M094 crash quitting with option-q [@ 0xffc6af00 | 0xffc658c0 | 0xffc10000 | 0xffc80c2c | 0xffc7f89c | 0xffc723b0 | 0xffc7f8bc | 0xffc67e30 | 0xffc67bc0 - nsXPCWrappedJSClass::~nsXPCWrappedJSClass][@ PR_Lock]

VERIFIED FIXED

Status

()

Core
XPConnect
--
critical
VERIFIED FIXED
17 years ago
17 years ago

People

(Reporter: jay, Assigned: David Bradley)

Tracking

({crash, topcrash})

Trunk
PowerPC
Mac System 9.x
crash, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: PDT+, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

17 years ago
This is a topcrasher with M094 and is occurring only on MacOS 9.2.1.  Here is
the latest info:

0xffc658c0   45 
BBID range: 35399733 - 35501213
Min/Max Seconds since last crash: 236 - 51961
Min/Max Runtime: 236 - 51961
Crash data range: 2001-09-14 to 2001-09-17
Build ID range: 2001091311 to 2001091311

Stack Trace: 

	 0xffc658c0
	 nsXPCWrappedJSClass::~nsXPCWrappedJSClass()
[xpcwrappedjsclass.cpp  line 216]
	 nsXPCWrappedJSClass::Release()
[xpcwrappedjsclass.cpp  line 41]
	 nsXPCWrappedJS::~nsXPCWrappedJS()
[xpcwrappedjs.cpp  line 368]
	 nsXPCWrappedJS::Release()
[xpcwrappedjs.cpp  line 149]
	 nsSupportsArray::Clear()
[nsSupportsArray.cpp  line 585]
	 nsSupportsArray::DeleteArray()
[nsSupportsArray.cpp  line 287]
	 nsSupportsArray::~nsSupportsArray()
[nsSupportsArray.cpp  line 130]
	 nsSupportsArray::Release()
[nsSupportsArray.cpp  line 223]
	 nsCOMPtr_base::~nsCOMPtr_base()
[nsCOMPtr.cpp  line 49]
	 nsObserverList::~nsObserverList()
[nsObserverList.cpp  line 184]
	 nsObserverList::Release()
[nsObserverList.cpp  line 157]
	 ReleaseObserverList()
[nsObserverService.cpp  line 96]
	 _hashEnumerateRemove()
[nsHashtable.cpp  line 379]
	 PL_HashTableEnumerateEntries()
[plhash.c  line 429]
	 nsHashtable::Reset()
[nsHashtable.cpp  line 400]
	 nsObjectHashtable::Reset()
[nsHashtable.cpp  line 849]
	 nsObjectHashtable::~nsObjectHashtable()
[nsHashtable.cpp  line 815]
	 nsObserverService::~nsObserverService()
[nsObserverService.cpp  line 63]
	 nsObserverService::Release()
[nsObserverService.cpp  line 46]
	 CObserverService::ReleaseGlobals()
[nsDTDUtils.cpp  line 1618]
	 Shutdown()
[nsParserModule.cpp  line 206]
	 nsGenericModule::Shutdown()
[nsGenericFactory.cpp  line 269]
	 nsGenericModule::~nsGenericModule()
[nsGenericFactory.cpp  line 216]
	 nsGenericModule::Release()
[nsGenericFactory.cpp  line 220]
	 nsDll::Shutdown()
[xcDll.cpp  line 472]
	 nsFreeLibrary()
[nsNativeComponentLoader.cpp  line 389]
	 nsFreeLibraryEnum()
[nsNativeComponentLoader.cpp  line 439]
	 _hashEnumerate()
[nsHashtable.cpp  line 194]     (35501213)	Comments: Closing Mozilla
     (35490096)	Comments: Quit the browser.
     (35488468)	Comments: apple-q
     (35486690)	Comments: crash on quit
     (35478058)	Comments: downloadin a theme for the browser
     (35475989)	Comments: Quitting
     (35475658)	Comments: I was quitting and Talkback came on
     (35462211)	Comments: Quiting the browser ...
     (35458513)	URL: my.eusoff.nus.edu.sg
     (35458513)	Comments: opening icq.
     (35453175)	Comments: cmd-q to quit communicator
     (35449109)	URL: http://www.ctt.ne.jp/hp4.html
(35449109)
Comments: After I had completed the  form and sent it  I tried to quit and then
type 3 error occured.
     (35444627)	Comments: quitting mozzilz
     (35443533)	URL: http://www.forum-der-13.de
http://www.forum-der-13.de
(35439473)
Comments: quitting
     (35437852)	Comments: Quitting it using Option-Q
     (35437402)	Comments: I was quiting using the apple-q key combination...
     (35433035)	Comments: QUitting
     (35417718)	Comments: quitting
     (35413076)	Comments: Pressing "Apple + Q" (= quitting)
     (35411183)	URL: Mozilla crashed when I quit the program.
     (35411183)	Comments: Mozilla crashed when I quit the program.
     (35399733)	URL: http://www.mozilla.org
(35399733)
Comments: Quitting
(Reporter)

