Closed Bug 907096 Opened 7 years ago Closed 1 year ago

crash in nsInterfaceRequestorAgg::GetInterface(nsID const&, void**) via mozilla::psm::TransportSecurityInfo::GetInterface

Categories

(Core :: Security: PSM, defect, P3, critical)

17 Branch
defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox48 --- affected
firefox49 --- affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected

People

(Reporter: Usul, Unassigned)

References

Details

(Keywords: crash, Whiteboard: [startupcrash][tbird crash][psm-backlog])

Crash Data

This bug was filed from the Socorro interface and is 
report bp-911bb3d7-d4fe-454c-a278-067f52130819 .
 ============================================================= 

0 	xul.dll 	nsInterfaceRequestorAgg::GetInterface(nsID const &,void * *) 	xpcom/base/nsInterfaceRequestorAgg.cpp
1 	xul.dll 	mozilla::psm::TransportSecurityInfo::GetInterface(nsID const &,void * *) 	security/manager/ssl/src/TransportSecurityInfo.cpp
2 	xul.dll 	nsGetInterface::operator()(nsID const &,void * *) 	objdir-tb/mozilla/xpcom/build/nsIInterfaceRequestorUtils.cpp
3 	xul.dll 	nsCOMPtr_base::assign_from_helper(nsCOMPtr_helper const &,nsID const &) 	objdir-tb/mozilla/xpcom/build/nsCOMPtr.cpp
4 	xul.dll 	PK11PasswordPromptRunnable::RunOnTargetThread() 	security/manager/ssl/src/nsNSSCallbacks.cpp
5 	xul.dll 	mozilla::psm::SyncRunnableBase::Run() 	security/manager/ssl/src/PSMRunnable.cpp
6 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
7 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp
8 	xul.dll 	nsXULWindow::ShowModal() 	xpfe/appshell/src/nsXULWindow.cpp
9 	xul.dll 	nsContentTreeOwner::ShowAsModal() 	xpfe/appshell/src/nsContentTreeOwner.cpp
10 	xul.dll 	nsWindowWatcher::OpenWindowInternal(nsIDOMWindow *,char const *,char const *,char const *,bool,bool,bool,nsIArray *,nsIDOMWindow * *) 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp
11 	xul.dll 	nsWindowWatcher::OpenWindow(nsIDOMWindow *,char const *,char const *,char const *,nsISupports *,nsIDOMWindow * *) 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp
12 	xul.dll 	NS_InvokeByIndex 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
13 	xul.dll 	XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
14 	xul.dll 	XPC_WN_CallMethod(JSContext *,unsigned int,JS::Value *) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
15 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
16 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
17 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
18 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
19 	mozjs.dll 	js_fun_apply(JSContext *,unsigned int,JS::Value *) 	js/src/jsfun.cpp
20 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
21 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
22 	mozjs.dll 	JSObject::addPropertyInternal(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>),int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int,JS::MutableHandle<JS::Value>),unsigned int,unsigned int,unsigned int,int,js::Shape * *,bool) 	js/src/vm/Shape.cpp
23 	mozjs.dll 	JSObject::putProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>),int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int,JS::MutableHandle<JS::Value>),unsigned int,unsigned int,unsigned int,int) 	js/src/vm/Shape.cpp
24 	mozjs.dll 	mozjs.dll@0x1d7630 	
25 		@0xffffff86 	
26 	mozglue.dll 	arena_dalloc 	memory/mozjemalloc/jemalloc.c
27 	xul.dll 	xul.dll@0x10d7bb4 	
28 		@0x2a4294 	
29 	xul.dll 	nsCharTraits<wchar_t>::move(wchar_t *,wchar_t const *,unsigned int) 	objdir-tb/mozilla/dist/include/nsCharTraits.h
30 	xul.dll 	nsCharSinkTraits<wchar_t *>::write(wchar_t * &,wchar_t const *,unsigned int) 	objdir-tb/mozilla/dist/include/nsCharTraits.h
31 	mozglue.dll 	arena_dalloc_small 	memory/mozjemalloc/jemalloc.c
32 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp
33 	xul.dll 	PK11PasswordPromptRunnable::RunOnTargetThread() 	security/manager/ssl/src/nsNSSCallbacks.cpp
34 	winmm.dll 	timeGetTime 	
35 	xul.dll 	mozilla::psm::SyncRunnableBase::Run() 	security/manager/ssl/src/PSMRunnable.cpp
36 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
37 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp
38 	xul.dll 	nsXULWindow::ShowModal() 	xpfe/appshell/src/nsXULWindow.cpp
39 	xul.dll 	nsContentTreeOwner::ShowAsModal() 	xpfe/appshell/src/nsContentTreeOwner.cpp
40 	xul.dll 	nsWindowWatcher::OpenWindowInternal(nsIDOMWindow *,char const *,char const *,char const *,bool,bool,bool,nsIArray *,nsIDOMWindow * *) 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp
41 	xul.dll 	nsWindowWatcher::OpenWindow(nsIDOMWindow *,char const *,char const *,char const *,nsISupports *,nsIDOMWindow * *) 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp
42 	xul.dll 	NS_InvokeByIndex 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
43 	xul.dll 	XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
44 	xul.dll 	XPC_WN_CallMethod(JSContext *,unsigned int,JS::Value *) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
45 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
46 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
47 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
48 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
49 	mozjs.dll 	js_fun_apply(JSContext *,unsigned int,JS::Value *) 	js/src/jsfun.cpp
50 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
51 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
52 	mozjs.dll 	JSObject::addPropertyInternal(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>),int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int,JS::MutableHandle<JS::Value>),unsigned int,unsigned int,unsigned int,int,js::Shape * *,bool) 	js/src/vm/Shape.cpp
53 	mozjs.dll 	JSObject::putProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>),int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int,JS::MutableHandle<JS::Value>),unsigned int,unsigned int,unsigned int,int) 	js/src/vm/Shape.cpp
54 	mozjs.dll 	DefinePropertyOrElement 	js/src/jsobj.cpp
55 		@0x2a5c58

