106585 - crash in XPCOMM.DLL during shutdown when mail-news window was open; trunk M1RC1 topcrash [@ nsThreadPool::Shutdown]

Status: VERIFIED FIXED

(Core :: XPCOM, defect)

Description

[K Chayka]

win32 talkback build 2001102309, win98se
also occurs in build 2001102403

1. Start mozilla
2. Start mail-news
3. Close open windows (in any order)
4. Crash when closing the last window

No crash occurs if mail-news was not opened during the session

talkback IDs: 
TB37116550X (10/23 build, one of several)
TB37144870Q (10/24 build)

Comment 1

[Ashley Bischoff (blog at handcoding.com)]

CC: [e-mail], for talkback retrieval, please (TB37144870Q)

-> critical

-> XPCOM, but punt as needed

Comment 2

[Doug Turner (:dougt)]

nsThreadPool::Shutdown [d:\builds\seamonkey\mozilla\xpcom\threads\nsThread.cpp,
line 722]
nsFileTransportService::Shutdown
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsFileTransportService.cpp, line 196]
nsIOService::~nsIOService
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsIOService.cpp, line 239]
nsIOService::`scalar deleting destructor'
nsHttpHandler::Release
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpHandler.cpp, line 1559]
nsServiceEntry::~nsServiceEntry
[d:\builds\seamonkey\mozilla\xpcom\components\nsComponentManager.cpp, line 405]
FreeServiceContractIDEntryEnumerate
[d:\builds\seamonkey\mozilla\xpcom\components\nsComponentManager.cpp, line 1725]
PL_DHashTableEnumerate [d:\builds\seamonkey\mozilla\xpcom\ds\pldhash.c, line 602]
NECKO.DLL + 0x3b59c (0x6082b59c)
nsJARChannel::AddRef
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 103]
nsPartChannel::GetLoadFlags
[d:\builds\seamonkey\mozilla\netwerk\streamconv\converters\nsMultiMixedConv.cpp,
line 229]
nsOnStartRequestEvent::`scalar deleting destructor'
nsJARURI::AddRef 


Neeti, could this be your change?

Comment 3

[neeti]

investigating.

Comment 4

[neeti]

Doug, can you reproduce this. Its not crashing on win2000.

Comment 5

[neeti]

Searching by Stack Signature in talkback for nsThreadPool::Shutdown, I find that 
we are crashing when we call nsHttpHandler::Release, in nsServiceEntry's 
destructor. This is happening on winNT and win98, but not on win2k.

Comment 6

[Doug Turner (:dougt)]

*** Bug 106567 has been marked as a duplicate of this bug. ***

Comment 7

[Matthias Versen [:Matti]]

*** Bug 106690 has been marked as a duplicate of this bug. ***

Comment 8

[neeti]

Attachment: patch for fixing the crash

Comment 9

[neeti]

we need to set the gXPCOMShuttingDown flag after the FreeServices call in 
NS_ShutdownXPCOM(..)

Comment 10

[neeti]

Doug, shaver, can I get a r= and sr=

Comment 11

[neeti]

correction to my comment above: We are moving the flag before the FreeServices() 
call. It is currently after the call.

Comment 12

[Doug Turner (:dougt)]

Comment on attachment 55111 [details] [diff] [review]
patch for fixing the crash

Perfect.

Comment 13

[Doug Turner (:dougt)]

david, can you review this?

Comment 14

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 55111 [details] [diff] [review]
patch for fixing the crash

Cool.

Comment 15

[Doug Turner (:dougt)]

lets get this in as a smoketest blocker.

Comment 16

[neeti]

Checked in fix. Thanks a lot for your help Doug!.

Comment 17

[lpham]

The linux respin completed.  Can someone in this bug to verify it?
ftp://sweetlou.mcom.com/products/client/seamonkey/unix/linux/2.2/x86/2001-10-25-
14-trunk
Thanks,
Loan

Comment 18

[Doug Turner (:dougt)]

I have verified the fix.  Looks good.  Thanks Neeti!!

Comment 19

[Jan Carpenter]

Just added trunk crash [@ nsThreadPool::Shutdown] for future tracking.

Comment 20

[Jan Carpenter]

Reopening for topcrash on M1RC1

     Keyword List : start(4),  
     Count   Platform List 
     31   Windows 98 4.10 build 67766446
     5   Windows 98 4.10 build 67766222
     1   Windows 95 4.0 build 67306684
 
