31695 - Crash exiting after trigger with callback function

Status: VERIFIED WORKSFORME

(Core Graveyard :: Installer: XPInstall Engine, defect, P3)

Description

[John G. Myers]

Debug build, pulled early afternoon Mar 13.  Running on a 2-processor NT box.

Attempted to install PSM, using the above URL.  During the installation process, 
got hundreds of "not thread-safe:" assertions during and immediately after the 
install.

Eventually, the assertions stopped.  Upon closing both browser windows, Mozilla 
crashed:

js_RemoveRoot(JSRuntime * 0xdddddddd, void * 0x038b72a4) line 178 + 3 bytes
JS_RemoveRoot(JSContext * 0x03397470, void * 0x038b72a4) line 1086 + 16 bytes
nsXPITriggerInfo::~nsXPITriggerInfo() line 102 + 20 bytes
nsXPITriggerInfo::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXPInstallManager::~nsXPInstallManager() line 98 + 31 bytes
nsXPInstallManager::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXPInstallManager::Release(nsXPInstallManager * const 0x038b10c0) line 103 + 
129 bytes
nsXPCWrappedNative::~nsXPCWrappedNative() line 390 + 27 bytes
nsXPCWrappedNative::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXPCWrappedNative::Release(nsXPCWrappedNative * const 0x039c1b30) line 71 + 31 
bytes
nsXPCWrappedNative::JSObjectFinalized(JSContext * 0x02f5fd40, JSObject * 
0x02dd9a48) line 96
WrappedNative_Finalize(JSContext * 0x02f5fd40, JSObject * 0x02dd9a48) line 679
js_FinalizeObject(JSContext * 0x02f5fd40, JSObject * 0x02dd9a48) line 1470 + 114 
bytes
js_GC(JSContext * 0x02f5fd40) line 898 + 11 bytes
js_ForceGC(JSContext * 0x02f5fd40) line 678 + 9 bytes
js_DestroyContext(JSContext * 0x02f5fd40, int 2) line 183 + 9 bytes
JS_DestroyContext(JSContext * 0x02f5fd40) line 794 + 11 bytes
nsJSContext::~nsJSContext() line 185 + 13 bytes
nsJSContext::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsJSContext::Release(nsJSContext * const 0x02f5c2d0) line 194 + 154 bytes
nsCOMPtr<nsIScriptContext>::assign_assuming_AddRef(nsIScriptContext * 
0x00000000) line 417
nsCOMPtr<nsIScriptContext>::assign_with_AddRef(nsISupports * 0x00000000) line 
788
nsCOMPtr<nsIScriptContext>::operator=(nsIScriptContext * 0x00000000) line 527
nsWebShell::~nsWebShell() line 607
nsWebShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsDocShell::Release(nsDocShell * const 0x02f61c40) line 127 + 129 bytes
nsWebShell::Release(nsWebShell * const 0x02f61c40) line 680 + 12 bytes
nsCOMPtr<nsIBaseWindow>::~nsCOMPtr<nsIBaseWindow>() line 435
nsWebShellWindow::~nsWebShellWindow() line 246
nsWebShellWindow::`scalar deleting destructor'() + 15 bytes
nsWebShellWindow::Release(nsWebShellWindow * const 0x02f63870) line 256 + 158 
bytes
nsCOMPtr<nsIXULWindow>::assign_assuming_AddRef(nsIXULWindow * 0x00000000) line 
417
nsCOMPtr<nsIXULWindow>::assign_with_AddRef(nsISupports * 0x00000000) line 788
nsCOMPtr<nsIXULWindow>::operator=(nsIXULWindow * 0x00000000) line 527
nsAppShellService::~nsAppShellService() line 100
nsAppShellService::`scalar deleting destructor'() + 15 bytes
nsAppShellService::Release(nsAppShellService * const 0x00ce36d0) line 113 + 133 
bytes
DeleteEntry(nsHashKey * 0x00ce38b0, void * 0x00ce3690, void * 0x00000000) line 
210 + 18 bytes
_hashEnumerateRemove(PLHashEntry * 0x00ce3870, int 57, void * 0x0012fdc8) line 
227 + 26 bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x00ca46e0, int (PLHashEntry *, int, 
void *)* 0x10014160 _hashEnumerateRemove(PLHashEntry *, int, void *), void * 
0x0012fdc8) line 368 + 15 bytes
nsHashtable::Reset(int (nsHashKey *, void *, void *)* 0x1004e740 
DeleteEntry(nsHashKey *, void *, void *), void * 0x00000000) line 243 + 20 bytes
nsObjectHashtable::Reset() line 347
nsObjectHashtable::~nsObjectHashtable() line 313
nsObjectHashtable::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsServiceManagerImpl::~nsServiceManagerImpl() line 235 + 31 bytes
nsServiceManagerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsServiceManagerImpl::Release(nsServiceManagerImpl * const 0x00ca4780) line 244 
+ 152 bytes
nsServiceManager::ShutdownGlobalServiceManager(nsIServiceManager * * 0x00000000) 
line 484 + 17 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 585 + 7 bytes
main(int 1, char * * 0x00ca4bb0) line 913 + 8 bytes
mainCRTStartup() line 338 + 17 bytes