and 
0 	xul.dll 	nsInterfaceRequestorAgg::GetInterface(nsID const &,void * *) 	xpcom/base/nsInterfaceRequestorAgg.cpp
1 	xul.dll 	mozilla::psm::TransportSecurityInfo::GetInterface(nsID const &,void * *) 	security/manager/ssl/src/TransportSecurityInfo.cpp
2 	xul.dll 	nsGetInterface::operator()(nsID const &,void * *) 	objdir-tb/mozilla/xpcom/build/nsIInterfaceRequestorUtils.cpp
3 	xul.dll 	nsCOMPtr_base::assign_from_helper(nsCOMPtr_helper const &,nsID const &) 	objdir-tb/mozilla/xpcom/build/nsCOMPtr.cpp
4 	xul.dll 	PK11PasswordPromptRunnable::RunOnTargetThread() 	security/manager/ssl/src/nsNSSCallbacks.cpp
5 	xul.dll 	mozilla::psm::SyncRunnableBase::Run() 	security/manager/ssl/src/PSMRunnable.cpp
6 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
7 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp
8 	xul.dll 	nsXULWindow::ShowModal() 	xpfe/appshell/src/nsXULWindow.cpp
9 	xul.dll 	nsContentTreeOwner::ShowAsModal() 	xpfe/appshell/src/nsContentTreeOwner.cpp
10 	xul.dll 	nsWindowWatcher::OpenWindowInternal(nsIDOMWindow *,char const *,char const *,char const *,bool,bool,bool,nsIArray *,nsIDOMWindow * *) 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp
11 	xul.dll 	nsWindowWatcher::OpenWindow(nsIDOMWindow *,char const *,char const *,char const *,nsISupports *,nsIDOMWindow * *) 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp
12 	xul.dll 	NS_InvokeByIndex 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
13 	xul.dll 	XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
14 	xul.dll 	XPC_WN_CallMethod(JSContext *,unsigned int,JS::Value *) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
15 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
16 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
17 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
18 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
19 	mozjs.dll 	js_fun_apply(JSContext *,unsigned int,JS::Value *) 	js/src/jsfun.cpp
20 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
21 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
22 	mozjs.dll 	JSObject::addPropertyInternal(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>),int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int,JS::MutableHandle<JS::Value>),unsigned int,unsigned int,unsigned int,int,js::Shape * *,bool) 	js/src/vm/Shape.cpp
23 	mozjs.dll 	JSObject::putProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>),int (*)(JSContext *,JS::Handle<JSObject *>,JS::Handle<int>,int,JS::MutableHandle<JS::Value>),unsigned int,unsigned int,unsigned int,int) 	js/src/vm/Shape.cpp
24 	mozjs.dll 	mozjs.dll@0x1d7630 	
25 		@0xffffff86 	
26 	mozglue.dll 	arena_dalloc 	memory/mozjemalloc/jemalloc.c
27 	xul.dll 	xul.dll@0x10d7bb4 	
28 		@0x1ace94 	
29 	xul.dll 	nsCharTraits<wchar_t>::move(wchar_t *,wchar_t const *,unsigned int) 	objdir-tb/mozilla/dist/include/nsCharTraits.h
30 	xul.dll 	nsCharSinkTraits<wchar_t *>::write(wchar_t * &,wchar_t const *,unsigned int) 	objdir-tb/mozilla/dist/include/nsCharTraits.h
31 	mozglue.dll 	arena_dalloc_small 	memory/mozjemalloc/jemalloc.c
32 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp
33 	xul.dll 	PK11PasswordPromptRunnable::RunOnTargetThread() 	security/manager/ssl/src/nsNSSCallbacks.cpp
34 	winmm.dll 	timeGetTime 	
35 	gkmedias.dll 	doProlog

From the same user.
I had this bug for a while after starting another Thunderbird version, for example when I quit Earlybird and then start Thunderbird beta. I think Thunderbird crashed before prompting for my master password and checking for add-ons compatibility/updates. When starting Thunderbird beta for the second and subsequent times, it would start normally (but not check for add-ons compatibility anymore).

