100222 - M094 crash quitting with option-q [@ 0xffc6af00 | 0xffc658c0 | 0xffc10000 | 0xffc80c2c | 0xffc7f89c | 0xffc723b0 | 0xffc7f8bc | 0xffc67e30 | 0xffc67bc0 - nsXPCWrappedJSClass::~nsXPCWrappedJSClass][@ PR_Lock]

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[Jay Patel [:jay]]

This is a topcrasher with M094 and is occurring only on MacOS 9.2.1.  Here is
the latest info:

0xffc658c0   45 
BBID range: 35399733 - 35501213
Min/Max Seconds since last crash: 236 - 51961
Min/Max Runtime: 236 - 51961
Crash data range: 2001-09-14 to 2001-09-17
Build ID range: 2001091311 to 2001091311

Stack Trace: 

	 0xffc658c0
	 nsXPCWrappedJSClass::~nsXPCWrappedJSClass()
[xpcwrappedjsclass.cpp  line 216]
	 nsXPCWrappedJSClass::Release()
[xpcwrappedjsclass.cpp  line 41]
	 nsXPCWrappedJS::~nsXPCWrappedJS()
[xpcwrappedjs.cpp  line 368]
	 nsXPCWrappedJS::Release()
[xpcwrappedjs.cpp  line 149]
	 nsSupportsArray::Clear()
[nsSupportsArray.cpp  line 585]
	 nsSupportsArray::DeleteArray()
[nsSupportsArray.cpp  line 287]
	 nsSupportsArray::~nsSupportsArray()
[nsSupportsArray.cpp  line 130]
	 nsSupportsArray::Release()
[nsSupportsArray.cpp  line 223]
	 nsCOMPtr_base::~nsCOMPtr_base()
[nsCOMPtr.cpp  line 49]
	 nsObserverList::~nsObserverList()
[nsObserverList.cpp  line 184]
	 nsObserverList::Release()
[nsObserverList.cpp  line 157]
	 ReleaseObserverList()
[nsObserverService.cpp  line 96]
	 _hashEnumerateRemove()
[nsHashtable.cpp  line 379]
	 PL_HashTableEnumerateEntries()
[plhash.c  line 429]
	 nsHashtable::Reset()
[nsHashtable.cpp  line 400]
	 nsObjectHashtable::Reset()
[nsHashtable.cpp  line 849]
	 nsObjectHashtable::~nsObjectHashtable()
[nsHashtable.cpp  line 815]
	 nsObserverService::~nsObserverService()
[nsObserverService.cpp  line 63]
	 nsObserverService::Release()
[nsObserverService.cpp  line 46]
	 CObserverService::ReleaseGlobals()
[nsDTDUtils.cpp  line 1618]
	 Shutdown()
[nsParserModule.cpp  line 206]
	 nsGenericModule::Shutdown()
[nsGenericFactory.cpp  line 269]
	 nsGenericModule::~nsGenericModule()
[nsGenericFactory.cpp  line 216]
	 nsGenericModule::Release()
[nsGenericFactory.cpp  line 220]
	 nsDll::Shutdown()
[xcDll.cpp  line 472]
	 nsFreeLibrary()
[nsNativeComponentLoader.cpp  line 389]
	 nsFreeLibraryEnum()
[nsNativeComponentLoader.cpp  line 439]
	 _hashEnumerate()
[nsHashtable.cpp  line 194]     (35501213)	Comments: Closing Mozilla
     (35490096)	Comments: Quit the browser.
     (35488468)	Comments: apple-q
     (35486690)	Comments: crash on quit
     (35478058)	Comments: downloadin a theme for the browser
     (35475989)	Comments: Quitting
     (35475658)	Comments: I was quitting and Talkback came on
     (35462211)	Comments: Quiting the browser ...
     (35458513)	URL: my.eusoff.nus.edu.sg
     (35458513)	Comments: opening icq.
     (35453175)	Comments: cmd-q to quit communicator
     (35449109)	URL: http://www.ctt.ne.jp/hp4.html
(35449109)
Comments: After I had completed the  form and sent it  I tried to quit and then
type 3 error occured.
     (35444627)	Comments: quitting mozzilz
     (35443533)	URL: http://www.forum-der-13.de
http://www.forum-der-13.de
(35439473)
Comments: quitting
     (35437852)	Comments: Quitting it using Option-Q
     (35437402)	Comments: I was quiting using the apple-q key combination...
     (35433035)	Comments: QUitting
     (35417718)	Comments: quitting
     (35413076)	Comments: Pressing "Apple + Q" (= quitting)
     (35411183)	URL: Mozilla crashed when I quit the program.
     (35411183)	Comments: Mozilla crashed when I quit the program.
     (35399733)	URL: http://www.mozilla.org
(35399733)
Comments: Quitting

Comment 1

[Jay Patel [:jay]]

Adding crash, topcrash keywords and M094 [@ 0xffc658c0 -
nsXPCWrappedJSClass::~nsXPCWrappedJSClass] to summary for tracking.

