904147 - crash in mozilla::dom::WindowNamedPropertiesHandler::getOwnPropertyDescriptor

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It first showed up in 26.0a1/20130812 and is currently #1 crasher in this build. The regression window is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3d20597e0a07&tochange=87c1796bc46c
It's likely a regression from bug 895758.

Signature 	mozilla::dom::WindowNamedPropertiesHandler::getOwnPropertyDescriptor(JSContext*, JS::Handle<JSObject*>, JS::Handle<int>, JS::MutableHandle<JSPropertyDescriptor>, unsigned int) More Reports Search
UUID 	95633af1-2010-4a3a-aa9b-cb88b2130812
Date Processed	2013-08-12 17:37:04.824391
Uptime	89
Last Crash	7617632 seconds before submission
Install Age 	89 since version was first installed.
Install Time 	2013-08-12 17:35:16
Product 	Firefox
Version 	26.0a1
Build ID 	20130812030209
Release Channel 	nightly
OS 	Windows NT
OS Version 	6.1.7601 Service Pack 1
Build Architecture 	x86
Build Architecture Info 	GenuineIntel family 6 model 42 stepping 7 | 4
Crash Reason 	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address 	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0116, AdapterSubsysID: 3672103c, AdapterDriverVersion: 9.17.10.2867
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::dom::WindowNamedPropertiesHandler::getOwnPropertyDescriptor(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JSPropertyDescriptor>,unsigned int) 	dom/base/WindowNamedPropertiesHandler.cpp
1 	xul.dll 	mozilla::AutoPushJSContext::AutoPushJSContext(JSContext *) 	js/xpconnect/src/nsCxPusher.cpp
2 	mozjs.dll 	js::Proxy::has(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,bool *) 	js/src/jsproxy.cpp
3 	mozjs.dll 	proxy_LookupGeneric 	js/src/jsproxy.cpp
4 	mozjs.dll 	js::ObjectImpl::nativeLookup(js::ExclusiveContext *,int) 	js/src/vm/ObjectImpl.cpp
5 	xul.dll 	xul.dll@0x1ce280 	
6 		@0x5 	
7 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
8 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
9 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
10 	mozjs.dll 	js_fun_call(JSContext *,unsigned int,JS::Value *) 	js/src/jsfun.cpp
11 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
12 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
13 	kernel32.dll 	GetLastError 	

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Adom%3A%3AWindowNamedPropertiesHandler%3A%3AgetOwnPropertyDescriptor%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Cint%3E%2C+JS%3A%3AMutableHandle%3CJSPropertyDescriptor%3E%2C+unsigned+int%29
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Adom%3A%3AWindowNamedPropertiesHandler%3A%3AgetOwnPropertyDescriptor%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3Clong%3E%2C+JS%3A%3AMutableHandle%3CJSPropertyDescriptor%3E%2C+unsigned+int%29
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Adom%3A%3AWindowNamedPropertiesHandler%3A%3AgetOwnPropertyDescriptor%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%2C+JS%3A%3AHandle%3C__int64%3E%2C+JS%3A%3AMutableHandle%3CJSPropertyDescriptor%3E%2C+unsigned+int%29

Comment 1

[Peter Van der Beken [:peterv]]

Some of the stacks don't look very useful, but some of them seem to be happening during shutdown, at which point nsDOMClassInfo::ScriptSecurityManager() could be null.

Comment 2

[Pierre Rudloff]

I confirm it happens every time during shutdown for me.

Comment 3

[Pierre Rudloff]

I confirm it happens every time during shutdown for me.
Here are my reports:
https://crash-stats.mozilla.com/report/index/d43fb380-c682-4c35-a99b-209842130815
https://crash-stats.mozilla.com/report/index/70f1b8dd-27ef-4b02-8055-ad4162130815

Comment 4

[Boris Zbarsky [:bzbarsky]]

At a guess this is always a shutdown crash, the secman is null, and we used to not hit this because we unhooked the GSP when doing SetNewDocument stuff but now we never unhook it...  Peter, thoughts on what we should do when there is no secman here?

Comment 5

[Peter Van der Beken [:peterv]]

I can reproduce this with the YSlow addon.

Comment 6

[Peter Van der Beken [:peterv]]

Attachment: 904147.patch

We shut down nsDOMClassInfo's pointer to the security manager early from nsDOMScriptObjectFactory::Observe for XPCOM shutdown, instead of just letting nsLayoutStatics do it (it already calls nsDOMClassInfo::Shutdown).

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 792283 [details] [diff] [review]
904147.patch

r=me

Comment 8

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/497a75a9a15f

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/497a75a9a15f

Comment 10

[Lukas Blakk [:lsblakk] use ?needinfo]

Tracking so we get confirmation this is truly fixed by the crash data.

Comment 11

[Robert Kaiser]

No crashes after it landed, from all I can see.