Comment 1

17 years ago
Adding crash, topcrash keywords and M094 [@ 0xffc658c0 -
nsXPCWrappedJSClass::~nsXPCWrappedJSClass] to summary for tracking.
Keywords: crash, topcrash

Comment 2

17 years ago
-> xpconnect?
Assignee: aaronl → dbradley
Component: Keyboard Navigation → XPConnect
QA Contact: sairuh → pschwartau

Comment 3

17 years ago
Note the comments from the users: 

Comments: After I had completed the form and sent it, 
          I tried to quit and then type 3 error occured.
(35444627) Comments: quitting mozilla
(35443533) URL: http://www.forum-der-13.de
(35439473)Comments: quitting
(35437852) Comments: Quitting it using Option-Q
(35437402) Comments: I was quiting using the apple-q key combination...
(35433035) Comments: QUitting
(35417718) Comments: quitting
(35413076) Comments: Pressing "Apple + Q" (= quitting)
(35411183) URL: Mozilla crashed when I quit the program.
(35411183) Comments: Mozilla crashed when I quit the program.
(35399733) URL: http://www.mozilla.org
(35399733) Comments: Quitting


I was only able to reproduce this once on Mac9.1, with binary 2001091808:

STEPS TO REPRODUCE:
1. Load http://www.cnn.com
2. x-dismiss the popup window containing advertising
3. Apple + "Q" to quit Mozilla
4. CRASH!


Note: so far I've not been able to do it again. I think it's because
I never get the popup window anymore, even if I delete all cookies.
CNN leaves a cookie called "Edition Popup". 

Comment 4

17 years ago
Yes this is an xpconnect bug. We should just be letting the nsXPCWrappedJSClass
objects leak when these releases come after the xpconnect subsystem has been
shut down. We can fix this in the nsXPCWrappedJS dtor by only doing the releases
if xpconnect has not yet shutdown (the normal case!).

The comment in nsXPCWrappedJS::SystemIsBeingShutDown explains why we don't just
eagerly let go of mClass.

We should do the same for the mOuter member (used in aggregation - by xbl) since
it is currently in violation of our policy of not propagating releases out of
xpconnect after shutdown.

I'll attach a short patch.

Comment 5

17 years ago
Created attachment 49809 [details] [diff] [review]
proposed fix
(Assignee)

Comment 6

17 years ago
r=dbradley
Comment on attachment 49809 [details] [diff] [review]
proposed fix

sr=jst
Attachment #49809 - Flags: superreview+
Attachment #49809 - Flags: review+

Comment 8

17 years ago
fix checked into trunk.

