423669 - AntiVir Current Virus Definition Extension Crash Firefox Debug Build

Status: RESOLVED DUPLICATE of bug 422827

(Core :: General, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: apple crash reporter output

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b5pre) Gecko/2008031718 Firefox/3.0b5pre ID:2008031718

Steps to reproduce:
-> Install the AntiVir Current Virus Definition Extension
-> In the Status Bar click on "AntiVir"-> Download Updates Manually
-> Cancel the Select File Location Dialog
-> Close Firefox
--> Crash

Process:         firefox-bin [404]
Path:            /debug/mozilla/firefox-10.5-debug/dist/FirefoxDebug.app/Contents/MacOS/firefox-bin
Identifier:      org.mozilla.firefox
Version:         3.0b5pre (3.0b5pre)
Code Type:       X86 (Native)
Parent Process:  sh [398]

Date/Time:       2008-03-18 15:56:40.800 +0100
OS Version:      Mac OS X 10.5.2 (9C31)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000077696e84
Crashed Thread:  0

Thread 0 Crashed:
0   libobjc.A.dylib               	0x94bd26e8 objc_msgSend + 24
1   com.apple.AppKit              	0x932fe74e +[NSMenu(NSKeyEquivalents) _unregisterMenuItemForKeyEquivalentUniquing:] + 100
2   com.apple.AppKit              	0x932fe3d1 -[NSMenuItem setMenu:] + 113
3   com.apple.AppKit              	0x932ff40c -[NSMenu removeItemAtIndex:] + 107
4   libwidget_mac.dylib           	0x00e2d5b5 nsMenuX::RemoveAll() + 417 (nsMenuX.mm:413)
5   libwidget_mac.dylib           	0x00e2d70d nsMenuX::~nsMenuX() + 219 (nsMenuX.mm:113)
6   libwidget_mac.dylib           	0x00e2c46d nsMenuX::Release() + 291 (nsMenuX.mm:87)
7   libxpcom_core.dylib           	0x0071925e ReleaseObjects(void*, void*) + 36 (nsCOMArray.cpp:151)
8   libxpcom_core.dylib           	0x0071fa62 nsVoidArray::EnumerateForwards(int (*)(void*, void*), void*) + 58 (nsVoidArray.cpp:678)
9   libxpcom_core.dylib           	0x00719296 nsCOMArray_base::Clear() + 42 (nsCOMArray.cpp:159)
10  libwidget_mac.dylib           	0x00e397b5 nsCOMArray<nsIMenu>::Clear() + 17 (nsCOMArray.h:217)
11  libwidget_mac.dylib           	0x00e358f3 nsMenuBarX::~nsMenuBarX() + 237 (nsMenuBarX.mm:129)
12  libwidget_mac.dylib           	0x00e34685 nsMenuBarX::Release() + 291 (nsMenuBarX.mm:67)
13  libwidget_mac.dylib           	0x00e31eee nsCOMPtr<nsIMenuBar>::~nsCOMPtr() + 66 (nsCOMPtr.h:583)
14  libwidget_mac.dylib           	0x00e31f01 nsCOMPtr<nsIMenuBar>::~nsCOMPtr() + 17 (nsCOMPtr.h:583)
15  libwidget_mac.dylib           	0x00e5401e nsCocoaWindow::~nsCocoaWindow() + 644 (nsCocoaWindow.mm:142)
16  libwidget_mac.dylib           	0x00e88589 nsBaseWidget::Release() + 293 (nsBaseWidget.cpp:69)
17  libwidget_mac.dylib           	0x00e4eb28 nsCocoaWindow::Release() + 24 (nsCocoaWindow.mm:82)
18  libnsappshell.dylib           	0x0ab985fc nsCOMPtr<nsIWidget>::assign_assuming_AddRef(nsIWidget*) + 94 (nsCOMPtr.h:568)
19  libnsappshell.dylib           	0x0ab9862e nsCOMPtr<nsIWidget>::assign_with_AddRef(nsISupports*) + 48 (nsCOMPtr.h:1267)
20  libnsappshell.dylib           	0x0ab9a466 nsCOMPtr<nsIWidget>::operator=(nsIWidget*) + 24 (nsCOMPtr.h:714)
21  libnsappshell.dylib           	0x0ab91b37 nsXULWindow::Destroy() + 975 (nsXULWindow.cpp:534)
22  libnsappshell.dylib           	0x0aba1ebf nsWebShellWindow::Destroy() + 345 (nsWebShellWindow.cpp:840)
23  libnsappshell.dylib           	0x0ab9c62c nsAppShellService::DestroyHiddenWindow() + 68 (nsAppShellService.cpp:211)
24  libtoolkitcomps.dylib         	0x0a5ae754 nsAppStartup::DestroyHiddenWindow() + 152 (nsAppStartup.cpp:160)
25  XUL                           	0x000ba263 ScopedXPCOMStartup::~ScopedXPCOMStartup() + 101 (nsAppRunner.cpp:905)
26  XUL                           	0x000ba2d5 ScopedXPCOMStartup::~ScopedXPCOMStartup() + 17 (nsAppRunner.cpp:912)
27  XUL                           	0x000c1084 XRE_main + 6746 (nsAppRunner.cpp:3195)
28  org.mozilla.firefox           	0x000026d3 main + 709 (nsBrowserApp.cpp:158)
29  org.mozilla.firefox           	0x00001d00 _start + 210
30  org.mozilla.firefox           	0x00001c2d start + 41