Comment 2

[Aaron Leventhal]

-> xpconnect?

Comment 3

[Phil Schwartau]

Note the comments from the users: 

Comments: After I had completed the form and sent it, 
          I tried to quit and then type 3 error occured.
(35444627) Comments: quitting mozilla
(35443533) URL: http://www.forum-der-13.de
(35439473)Comments: quitting
(35437852) Comments: Quitting it using Option-Q
(35437402) Comments: I was quiting using the apple-q key combination...
(35433035) Comments: QUitting
(35417718) Comments: quitting
(35413076) Comments: Pressing "Apple + Q" (= quitting)
(35411183) URL: Mozilla crashed when I quit the program.
(35411183) Comments: Mozilla crashed when I quit the program.
(35399733) URL: http://www.mozilla.org
(35399733) Comments: Quitting


I was only able to reproduce this once on Mac9.1, with binary 2001091808:

STEPS TO REPRODUCE:
1. Load http://www.cnn.com
2. x-dismiss the popup window containing advertising
3. Apple + "Q" to quit Mozilla
4. CRASH!


Note: so far I've not been able to do it again. I think it's because
I never get the popup window anymore, even if I delete all cookies.
CNN leaves a cookie called "Edition Popup". 

Comment 4

[John Bandhauer]

Yes this is an xpconnect bug. We should just be letting the nsXPCWrappedJSClass
objects leak when these releases come after the xpconnect subsystem has been
shut down. We can fix this in the nsXPCWrappedJS dtor by only doing the releases
if xpconnect has not yet shutdown (the normal case!).

The comment in nsXPCWrappedJS::SystemIsBeingShutDown explains why we don't just
eagerly let go of mClass.

We should do the same for the mOuter member (used in aggregation - by xbl) since
it is currently in violation of our policy of not propagating releases out of
xpconnect after shutdown.

I'll attach a short patch.

Comment 5

[John Bandhauer]

Attachment: proposed fix

Comment 6

[David Bradley]

r=dbradley

Comment 7

[Johnny Stenback (:jst)]

Comment on attachment 49809 [details] [diff] [review]
proposed fix

sr=jst

Comment 8

[John Bandhauer]

fix checked into trunk.

It would be great if someone who has seen this bug would verify.

Comment 9

[Phil Schwartau]

Verified Fixed on Mac9.1 with Mozilla trunk binary 2001092108.
I followed the steps to reproduce at 2001-09-18 12:20 above, by
going to sites that throw up popup ads. I x-dismissed the popups,
then did Apple + Q to quit Mozilla.

I also tried this with Mozilla trunk binaries 20010921xx on WinNT, Linux. 


I never crashed. Marking Verified. If anyone has Mac OS 9.2.1 and is
still crashing, please reopen. I do not have that version of the OS.

Comment 10

[greer]

Adding 0xffc6af00 to summary. Just for talkback reference. This crash is was
also happening under this signature.

Comment 11

[Jay Patel [:jay]]

What about the branch?  Are we going to get this checked into the M094/N620
branch?  This was reported a topcrash for Mozilla0.9.4, which came off the
branch, so if we don't want to see this crash with eMojo, it needs to be checked
into the branch.

Comment 12

[Jay Patel [:jay]]

cc'ing chofmann to see about the branch.

Comment 13

[John Bandhauer]

This is small cheap and safe. I'm all for it.

Comment 14

[David Bradley]

Little risk in applying it to the branch in my opinion, I'm fine with it.

Comment 15

[chris hofmann]

yes, lets get this on the 0.9.4 branch

Comment 16

[John Bandhauer]

fix checked in to MOZILLA_0_9_4_BRANCH

Comment 17

[greer]

*** Bug 101445 has been marked as a duplicate of this bug. ***

Comment 18

[greer]

Bizarre talkback summary change. (Pay no attention the the man behind the 
curtain...)

Comment 19

[Phil Schwartau]

Verified on branch: on Mac9.1 with Mozilla 0.9.4 binary 2001092603.
Method - same as for trunk verification at 2001-09-21 16:43 above. 

Comment 20

[Jay Patel [:jay]]

Adding [@ PR_Lock], bug 101445 was marked a dup of this one.