122314 - crashes on exit in my debug build.

Status: RESOLVED FIXED

(Core Graveyard :: RDF, defect, P3)

Description

[Navin Gupta]

I have a patch in my tree that creates sortNodes as nsIRDFBlob, but I'm
not sure why it would crash here.  

RDFServiceImpl::UnregisterLiteral(nsIRDFLiteral * 0x05861ce0) line 1615 + 18 
bytes
LiteralImpl::~LiteralImpl() line 579
LiteralImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
LiteralImpl::Release(LiteralImpl * const 0x05861ce0) line 583 + 138 bytes
Value::Clear() line 274 + 27 bytes
Value::~Value() line 262
nsAssignment::~nsAssignment() line 387 + 44 bytes
nsAssignmentSet::List::~List() line 424 + 44 bytes
nsAssignmentSet::List::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsAssignmentSet::List::Release() line 430 + 34 bytes
nsAssignmentSet::List::~List() line 424 + 20 bytes
nsAssignmentSet::List::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsAssignmentSet::List::Release() line 430 + 34 bytes
nsAssignmentSet::List::~List() line 424 + 20 bytes
nsAssignmentSet::List::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsAssignmentSet::List::Release() line 430 + 34 bytes
nsAssignmentSet::~nsAssignmentSet() line 458 + 18 bytes
nsTemplateMatch::~nsTemplateMatch() + 29 bytes
nsTemplateMatch::`scalar deleting destructor'(unsigned int 0) + 15 bytes
nsTemplateMatch::Destroy(nsFixedSizeAllocator & {...}, nsTemplateMatch * 
0x04825b08) line 91
nsTemplateMatch::Release(nsFixedSizeAllocator & {...}) line 146 + 13 bytes
nsConflictSet::SupportEntry::Destroy(nsFixedSizeAllocator & {...}, 
nsConflictSet::SupportEntry * 0x04824188) line 420 + 19 bytes
nsConflictSet::FreeSupportEntry(void * 0x03da7e70, PLHashEntry * 0x04824188, 
unsigned int 1) line 339 + 13 bytes
PL_HashTableDestroy(PLHashTable * 0x04587d30) line 166 + 16 bytes
nsConflictSet::Destroy() line 114 + 12 bytes
nsConflictSet::Clear() line 382
nsXULOutlinerBuilder::Rebuild(nsXULOutlinerBuilder * const 0x03da7dc0) line 964
nsXULOutlinerBuilder::SetOutliner(nsXULOutlinerBuilder * const 0x03da7ea8, 
nsIOutlinerBoxObject * 0x00000000) line 693
nsOutlinerBoxObject::SetDocument(nsOutlinerBoxObject * const 0x04509a64, 
nsIDocument * 0x00000000) line 86
nsXULDocument::SetBoxObjectFor(nsXULDocument * const 0x029f5b10, nsIDOMElement * 
0x03722bf4, nsIBoxObject * 0x00000000) line 7144
nsXULElement::SetDocument(nsXULElement * const 0x03722bf0, nsIDocument * 
0x00000000, int 1, int 1) line 2069
nsXULElement::SetDocument(nsXULElement * const 0x03722cf0, nsIDocument * 
0x00000000, int 1, int 1) line 2137
nsXULElement::SetDocument(nsXULElement * const 0x03722d60, nsIDocument * 
0x00000000, int 1, int 1) line 2137
nsXULElement::SetDocument(nsXULElement * const 0x036d1840, nsIDocument * 
0x00000000, int 1, int 1) line 2137
nsXULDocument::SetScriptGlobalObject(nsXULDocument * const 0x029f5af0, 
nsIScriptGlobalObject * 0x00000000) line 1523
DocumentViewerImpl::Close(DocumentViewerImpl * const 0x031fb160) line 1329
nsDocShell::Destroy(nsDocShell * const 0x0293fe24) line 2538
nsWebShell::Destroy(nsWebShell * const 0x0293fe24) line 1218
nsXULWindow::Destroy(nsXULWindow * const 0x0293e4c4) line 382
nsWebShellWindow::Destroy(nsWebShellWindow * const 0x0293e4c4) line 1754 + 9 
bytes
nsWebShellWindow::Close(nsWebShellWindow * const 0x0293e51c) line 389
nsWebShellWindow::HandleEvent(nsGUIEvent * 0x0012f610) line 464
nsWindow::DispatchEvent(nsWindow * const 0x0293e2e4, nsGUIEvent * 0x0012f610, 
nsEventStatus & nsEventStatus_eIgnore) line 850 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f610) line 871
nsWindow::DispatchStandardEvent(unsigned int 101) line 891 + 15 bytes
nsWindow::ProcessMessage(unsigned int 16, unsigned int 0, long 0, long * 
0x0012f9b8) line 3236
nsWindow::WindowProc(HWND__ * 0x002a1144, unsigned int 16, unsigned int 0, long 
0) line 1115 + 27 bytes
USER32! 77e13eb0()
USER32! 77e1591b()
USER32! 77e1595d()
NTDLL! 77f9fb83()
USER32! 77e169a7()
USER32! 77e13eb0()
USER32! 77e16469()
USER32! 77e1a6f8()
nsWindow::WindowProc(HWND__ * 0x002a1144, unsigned int 274, unsigned int 61536, 
long 66552) line 1122 + 31 bytes
USER32! 77e13eb0()
USER32! 77e1591b()
USER32! 77e1595d()
NTDLL! 77f9fb83()
USER32! 77e169a7()
USER32! 77e13eb0()
USER32! 77e16469()
USER32! 77e1a6f8()
nsWindow::WindowProc(HWND__ * 0x002a1144, unsigned int 161, unsigned int 20, 
long 66552) line 1122 + 31 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x004b5fb0) line 308
main1(int 4, char * * 0x004447d0, nsISupports * 0x00000000) line 1285 + 32 bytes
main(int 4, char * * 0x004447d0) line 1625 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87903()

Comment 1

[Chris Waterson]

If you attach your patch (or point me to the bug that has the attachment), I'll
take a look...

Comment 2

[Navin Gupta]

Attachment: patch that causes crash

Comment 3

[Chase Tingley]

Probably unrelated, but I just noticed that the BlobImpl dtor is calling
|NS_RELEASE(gRDFService)| rather than using NS_RELEASE2 like all the other node
implementations do.  I'll give this a quick test to see if it makes a difference.

Comment 4

[Chase Tingley]

Attachment: fix

Yup, this seems to do it.  The blob dtor is clearing the gRDFService pointer
and the next dtor to fire (in this case a literal) crashes on the null pointer.

Comment 5

[Chris Waterson]

Comment on attachment 66886 [details] [diff] [review]
fix

sr=waterson. duh!

Comment 6

[Chris Waterson]

tingley, go ahead and check that in when the tree opens. thanks for wiping my
chin (again!)

Comment 7

[Chase Tingley]

I won't be able to check in until this evening; if someone wants to check this
in before then, let me know.

Comment 8

[Navin Gupta]

I can check it in for you. 

Comment 9

[Chase Tingley]

Go for it.

Comment 10

[Navin Gupta]

fix checked in.