     Count   Build Id List 
     37   2002041717
 
     No of Unique Users        31
 
 Stack trace(Frame) 

	 nsThreadPool::Shutdown
[d:\builds\seamonkey\mozilla\xpcom\threads\nsThread.cpp  line 741] 
	 nsFileTransportService::Shutdown
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsFileTransportService.cpp  line 216] 
	 nsIOService::~nsIOService
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsIOService.cpp  line 253] 
	 nsIOService::`scalar deleting destructor'  
	 nsHttpHandler::Release
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpHandler.cpp  line
1690] 
	 nsCOMPtr_base::assign_with_AddRef
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp  line 74] 
	 PL_DHashTableEnumerate
[d:\builds\seamonkey\mozilla\xpcom\ds\pldhash.c  line 601] 
	 NECKO.DLL + 0x42654 (0x609a2654)  
	 nsIOService::AddRef
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsIOService.cpp  line 299] 
	 0x85107d8b   
 
     (5733665)	Comments: started program twice (2 times a double click).
     (5716887)	Comments: trying to open it  went very slowly  a "Main Window" screen popped
up  and I closed it.  Apparently that's the precursor to Mozilla opening  but
the startup took so long that this window appeared (instead of instantly vanishing
     (5692442)	Comments: upon starup of mozilla  Windows displayed a msg that Mozilla had
made an illegal operation and would be closed downi have been using it for a
week with no such problem
     (5670759)	Comments: I simply  launched the application from my toolbar. I accidentally
double clicked on it (it only needs a single click to launch). It brought up two
windows; one was just a menu bar about 2 inches long and another was a small
window with a white background
     (5670759)	Comments:  and one line of code.
     (5659650)	Comments: installing shockwave and flash
     (5637837)	Comments: I had already launched mozilla  it was frozen  so I killed it.  I
hadn't lauched netscape.  
     (5567190)	Comments: I think Mozlla still had memory allocated but there were no
processes running for mozilla.  system crashed hard when I tried to run the
program after closing it a few minutes before
     (5531631)	URL: www.pbsk.org/
     (5529001)	Comments: I selected several (20 or so) .jpg files  right clicked  and chose
open.  Instead of photoed opening the files  mozilla tried  and I clicked the
"x" to stop it.  Kaboom...
     (5522739)	Comments: Newl mozilla 1.0 installation. Windows 98se  I was looking at a
web site (http://www.dutchisnotrequired.nl/).  I was directed to the macromedia
site to download something but Macromedia didn't know which  so I downloaded the
flash.  When I installed it it
     (5522739)	Comments:  went fine until the end  and then all open Mozilla crashed.
Windoze output:MOZILLA caused an invalid page fault inmodule XPCOM.DLL at
0167:61161726.Registers:EAX=00000000 CS=0167 EIP=61161726
EFLGS=00010246EBX=007e557c SS=016f ESP=0064fc68
     (5522739)	Comments:  EBP=0064fc88ECX=0064fc6c DS=016f ESI=007e7910 FS=322fEDX=0064fc6c
ES=016f EDI=007e7918 GS=0000Bytes at CS:EIP:8b 08 50 ff 51 74 bb 00 00 00 80 89
45 08 85 c3 Stack dump:611616ac 00000000 007e7910 007e7974 007e557c 007e77c0
60fa38d2 00000000
     (5522739)	Comments:  0064fcb4 60969a5c 007e7910 007e5560 007e5568 6117933c 609aae60
609aae6e Good luck!Liam
     (5448156)	Comments: Installed flash player 6 for netscape on Windows 98 with Mozilla
1.0 rc1. 
     (5447998)	Comments: I was starting up Mozilla.
     (5418265)	Comments: startup -- started moz twice in rapid succession -- by
double-clicking on the icon in the startup-bar

     (5708673)	Comments: Browser failed to open when right clicked.
     (5698003)	Comments: Browser failed when I first tried to open browser.
     (5607294)	Comments: Window wouldn't come up when launching program. Got tiny window
with what looked like a line of code on white background.  Also seems to have a
problem minimizing; pops right back up.
 
(5694730)
Comments: Started browser twice  quickly second after first. First browser
window wasn't visible  yet. Error window appeared (something with "mainwindow")
but I don't remember text in it. Closed window and the crash happened.
 
     (5575571)	Comments: restarting browser after installing macromedia flash plugin

     (5674050)	Comments: I wanted to install Flash Player 6.  I downloaded a
Netscape-compatible copy from Macromedia and installed it.After installing  I
was given a small window with a box in it.  This was probably a test page being
loaded  that would show whether Flash 6
     (5674050)	Comments:  was working or not.  Nothing happened for a while  so I closed
the window - that's when the crash occurred.

Comment 21

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

After that long, it's not clear whether this should have been filed as a
separate bug.  However, it definitely shouldn't be a smoketest blocker.

Who should get this bug?

Comment 22

[neeti]

doug, darin: could these be your changes?

Comment 23

[Darin Fisher]

hmm... i can't think of any changes that might explain the recent occurance of
this crash.

Comment 24

[Doug Turner (:dougt)]

I belive this is a completely different bug.  141479.  

Comment 25

[Jay Patel [:jay]]

v.fixed.  please open a new bug for any new crashes with the
nsThreadPool::Shutdown stack signature.