Comment 1

[Steven Michaud [:smichaud] (Retired)]

I'll bet this is a dup of bug 422827.

This stack is very similar to the one at bug 422827 comment #2.  And
both bugs seem to be triggered by exercising a seldom-used menu item,
then quitting.

One question -- does this crash also happen on OS X 10.4.11?

(The STR in bug 422827 comment #3 only "works" on OS X 10.5.2.)

Comment 2

[Carsten Book [:Tomcat]]

yeah might be a dupe of 422827, i'm also only able to crash leopard and not tiger with a new debug build

Comment 3

[Mike Schroepfer]

Given comment 1 taking off blocking list - if we find this is a unique/bad issue please re-nom

Comment 4

[Steven Michaud [:smichaud] (Retired)]

Here's a reduced version of Tomcat's STR from comment #0.  (I assume
that you've already installed the AntiVir extension):

1) With Minefield running and at least one window open, click
   somewhere (e.g. on the desktop) to make Minefield lose the app
   focus.

2) While Minefield is still unfocused, right-click on "AntiVir" in the
   Status Bar and choose Download Updates Manually.  (Ctrl-click won't
   do.  Minefield should still be unfocused.)

3) Left-click on the Cancel button in the Select File Location dialog
   (this will give Minefield the app focus).

4) Quit Minefield (using Cmd-q or from the menu).

5) Crash.

Comment 5

[Steven Michaud [:smichaud] (Retired)]

I've posted a patch for bug 422827 that also fixes this bug (bug
423669).  Here's a tryserver build made with that patch:

https://build.mozilla.org/tryserver-builds/2008-03-20_13:[e-mail]-bugzilla422827/[e-mail]

Comment 6

[Steven Michaud [:smichaud] (Retired)]

Oops, I made a dumb mistake in my patch.  I'll post a new one (and a new tryserver build) shortly.

Comment 7

[Steven Michaud [:smichaud] (Retired)]

I've posted a new patch at bug 422827, which fixes a bad leak.

Here's a tryserver build made with it:

https://build.mozilla.org/tryserver-builds/2008-03-20_15:[e-mail]-bugzilla422827-rev1/[e-mail]

Comment 8

[Carsten Book [:Tomcat]]

(In reply to comment #7)
> I've posted a new patch at bug 422827, which fixes a bad leak.
> 
> Here's a tryserver build made with it:
> 
> https://build.mozilla.org/tryserver-builds/2008-03-20_15:[e-mail]-bugzilla422827-rev1/[e-mail]
> 

i can confirm that this crash is fixed with the steven's tryserver build Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b5pre) Gecko/2008032015 Minefield/3.0b5pre i no longer crash with my steps to reproduce.

With this Bug it seems we have found another way to crash the builds as the topcrashes in Bug 422827

Even when this bug has different steps to reproduce, i will dupe this bug to Bug 422827 for a better tracking. Thanks Steven for fixing this :)