Shutdown crash [@ nsCacheService::DispatchToCacheIOThread]




2 years ago
a year ago


(Reporter: mayhemer, Unassigned)



Firefox Tracking Flags

(firefox50 affected)


(Whiteboard: [necko-backlog])



2 years ago
- current m-c, debug, win10
- e10s OFF!
- load an offline cached page
- ctrl-shift-del
- delete offline data
- reload the page twice to cache it again
- close firefox
=> crash

Cause: CC frees the nsHttpChannel of the document which also tears down the associated nsApplicationCache object.  It tries to post nsOfflineCacheDiscardCache event to the cache IO thread, but that is already dead by that time.  The code crashes on dereference of nsCacheService::gService, but just adding a null check doesn't help here.  The cache tries to write something, apparently important, to the sqlite database, that has already been closed.  CC collects stuff long after all the shutdown notifications, I don't see a simple way of reordering here.

This will be very hard to fix.  I have no idea what is the regression range here.  Our appcache tests (still running with e10s off, AFAIK) didn't catch this.  Only channel not having e10s on right now is release.  A bit too late to discover these issues..

>	xul.dll!nsCOMPtr<nsIThread>::operator bool() Line 742	C++
 	xul.dll!nsCacheService::DispatchToCacheIOThread(0x010f95b0) Line 839	C++
 	xul.dll!nsApplicationCache::Discard() Line 771	C++
 	xul.dll!nsApplicationCache::~nsApplicationCache() Line 680	C++
 	xul.dll!nsApplicationCache::`scalar deleting destructor'()	C++
 	xul.dll!nsApplicationCache::Release() Line 647	C++
 	xul.dll!nsCOMPtr<nsIApplicationCache>::~nsCOMPtr<nsIApplicationCache>() Line 407	C++
 	xul.dll!mozilla::net::HttpBaseChannel::~HttpBaseChannel() Line 140	C++
 	xul.dll!mozilla::net::nsHttpChannel::~nsHttpChannel() Line 283	C++
 	xul.dll!mozilla::net::nsHttpChannel::`scalar deleting destructor'()	C++
 	xul.dll!mozilla::net::HttpBaseChannel::Release() Line 213	C++
 	xul.dll!mozilla::net::nsHttpChannel::Release() Line 5331	C++
 	xul.dll!nsCOMPtr<nsIChannel>::~nsCOMPtr<nsIChannel>() Line 407	C++
 	xul.dll!nsIDocument::~nsIDocument() Line 1503	C++
 	xul.dll!nsDocument::~nsDocument() Line 1666	C++
 	xul.dll!nsHTMLDocument::~nsHTMLDocument() Line 187	C++
 	xul.dll!nsHTMLDocument::`scalar deleting destructor'()	C++
 	xul.dll!nsDocument::DeleteCycleCollectable() Line 1721	C++
 	xul.dll!nsDocument::cycleCollection::DeleteCycleCollectable(0x21936800) Line 1024	C++
 	xul.dll!SnowWhiteKiller::~SnowWhiteKiller() Line 2687	C++
 	xul.dll!nsCycleCollector::FreeSnowWhite(true) Line 2859	C++
 	xul.dll!nsCycleCollector::BeginCollection(ShutdownCC, 0x00000000) Line 3842	C++
 	xul.dll!nsCycleCollector::Collect(ShutdownCC, {...}, 0x00000000, false) Line 3667	C++
 	xul.dll!nsCycleCollector::ShutdownCollect() Line 3607	C++
 	xul.dll!nsCycleCollector::Shutdown() Line 3901	C++
 	xul.dll!nsCycleCollector_shutdown() Line 4218	C++
 	xul.dll!mozilla::ShutdownXPCOM(0x00000000) Line 968	C++
 	xul.dll!NS_ShutdownXPCOM(0x01083104) Line 810	C++
 	xul.dll!ScopedXPCOMStartup::~ScopedXPCOMStartup() Line 1340	C++
 	xul.dll!ScopedXPCOMStartup::`scalar deleting destructor'()	C++
 	xul.dll!mozilla::DefaultDelete<ScopedXPCOMStartup>::operator()(0x010061b8) Line 528	C++
 	xul.dll!mozilla::UniquePtr<ScopedXPCOMStartup,mozilla::DefaultDelete<ScopedXPCOMStartup> >::reset(0x00000000) Line 345	C++
 	xul.dll!mozilla::UniquePtr<ScopedXPCOMStartup,mozilla::DefaultDelete<ScopedXPCOMStartup> >::operator=(0x00000000) Line 314	C++
 	xul.dll!XREMain::XRE_main(0x00000004, 0x01001020, 0x004ff95c) Line 4414	C++
 	xul.dll!XRE_main(0x00000004, 0x01001020, 0x004ff95c, 0x00000000) Line 4474	C++

Notes: I can't reproduce this crash on any channel (an official release build) with e10s off.  Still, this prevents me from fixing and verifying bug 1286735.


2 years ago
Whiteboard: [necko-backlog]
You need to log in before you can comment on or make changes to this bug.