1156283 - crash in WidgetShutdownObserver::Observe(nsISupports*, char const*, char16_t const*)

Status: VERIFIED FIXED

(Core :: Widget: Cocoa, defect)

Description

[Yury Delendik (:yury)]

This bug was filed from the Socorro interface and is 
report bp-ac9510c5-9c88-49a7-abb5-8dcfe2150420.
=============================================================

The first bad revision is:
changeset:   239650:c24fb4429029
user:        Jim Mathies <[e-mail]>
date:        Thu Apr 16 10:16:04 2015 -0500
summary:     Bug 1153939 - Avoid a race condition with setting nsBaseWidgets WidgetShutdownObserver widget pointer to null. Fixes a crash in nsBaseWidget::DestroyCompositor(). r=roc


STR:
1. Open Nightly from terminal with -ProfileManager, e.g.  ./obj-x86_64-apple-darwin14.3.0/dist/Nightly.app/Contents/MacOS/firefox -ProfileManager

Comment 2

[Tracy Walker [:tracy]]

This is a blocker for anyone using the profile manager.  I have been forced to revert to the build on 20140417 and disable updates until this is fixed.

Comment 3

[Jim Mathies [:jimm]]

Looks like mWidget is null here. I*'m going to try to reproduce locally.

Comment 4

[Jim Mathies [:jimm]]

Hmm bummer, I can't reproduce on Windows. I'll have to fire up my mac and get it updated. If anyone on mac has the time to loook at this I would appreciate it.

Comment 5

[Jim Mathies [:jimm]]

bug 1156215 mentions debug build only, will look at that.

Comment 6

[Fred Wenzel [:wenzel]]

(In reply to Jim Mathies [:jimm] from comment #5)
> bug 1156215 mentions debug build only, will look at that.

I can reproduce on today's "regular" nightlies, which I think (?) are not debug builds, fwiw.

Comment 7

[Jim Mathies [:jimm]]

Yeah, whatever this is it's looks like it is osx specific.

Comment 8

[Jim Mathies [:jimm]]

Note you can work around this by using the -p <profilename> option.

Comment 9

[Jim Mathies [:jimm]]

Attachment: patch

This is what I'm seeing:

1) The list of shutdown observers starts getting processed and during this our widget gets torn down.

2) During widget tear down we unregister the WidgetShutdownObserver observer and cleanup the gfx code.

3) The UnregisterShutdownObserver(this) call in WidgetShutdownObserver::Unregister() doesn't take effect, the observer service is too far into processing its list.

5) Observe gets called on WidgetShutdownObservers which looks at mWidget which still looks valid.. but it's not, the widget is already dead.

At this point we crash. Clearing mWidget before ~nsBaseWidget() works around this race.

Comment 10

[Jim Mathies [:jimm]]

 https://treeherder.mozilla.org/#/jobs?repo=try&revision=3524e8ed6354

Comment 11

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a81b76a677af

Comment 12

[Armen [:armenzg]]

Once we're good, could we merge to m-c and re-spin a new Mac nightly? Please and thank you!

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/a81b76a677af

Comment 14

[Carsten Book [:Tomcat]]

also restarted nightlys now for this!

Comment 16

[Jim Mathies [:jimm]]

no crashes in the 4-21 build so far, looks fixed.

Comment 17

[Fred Wenzel [:wenzel]]

Can confirm, no crash anymore here.