120956 - Access Violation in winEmbed on quit.

Status: RESOLVED FIXED

(Core Graveyard :: Embedding: APIs, defect)

Description

[timeless]

w32w2k cvs tip build from a few hours ago. I don't have MFC.

console:
WEBSHELL+ = 1
pldhash: for the table at address 0x01C80DD4, the given entrySize of 44 
probably favors chaining over double hashing.
Note: verifyreflow is disabled
Note: styleverifytree is disabled
Note: frameverifytree is disabled
Opening file cookperm.txt failed
System has shaping
WEBSHELL- = 0
### nsCacheProfilePrefObserver::Observe [topic=xpcom-shutdown data=]
nsPluginHostImpl::Observe "xpcom-shutdown"
Getting service on shutdown. Denied.
  ContractID: @mozilla.org/observer-service;1
         IID: {d07f5192-e3d1-11d2-8acd-00105a1b8860}
Getting service on shutdown. Denied.
  ContractID: @mozilla.org/preferences-service;1
         IID: {decb9cc7-c08f-4ea5-be91-a8fc637ce2d2}
Getting service on shutdown. Denied.
         CID: {a6cf9112-15b3-11d2-932e-00805f8add32}
         IID: {a6cf9111-15b3-11d2-932e-00805f8add32}
Getting service on shutdown. Denied.
  ContractID: @mozilla.org/observer-service;1
         IID: {d07f5192-e3d1-11d2-8acd-00105a1b8860}
Getting service on shutdown. Denied.
         CID: {dc26e0e0-ca94-11d1-a9a4-00805f8a7ac4}
         IID: {a22ad7b0-ca86-11d1-a9a4-00805f8a7ac4}
Getting service on shutdown. Denied.
         CID: {cb6593e0-f9b2-11d2-bdd6-000064657374}
         IID: {efae37b0-946d-11d2-ba58-00805f8a5dd7}

stack:
nsSupportsArray::Clear(nsSupportsArray * const 0x01c48c00) line 600 + 51 bytes
nsSupportsArray::DeleteArray() line 304
nsSupportsArray::~nsSupportsArray() line 147
nsSupportsArray::`vector deleting destructor'(unsigned int 1) + 81 bytes
nsSupportsArray::Release(nsSupportsArray * const 0x01c48c00) line 238 + 133 
bytes
nsCOMPtr<nsISupportsArray>::~nsCOMPtr<nsISupportsArray>() line 491
nsObserverList::~nsObserverList() line 59 + 11 bytes
nsObserverList::`scalar deleting destructor'(unsigned int 1) + 15 bytes
ReleaseObserverList(nsHashKey * 0x01c48cb0, void * 0x01c48df0, void * 
0x00000000) line 110 + 30 bytes
_hashEnumerateRemove(PLHashEntry * 0x01c48c70, int 2, void * 0x0012fe34) line 
371 + 26 bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x00477d08, int (PLHashEntry *, int, 
void *)* 0x1002cd30 _hashEnumerateRemove(PLHashEntry *, int, void *), void * 
0x0012fe34) line 429 + 15 bytes
nsHashtable::Reset(int (nsHashKey *, void *, void *)* 0x100274d0 
ReleaseObserverList(nsHashKey *, void *, void *), void * 0x00000000) line 390 + 
21 bytes
nsObjectHashtable::Reset() line 841
nsObjectHashtable::~nsObjectHashtable() line 807
nsObjectHashtable::`vector deleting destructor'(unsigned int 1) + 81 bytes
nsObserverService::~nsObserverService() line 85 + 33 bytes
nsObserverService::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsObserverService::Release(nsObserverService * const 0x004740b0) line 73 + 127 
bytes
nsCOMPtr<nsIObserverService>::~nsCOMPtr<nsIObserverService>() line 491
main(int 1, char * * 0x00424340) line 196 + 17 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e97d08()

nsSupportsArray::Clear(void)
{
  if (0 < mCount) {
    do {
      --mCount;
      NS_IF_RELEASE(mArray[mCount]); //<--crash here
/*

*/
    } while (0 != mCount);
  }
  return NS_OK;
}

local data at crash point:
-	mArray[mCount]	0x01c48978
+	__vfptr	0xdddddddd <-- bad [freed value]
	mCount	1
-	this	0x01c48c00
+	nsISupportsArray	{...}
	mRefCnt	1
	_mOwningThread	0x00422460
+	mArray	0x01c48c18
	mArraySize	8
	mCount	1
-	mAutoArray	0x01c48c18
+	[0]	0x01c49ef0
+	[1]	0x01c48978
+	[2]	0xcdcdcdcd
+	[3]	0xcdcdcdcd
+	[4]	0xcdcdcdcd
+	[5]	0xcdcdcdcd
+	[6]	0xcdcdcdcd
+	[7]	0xcdcdcdcd

Comment 1

[Adam Lock]

Downgrading priority (winEmbed is unsupported) and confirming.

During closure chrome's refcount is not going to 0 because checkin for bug 99163
caused observers (including chrome) to be added to the observer list with strong
refs instead of weak ones.

Patch follows to correct this. A single r= will be sufficient to enable this
checkin.

Comment 2

[Adam Lock]

Attachment: Ensure observers are added with weak refs

Patch is straightforward. It passes PR_TRUE to the observer service to tell it
to hold weak refs to the observers that are added by winembed.

Review please.

Comment 3

[Axel Hecht]

Comment on attachment 66452 [details] [diff] [review]
Ensure observers are added with weak refs

r=[e-mail]

Comment 4

[Adam Lock]

Fix is in.

Comment 5

[David Epstein]

Was this fixed in the branch? Because the access msgs are still appearing on
shutdown using the trunk (Mozilla 0.9.8 Gecko/20020203). AddObserver() changes
are in this build's WinEmbed.cpp. They're not appearing in MfcEmbed (though
there are some asserts on quit).

Comment 6

[Adam Lock]

No it wasn't fixed in the branch, only in the trunk. I didn't feel that a bug on
a deprecated test application warranted holding up the 0.9.8 release.

Comment 7

[David Epstein]

I agree, but it's not working for me in the Trunk. Will try again in later
build. Timeless, could you take a look at this to see if it works for you on the
trunk?

Comment 8

[Adam Lock]

Works for me in my local build fetched this morning. 

Comment 9

[David Epstein]

I'm no longer getting the msgs with contract IDs, but still get the ones with
CIDs. Mozilla 0.9.8 trunk Gecko/20020209:

### nsCacheProfilePrefObserver::Observe [topic=xpcom-shutdown data=]
nsPluginHostImpl::Observe "xpcom-shutdown"
Getting service on shutdown. Denied.
         CID: {a6cf9112-15b3-11d2-932e-00805f8add32}
         IID: {a6cf9111-15b3-11d2-932e-00805f8add32}
Getting service on shutdown. Denied.
         CID: {dc26e0e0-ca94-11d1-a9a4-00805f8a7ac4}
         IID: {a22ad7b0-ca86-11d1-a9a4-00805f8a7ac4}
Getting service on shutdown. Denied.
         CID: {cb6593e0-f9b2-11d2-bdd6-000064657374}
         IID: {efae37b0-946d-11d2-ba58-00805f8a5dd7}