34411 - CRASH in NS_ShutdownXPCOM

Status: VERIFIED WORKSFORME

(Core :: XPCOM, defect, P3)

Description

[Bernd Mielke]

I used this approach to produce for hyatt the assert in bug 34130. With the
fixes from this bug, the assert vanished, but the crash at the end is still
there. The crash is different from 34130 so I file it as new one.
I recompiled at 04.04.2000 0:00 PDT.


Actions to reproduce:
1. close dialup connection
2. run mozilla
3. select a profile
4. Cancel the dialup
5. Close the alert boxes showing up
6. Hit the windows close mark.

Does not work all the times (50%) sometimes keyboard only is succesful,
sometimes mouse navigation is better. If it is not succful (does not crash),
there is a warning about 7 webshells leaked.

from the log:

Opening file cookperm.txt failed
in SetSecurityButton
WEBSHELL+ = 4
failed to set the page title.
Error loading URL http://www.mozilla.org/quality/checkin-guidelines.html
Document: Done (3.41 secs)
WEBSHELL+ = 5
WEBSHELL+ = 6
WEBSHELL+ = 7
commonDialogOnLoad
Move window by 422,149.6
screen x 1screen y 0
WEBSHELL- = 6
WEBSHELL+ = 7
WEBSHELL+ = 8
WEBSHELL+ = 9
commonDialogOnLoad
Move window by 414.5,149.6
screen x 1screen y 0
WEBSHELL- = 8
WEBSHELL- = 7
Shut down app shell component {18c2f989-b09f-11d2-bcde-00805f0e1353}, rv=0x00000000
Shut down app shell component {4a85a5d0-cddd-11d2-b7f6-00805f05ffa5}, rv=0x00000000
~nsProfile

the stack trace:

gc_root_marker(JSHashEntry * 0x043573b0, int 11, void * 0x00bb664c) line 647 + 3
bytes
JS_HashTableEnumerateEntries(JSHashTable * 0x0148b1e0, int (JSHashEntry *, int,
void *)* 0x0050f746 gc_root_marker(JSHashEntry *, int, void *), void *
0x00bb664c) line 363 + 15 bytes
js_GC(JSContext * 0x04238640) line 787 + 21 bytes
js_ForceGC(JSContext * 0x04238640) line 678 + 9 bytes
js_DestroyContext(JSContext * 0x04238640, int 2) line 183 + 9 bytes
JS_DestroyContext(JSContext * 0x04238640) line 794 + 11 bytes
nsJSContext::~nsJSContext() line 186 + 13 bytes
nsJSContext::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsJSContext::Release(nsJSContext * const 0x04238ae0) line 195 + 154 bytes
nsCOMPtr<nsIScriptContext>::assign_assuming_AddRef(nsIScriptContext *
0x00000000) line 447
nsCOMPtr<nsIScriptContext>::assign_with_AddRef(nsISupports * 0x00000000) line 818
nsCOMPtr<nsIScriptContext>::operator=(nsIScriptContext * 0x00000000) line 557
nsXULPDGlobalObject::SetContext(nsXULPDGlobalObject * const 0x04238864,
nsIScriptContext * 0x00000000) line 485
nsXULPrototypeDocument::~nsXULPrototypeDocument() line 179
nsXULPrototypeDocument::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXULPrototypeDocument::Release(nsXULPrototypeDocument * const 0x0409afc0) line
185 + 154 bytes
_ReleaseElement(nsHashKey * 0x04232b20, void * 0x0409afc0, void * 0x00000000)
line 368 + 18 bytes
_hashEnumerate(PLHashEntry * 0x04232620, int 1, void * 0x0095f844) line 89 + 26
bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x02aa7530, int (PLHashEntry *, int,
void *)* 0x100144c0 _hashEnumerate(PLHashEntry *, int, void *), void *
0x0095f844) line 368 + 15 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x10014a00
_ReleaseElement(nsHashKey *, void *, void *), void * 0x00000000) line 218 + 20 bytes
nsSupportsHashtable::~nsSupportsHashtable() line 375
nsXULPrototypeCache::~nsXULPrototypeCache() line 102 + 24 bytes
nsXULPrototypeCache::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXULPrototypeCache::Release(nsXULPrototypeCache * const 0x02aa7e00) line 105 +
151 bytes
nsServiceManagerImpl::ReleaseService(nsServiceManagerImpl * const 0x00c93080,
const nsID & {...}, nsISupports * 0x02aa7e00, nsIShutdownListener * 0x00000000)
line 343 + 12 bytes
nsServiceManager::ReleaseService(const nsID & {...}, nsISupports * 0x02aa7e00,
nsIShutdownListener * 0x00000000) line 509 + 29 bytes
nsXULDocument::~nsXULDocument() line 519 + 20 bytes
nsXULDocument::`scalar deleting destructor'() + 15 bytes
nsXULDocument::Release(nsXULDocument * const 0x0303f520) line 621 + 158 bytes
nsEventStateManager::~nsEventStateManager() line 159 + 36 bytes
nsEventStateManager::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsEventStateManager::Release(nsEventStateManager * const 0x035ea3b0) line 231 +
154 bytes
nsSupportsArray::Clear(nsSupportsArray * const 0x035f7030) line 319 + 36 bytes
nsSupportsArray::DeleteArray() line 64
nsSupportsArray::~nsSupportsArray() line 41
nsSupportsArray::`vector deleting destructor'(unsigned int 1) + 81 bytes
nsSupportsArray::Release(nsSupportsArray * const 0x035f7030) line 59 + 127 bytes
nsObserverList::~nsObserverList() line 186 + 27 bytes
nsObserverList::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsObserverList::Release(nsObserverList * const 0x035ea2f0) line 157 + 152 bytes
ReleaseObserverList(nsHashKey * 0x035f5030, void * 0x035ea2f0, void *
0x00000000) line 98 + 12 bytes
_hashEnumerateRemove(PLHashEntry * 0x035f5f30, int 4, void * 0x0095fb50) line
227 + 26 bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x02a9e2d0, int (PLHashEntry *, int,
void *)* 0x10014560 _hashEnumerateRemove(PLHashEntry *, int, void *), void *
0x0095fb50) line 368 + 15 bytes
nsHashtable::Reset(int (nsHashKey *, void *, void *)* 0x10021e60
ReleaseObserverList(nsHashKey *, void *, void *), void * 0x00000000) line 243 +
20 bytes
nsObjectHashtable::Reset() line 347
nsObjectHashtable::~nsObjectHashtable() line 313
nsObjectHashtable::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsObserverService::~nsObserverService() line 63 + 31 bytes
nsObserverService::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsObserverService::Release(nsObserverService * const 0x02a9e430) line 46 + 127 bytes
DeleteEntry(nsHashKey * 0x02a9e3b0, void * 0x02a9e3f0, void * 0x00000000) line
210 + 18 bytes
_hashEnumerateRemove(PLHashEntry * 0x02a9e370, int 29, void * 0x0095fc44) line
227 + 26 bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x00c94cf0, int (PLHashEntry *, int,
void *)* 0x10014560 _hashEnumerateRemove(PLHashEntry *, int, void *), void *
0x0095fc44) line 368 + 15 bytes
nsHashtable::Reset(int (nsHashKey *, void *, void *)* 0x1004f970
DeleteEntry(nsHashKey *, void *, void *), void * 0x00000000) line 243 + 20 bytes
nsObjectHashtable::Reset() line 347
nsObjectHashtable::~nsObjectHashtable() line 313
nsObjectHashtable::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsServiceManagerImpl::~nsServiceManagerImpl() line 235 + 31 bytes
nsServiceManagerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsServiceManagerImpl::Release(nsServiceManagerImpl * const 0x00c93080) line 244
+ 152 bytes
nsServiceManager::ShutdownGlobalServiceManager(nsIServiceManager * * 0x00000000)
line 484 + 17 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 598 + 7 bytes
main(int 1, char * * 0x00c931d0) line 906 + 8 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! bff8b560()
KERNEL32! bff8b412()
KERNEL32! bff89dd5()

Comment 1

[Suresh Duddi (gone)]

Jband did't you fix one of these.

Comment 2

[John Bandhauer]

I tried to reproduce and saw a crash with a completely different stack (in 
nsDNSService). I filed http://bugzilla.mozilla.org/show_bug.cgi?id=34663.

A crash in gc_root_marker at this point is most likely to have to do with 
hyatt's XBL stuff. I'm reassigning to him.

Comment 3

[John Bandhauer]

See posting from [e-mail] ...
news://news.mozilla.org/pd6tescgrpiuu31pfa5a7hgtv2jufcec70%404ax.com
... which verifies that this root is a "nsXULElement::mScriptObject"

Comment 4

[leger]

Adding crash keyword.

Comment 5

[sean echevarria]

FYI: The crash (which could be reproduced with the time-keeping accuracy of a 
swiss watch) described in the post that jband referred to on 4/7 no longer 
occurs.  I believe the crashes I was experiencing in gc_root_marker() stopped 
happening sometime between 4/28 - 5/1.

Comment 6

[Bernd Mielke]

I dont see it anymore.

Comment 7

[Phil Peterson]

cc chofmann. Top Talkback?

Comment 8

[Peter Trudelle]

resolving as wfm per comments from original submitter.

Comment 9

[Tracy Walker [:tracy]]

- Per last comments, age of bug, and no reopen - Marking Verified.  Please 
reopen if still a problem.