It would be great if someone who has seen this bug would verify.
Status: NEW → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → FIXED

Comment 9

17 years ago
Verified Fixed on Mac9.1 with Mozilla trunk binary 2001092108.
I followed the steps to reproduce at 2001-09-18 12:20 above, by
going to sites that throw up popup ads. I x-dismissed the popups,
then did Apple + Q to quit Mozilla.

I also tried this with Mozilla trunk binaries 20010921xx on WinNT, Linux. 


I never crashed. Marking Verified. If anyone has Mac OS 9.2.1 and is
still crashing, please reopen. I do not have that version of the OS.
Status: RESOLVED → VERIFIED

Comment 10

17 years ago
Adding 0xffc6af00 to summary. Just for talkback reference. This crash is was
also happening under this signature.
Summary: M094 crash quitting with option-q [@ 0xffc658c0 - nsXPCWrappedJSClass::~nsXPCWrappedJSClass] → M094 crash quitting with option-q [@ 0xffc6af00 0xffc658c0 - nsXPCWrappedJSClass::~nsXPCWrappedJSClass]
(Reporter)

Comment 11

17 years ago
What about the branch?  Are we going to get this checked into the M094/N620
branch?  This was reported a topcrash for Mozilla0.9.4, which came off the
branch, so if we don't want to see this crash with eMojo, it needs to be checked
into the branch.
(Reporter)

Comment 12

17 years ago
cc'ing chofmann to see about the branch.

Comment 13

17 years ago
This is small cheap and safe. I'm all for it.
(Assignee)

Comment 14

17 years ago
Little risk in applying it to the branch in my opinion, I'm fine with it.

Comment 15

17 years ago
yes, lets get this on the 0.9.4 branch
Keywords: nsbranch+
Whiteboard: PDT+

Comment 16

17 years ago
fix checked in to MOZILLA_0_9_4_BRANCH

Comment 17

17 years ago
*** Bug 101445 has been marked as a duplicate of this bug. ***

Comment 18

17 years ago
Bizarre talkback summary change. (Pay no attention the the man behind the 
curtain...)
Summary: M094 crash quitting with option-q [@ 0xffc6af00 0xffc658c0 - nsXPCWrappedJSClass::~nsXPCWrappedJSClass] → M094 crash quitting with option-q [@ 0xffc6af00 | 0xffc658c0 | 0xffc10000 | 0xffc80c2c | 0xffc7f89c | 0xffc723b0 | 0xffc7f8bc | 0xffc67e30 | 0xffc67bc0 | nsXPCWrappedJSClass::~nsXPCWrappedJSClass]

Comment 19

17 years ago
Verified on branch: on Mac9.1 with Mozilla 0.9.4 binary 2001092603.
Method - same as for trunk verification at 2001-09-21 16:43 above. 
(Reporter)

Comment 20

17 years ago
Adding [@ PR_Lock], bug 101445 was marked a dup of this one.
Summary: M094 crash quitting with option-q [@ 0xffc6af00 | 0xffc658c0 | 0xffc10000 | 0xffc80c2c | 0xffc7f89c | 0xffc723b0 | 0xffc7f8bc | 0xffc67e30 | 0xffc67bc0 | nsXPCWrappedJSClass::~nsXPCWrappedJSClass] → M094 crash quitting with option-q [@ 0xffc6af00 | 0xffc658c0 | 0xffc10000 | 0xffc80c2c | 0xffc7f89c | 0xffc723b0 | 0xffc7f8bc | 0xffc67e30 | 0xffc67bc0 - nsXPCWrappedJSClass::~nsXPCWrappedJSClass][@ PR_Lock]
Crash Signature: [@ 0xffc6af00 | 0xffc658c0 | 0xffc10000 | 0xffc80c2c | 0xffc7f89c | 0xffc723b0 | 0xffc7f8bc | 0xffc67e30 | 0xffc67bc0 - nsXPCWrappedJSClass::~nsXPCWrappedJSClass] [@ PR_Lock]
You need to log in before you can comment on or make changes to this bug.