189779 - crashes quitting [@ nsDiskCacheOutputStream::~nsDiskCacheOutputStream]

Status: VERIFIED FIXED

(Core :: Networking: Cache, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Crashes at nsDiskCacheOutputStream::~nsDiskCacheOutputStream have started
showing up in talkback starting on 2003-01-18.  I suspect this is related to
darin's landing.

User comments seem to show the crashes are occuring on quit, at least in some
cases.  Here's some summary info, although it only includes half the crashes
that are mentioned in the -detailed report.

nsDiskCacheOutputStream::~nsDiskCacheOutputStream   5 
BBID range: 16338868 - 16346156
Min/Max Seconds since last crash: 47 - 9572
Min/Max Runtime: 47 - 18641
Crash data range: 2003-01-18 to 2003-01-18
Build ID range: 2003011808 to 2003011808
Keyword List : 
Stack Trace: 

	 nsDiskCacheOutputStream::~nsDiskCacheOutputStream
[c:/builds/seamonkey/mozilla/netwerk/cache/src/nsDiskCacheStreams.cpp  line 217]
	 nsDiskCacheOutputStream::`scalar deleting destructor'
	 nsSOCKSSocketInfo::Release
[c:/builds/seamonkey/mozilla/netwerk/socket/base/nsSOCKSIOLayer.cpp  line 93]
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 65]
	 nsCacheEntryDescriptor::nsOutputStreamWrapper::`scalar deleting destructor'
	 nsCacheEntryDescriptor::nsOutputStreamWrapper::Release
[c:/builds/seamonkey/mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp  line 561]
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 65]
	 nsWyciwygChannel::~nsWyciwygChannel
[c:/builds/seamonkey/mozilla/content/html/document/src/nsWyciwygChannel.cpp 
line 56]
	 nsWyciwygChannel::Release
[c:/builds/seamonkey/mozilla/content/html/document/src/nsWyciwygChannel.cpp 
line 56]
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 65]
	 nsHTMLDocument::~nsHTMLDocument
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLDocument.cpp  line 364]
	 nsDocument::Release
[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp  line 669]
	 SubDocClearEntry	[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp
 line 1232]
	 PL_DHashTableFinish	[c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c  line 324]
	 PL_DHashTableDestroy	[c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c  line 165]
	 nsXULDocument::~nsXULDocument
[c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp  line 462]
	 nsXULDocument::`scalar deleting destructor'
	 nsXULDocument::Release
[c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp  line 558]
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 65]
	 nsEventStateManager::~nsEventStateManager
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp  line 265]
	 nsEventStateManager::`scalar deleting destructor'
	 nsEventStateManager::Release
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp  line 300]
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 65]
	 nsPresContext::~nsPresContext
[c:/builds/seamonkey/mozilla/layout/base/src/nsPresContext.cpp  line 127]
	 GalleyContext::`scalar deleting destructor'
	 nsPresContext::Release
[c:/builds/seamonkey/mozilla/layout/base/src/nsPresContext.cpp  line 245]
	 nsDOMEvent::~nsDOMEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsDOMEvent.cpp  line 266]
	 nsDOMEvent::`scalar deleting destructor'
	 nsDOMEvent::Release
[c:/builds/seamonkey/mozilla/content/events/src/nsDOMEvent.cpp  line 284]
	 XPCJSRuntime::GCCallback
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcjsruntime.cpp  line 539]
	 js_GC	[c:/builds/seamonkey/mozilla/js/src/jsgc.c  line 1408]
	 js_ForceGC	[c:/builds/seamonkey/mozilla/js/src/jsgc.c  line 994]
	 nsCOMPtr_base::assign_from_helper
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 78]
	 nsDOMSOFactory::Observe
[c:/builds/seamonkey/mozilla/dom/src/build/nsDOMFactory.cpp  line 230]
	 nsObserverService::NotifyObservers
[c:/builds/seamonkey/mozilla/xpcom/ds/nsObserverService.cpp  line 212]
	 NS_ShutdownXPCOM	[c:/builds/seamonkey/mozilla/xpcom/build/nsXPComInit.cpp 
line 691]
	 GRE_Shutdown
[c:/builds/seamonkey/mozilla/xpcom/glue/standalone/nsXPCOMGlue.cpp  line 254]
	 main	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1941]
	 WinMain	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1951]
	 WinMainCRTStartup()
	 kernel32.dll + 0x214c7 (0x77e814c7)
 
 	Source File :
c:/builds/seamonkey/mozilla/netwerk/cache/src/nsDiskCacheStreams.cpp line : 217
     (16346156)	Comments: Shuting browser down
     (16342741)	Comments: quit mail via "X" button

Comment 1

[Jay Patel [:jay]]

Adding regression and zt4newcrash keywords.  This is a new crash introduced in
the past 72 hours...and either needs to be fixed or the checkin that caused it
should be backed out.

Comment 2

[Jo Hermans]

*** Bug 189874 has been marked as a duplicate of this bug. ***

Comment 3

[Darin Fisher]

Attachment: v1 patch

dumb mistake on my part when i was making changes to the cache.  i did not
completely convert from nsCOMPtr<nsDiskCacheStreamIO> to nsDiskCacheStreamIO*
:-(

Comment 4

[Kai Engert [:KaiE:]]

Comment on attachment 112203 [details] [diff] [review]
v1 patch

This patch works very well for me, I can't make it crash with this fix applied.

r=kaie

Comment 5

[Darin Fisher]

for reference, kai sent me a 100% reproducible testcase.  this caused profile
switching to crash and burn if initiated while a page was still loading. 
requires the latest patch in bug 97622 to repro.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 112203 [details] [diff] [review]
v1 patch

+    NS_ASSERTION(mStreamIO == nsnull, "leak");

Maybe !mStreamIO instead of the comparison to nsnull?

Comment 7

[Darin Fisher]

patch checked in yesterday; marking FIXED.

Comment 8

[Darin Fisher]

*** Bug 190028 has been marked as a duplicate of this bug. ***

Comment 9

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Marking verified based on lack of talkback reports with this signature for 3 days.

Comment 10

[Torben]

*** Bug 190142 has been marked as a duplicate of this bug. ***