
35 	xul.dll 	PresShell::HandleEvent(nsIFrame *,nsGUIEvent *,bool,nsEventStatus *) 	layout/base/nsPresShell.cpp
36 	xul.dll 	nsViewManager::DispatchEvent(nsGUIEvent *,nsView *,nsEventStatus *) 	view/src/nsViewManager.cpp
37 	xul.dll 	nsView::HandleEvent(nsGUIEvent *,bool) 	view/src/nsView.cpp
38 	xul.dll 	nsWindow::DispatchWindowEvent(nsGUIEvent *) 	widget/windows/nsWindow.cpp
39 	xul.dll 	XPCVariant::InitializeData(JSContext *) 	js/xpconnect/src/XPCVariant.cpp
40 	nspr4.dll 	_PR_FileTimeToPRTime 	nsprpub/pr/src/md/windows/w95io.c
41 	nspr4.dll 	PR_Now 	nsprpub/pr/src/md/windows/ntmisc.c
42 	xul.dll 	nsCxPusher::Pop() 	content/base/src/nsContentUtils.cpp
43 	xul.dll 	nsCxPusher::~nsCxPusher() 	content/base/src/nsContentUtils.cpp
44 	xul.dll 	nsJSContext::CallEventHandler(nsISupports *,JSObject *,JSObject *,nsIArray *,nsIVariant * *) 	dom/base/nsJSEnvironment.cpp
45 	xul.dll 	nsTArray_Impl<mozilla::widget::WindowHook::MessageData,nsTArrayInfallibleAllocator>::DestructRange(unsigned int,unsigned int) 	objdir/mozilla/dist/include/nsTArray.h
46 	xul.dll 	nsTArray_Impl<mozilla::widget::WindowHook::MessageData,nsTArrayInfallibleAllocator>::DestructRange(unsigned int,unsigned int) 	objdir/mozilla/dist/include/nsTArray.h
47 	xul.dll 	nsTArray_Impl<mozilla::widget::WindowHook::MessageData,nsTArrayInfallibleAllocator>::DestructRange(unsigned int,unsigned int) 	objdir/mozilla/dist/include/nsTArray.h
48 	xul.dll 	nsTArray_Impl<mozilla::widget::WindowHook::MessageData,nsTArrayInfallibleAllocator>::DestructRange(unsigned int,unsigned int) 	objdir/mozilla/dist/include/nsTArray.h
49 	user32.dll 	UserCallWinProcCheckWow 	
50 	nspr4.dll 	nspr4.dll@0xcf60

More reports at:
https://crash-stats.mozilla.com/report/list?product=SeaMonkey&signature=zzz_AsmCodeRange_Begin+|+nsBaseURLParser%3A%3AParseURL%28char+const*%2C+int%2C+unsigned+int*%2C+int*%2C+unsigned+int*%2C+int*%2C+unsigned+int*%2C+int*%29

Comment 1

[[e-mail]]

Note that evaluating Components.classes['@mozilla.org/network/url-parser;1?auth=maybe'].getService(Components.interfaces.nsIURLParser).parseURL(null, -1, {}, {}, {}, {}, {}, {}); will cause an immediate crash (or an assertion and crash in debug builds). Without a JS stack I don't know whether the bogus null value is coming from though.

Comment 2

[[e-mail]]

Ah, and the comment for that crash says "In data manager tried to forget cookies and storage together of a domain." And there's a call to parseURL in data manager in getDomainFromHost. So maybe the null is getting in there somehow.

Comment 3

[Edmund Wong (:ewong)]

It's also happening in the 2.20 release.  Just got a crash from doing precisely the same thing.  Forget cookies, et. al from a domain.

Comment 4

[Robert Kaiser]

(In reply to [e-mail] from comment #1)
> Note that evaluating
> Components.classes['@mozilla.org/network/url-parser;1?auth=maybe'].
> getService(Components.interfaces.nsIURLParser).parseURL(null, -1, {}, {},
> {}, {}, {}, {}); will cause an immediate crash (or an assertion and crash in
> debug builds).

That sounds like a bug in the url parser to me in any case.

That said, do we know we are passing null to it? Should be easy to just do a null check in http://mxr.mozilla.org/comm-central/source/suite/common/dataman/dataman.js#470 if needed, but I somewhat wonder why we are getting there at all.

Comment 5

[Wayne Mery (:wsmwk)]

WFM?

For crashes containing nsBaseURLParser::ParseURL for the past 3 months, for currentish versions, I found two of version 2.30 for nsBaseURLParser::ParseURL(char const*, int, unsigned int*, int*, unsigned int*, int*, unsigned int*, int*) but the stacks are nothing like comment 0, eg bp-0e0270cc-f3df-4824-ab91-8a6c02141209

bp-871b85be-ff21-4f61-b187-c08c92141102 2.30
bp-abe8c8b7-63b5-4da2-ab2b-52f152141024 2.30
both stacks like
 0 	xul.dll	nsBaseURLParser::ParseURL(char const*, int, unsigned int*, int*, unsigned int*, int*, unsigned int*, int*)	netwerk/base/src/nsURLParsers.cpp
1 	xul.dll	NS_InvokeByIndex	xpcom/reflect/xptcall/md/win32/xptcinvoke.cpp
2 	xul.dll	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)	js/xpconnect/src/XPCWrappedNative.cpp
3 	xul.dll	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
4 	mozjs.dll	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)	js/src/vm/Interpreter.cpp
5 	mozjs.dll	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>)	js/src/vm/Interpreter.cpp
6 	mozjs.dll	js::jit::DoCallFallback	js/src/jit/BaselineIC.cpp

Comment 6

[Tony Mechelynck [:tonymec]]

I use 2.35a1, and I get some crashes, but this particular one does not ring a bell. The current "release" version is 2.32. Anything earlier won't get any new fixes, not even for crashing bugs. If I didn't answer your NEEDINFO, please formulate it in more detail.

Comment 7

[Wayne Mery (:wsmwk)]

Thanks. Let's call it WFM.