Comment 1

[Cathleen]

can you look for a file called "install.log" in your build's /bin directory, and 
provide it's content to us?

Comment 2

[John G. Myers]

Attachment: install.log

Comment 3

[Sean Su]

FYI: the Psm from the given url will probably not work with the tip builds.  It 
was only built for M14 (as I am aware of it).  It probably won't even work with 
the Beta1 builds.

Adding Javi and mwelch to the CC: list in case they can provide more info.

Comment 4

[Cathleen]

looks like install completed successfully (from the install log).

I'm thinking the same thing with Sean.  It's probably the psm bits themselves 
don't work with tip builds...

Mark?

Comment 5

[John G. Myers]

If you look at the stack trace, XPInstall tried to dereference bogus (probably 
freed) memory during destruction.

How can the installed bits cause the installer to screw up its destruction?

Comment 6

[Daniel Veditz [:dveditz]]

This has nothing to do with the PSM. There are two separate known problems 
described here.

1) warren added thread-safety assertions to ISupports. Since XPInstall spins up 
its own thread we trip all these assertions. Some are valid, many are "false 
positives". See porkjockey/xpcom discussions. Bottom line, don't use XPInstall 
on a debug build unless you like pain. Don't even *think* of running it in the 
debugger.

2) occasional crash freeing JS GC roots. IF a) the triggering page has a 
trigger-callback function and b) you exit from the triggering page without 
loading a new page you will usually crash during exit. This is on my list of 
things to fix but I hadn't written a bug yet; this one will do.  The problem is 
shutdown order.

Comment 7

[Cathleen]

call back support is needed by website folks
need to be fixed by PR2

Comment 8

[leger]

Putting on [nsbeta2+][6/01] radar.  This work must be done by 06/01 or we may 
pull this for PR2.

Comment 9

[leger]

Changing from [6/01] to [6/15]

Comment 10

[Andreas Franke (gone)]

*** Bug 40775 has been marked as a duplicate of this bug. ***

Comment 11

[Jim Roskind]

Cleaning up status whiteboard by marking beta2 minus (6/15 has passed)

Based on dveditz comment above, the issue is a correction of shutdown order... 
but folks are too doomed to get to this for beta2

Comment 12

[leger]

Adding nsbeta3 keyword.

Comment 13

[Daniel Veditz [:dveditz]]

nsbeta3- per PDT triage. There is a workaround (switch pages before exiting), 
the user is trying to quit anyway, and the underlying cause is a tricky 
shutdown order dependency.

Comment 14

[Daniel Veditz [:dveditz]]

Resetting target field for missed milestones

Comment 15

[Daniel Veditz [:dveditz]]

Moz 0.9 tasks

Comment 16

[Daniel Veditz [:dveditz]]

I can't reproduce this (though in part I'm blocked by bug 71504 a lot of the 
time) -- has this shutdown ordering problem gotten fixed on its own?

Comment 17

[Daniel Veditz [:dveditz]]

I can't reproduce this any more

Comment 18

[Jimmy Lee]

Build: 2001-04-17-09-trunk(WIN)

I cannot reproduce either.  Marking Verified.