Thunderbird would crash each first start after I switched channels, no matter to which channel I switched (beta, aurora, daily,...). All instances use the same profile.

Today I turned off FIPS and I could switch channels without a crash. After turning FIPS back on I still could switch channels. So FIPS was probably related (otherwise a lot more people would have had the crash) and disabling/re-enabling must have changed something...
Each time seems to be a PK11PasswordPromptRunnable that ends up showing a modal window that triggers another PK11PasswordPromptRunnable, which looks fun.
(not a scientific study) looks like less then half of thunderbird crashes with this signature have this stack
Summary: crash in nsInterfaceRequestorAgg::GetInterface(nsID const&, void**) → crash in nsInterfaceRequestorAgg::GetInterface(nsID const&, void**) via mozilla::psm::TransportSecurityInfo::GetInterface
Whiteboard: [tbird crash]
The crash is back again...
Also present on linux: https://crash-stats.mozilla.com/report/index/133e204c-cb97-46f0-b624-d39212130901
OS: Windows NT → All
Hardware: x86 → All
Another one with TB29 beta on Linux openSUSE 13.1.
bp-4dcde755-9a2b-4faf-acb0-06ec42140427
Today, immediately after restarting after having shut down Aurora, TB Daily crashed three times in a row. After switching to safe-mode and starting normal it worked again...
bp-428b975f-d4cb-4b89-afb0-02bdb2140430
bp-5b96c2c4-20c3-4557-bffd-301e82140430
bp-582068dc-4382-46f7-bdf5-843982140430
I have a Firefox Desktop user experiencing this (or a similar crash) https://support.mozilla.org/en-US/questions/1016319
TB is crashing more than Firefox.
57% of crashes are startup, between both Firefox and Thunderbird.
Estimate 80% of firefox crashes are startup
Whiteboard: [tbird crash] → [startupcrash][tbird crash]
See Also: → 902158
I am suspecting this crash is a side effect of the fix for bug 902158.

Some of comments from crash reports:

 crash at startup after upgrade from 31.2.0 to 31.3.0
MacOS X 10.7.5

 Submitted: 2014-12-08T16:47:06+00:00

 Downgrade to 31.1.0 is working

 Submitted: 2014-12-03T21:16:12+00:00
(In reply to Hiroyuki Ikezoe (:hiro) from comment #10)
> I am suspecting this crash is a side effect of the fix for bug 902158.
> 
> Some of comments from crash reports:
> 
>  crash at startup after upgrade from 31.2.0 to 31.3.0
> MacOS X 10.7.5
> 
>  Submitted: 2014-12-08T16:47:06+00:00
> 
>  Downgrade to 31.1.0 is working

If you are saying the fix for bug 902158 is causing this crash I think you are mistaken. I think we do not see this crash in 31.1.0 because what caused bug 902158 also caused the crashes for this bug to temporarily stop - i.e. bug 902158 caused us to crash earlier. Now that bug 902158 is fixed, the original problem causing this naturally starts happening again. (disclaimer, I beleive this based on the versions and timing of the reports of crashes, not by any understanding of the code - which I haven't examined)
Crash Signature: [@ nsInterfaceRequestorAgg::GetInterface(nsID const&, void**)] → [@ nsInterfaceRequestorAgg::GetInterface(nsID const&, void**)] [@ nsInterfaceRequestorAgg::GetInterface]
Whiteboard: [startupcrash][tbird crash] → [startupcrash][tbird crash][psm-backlog]
Saw this signature while doing Uptime triage. This is #10 with 4 crashes on build 20160801030227. There are 916 crashes reported this year, almost all of them are startup crashes.

A lot of crashes are on poisoned address 0xffffffffe5e5e5e5 or 0xffffffffffffffff so this is use after free crash.
Crash volume for signature 'nsInterfaceRequestorAgg::GetInterface':
 - nightly (version 51): 6 crashes from 2016-08-01.
 - aurora  (version 50): 22 crashes from 2016-08-01.
 - beta    (version 49): 25 crashes from 2016-08-02.
 - release (version 48): 27 crashes from 2016-07-25.
 - esr     (version 45): 9 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       1       0       5
 - aurora        7       7       5
 - beta         17       3       0
 - release       4       6       7
 - esr           0       2       2

Affected platforms: Windows, Linux

Crash rank on the last 7 days:
           Browser     Content   Plugin
 - nightly #876
 - aurora  #341
 - beta    #781
 - release #1659
 - esr

This signature no longer exists for newer versions of Thunderbird and Firefox

Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.