1370207 - Crash in mozilla::widget::TSFTextStore::Terminate

Status: RESOLVED FIXED

(Core :: Widget: Win32, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-d3d9502f-0df9-436d-a029-f70370170605.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 		@0x2566fb8e7f0 	
1 	xul.dll 	mozilla::widget::TSFTextStore::Terminate() 	widget/windows/TSFTextStore.cpp:6201
2 	xul.dll 	mozilla::widget::IMEHandler::Terminate() 	widget/windows/WinIMEHandler.cpp:87
3 	xul.dll 	nsWindow::~nsWindow() 	widget/windows/nsWindow.cpp:715
4 	xul.dll 	nsWindow::`scalar deleting destructor'(unsigned int) 	
5 	xul.dll 	nsBaseWidget::Release() 	widget/nsBaseWidget.cpp:144
6 	xul.dll 	nsCOMPtr_base::~nsCOMPtr_base() 	obj-firefox/dist/include/nsCOMPtr.h:294
7 	xul.dll 	nsBaseWidget::~nsBaseWidget() 	widget/nsBaseWidget.cpp:360
8 	xul.dll 	nsWindow::`scalar deleting destructor'(unsigned int) 	
9 	xul.dll 	nsBaseWidget::Release() 	widget/nsBaseWidget.cpp:144
10 	xul.dll 	nsCOMPtr_base::~nsCOMPtr_base() 	obj-firefox/dist/include/nsCOMPtr.h:294
11 	xul.dll 	nsDeviceContext::`scalar deleting destructor'(unsigned int) 	
12 	xul.dll 	nsPresContext::~nsPresContext() 	layout/base/nsPresContext.cpp:394
13 	xul.dll 	nsRootPresContext::`scalar deleting destructor'(unsigned int) 	
14 	xul.dll 	nsPresContext::DeleteCycleCollectable() 	layout/base/nsPresContext.cpp:402
15 	xul.dll 	SnowWhiteKiller::~SnowWhiteKiller() 	xpcom/base/nsCycleCollector.cpp:2651
16 	xul.dll 	nsCycleCollector::FreeSnowWhite(bool) 	xpcom/base/nsCycleCollector.cpp:2826
17 	xul.dll 	nsCycleCollector_shutdown(bool) 	xpcom/base/nsCycleCollector.cpp:4247
18 	xul.dll 	mozilla::ShutdownXPCOM(nsIServiceManager*) 	xpcom/build/XPCOMInit.cpp:987
19 	xul.dll 	ScopedXPCOMStartup::~ScopedXPCOMStartup() 	toolkit/xre/nsAppRunner.cpp:1450
20 	xul.dll 	mozilla::UniquePtr<ScopedXPCOMStartup, mozilla::DefaultDelete<ScopedXPCOMStartup> >::reset(ScopedXPCOMStartup*) 	obj-firefox/dist/include/mozilla/UniquePtr.h:345
21 	xul.dll 	XREMain::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4779
22 	xul.dll 	XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4846
23 	firefox.exe 	NS_internal_main(int, char**, char**) 	browser/app/nsBrowserApp.cpp:309
24 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
25 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
26 	kernel32.dll 	BaseThreadInitThunk 	
27 	ntdll.dll 	RtlUserThreadStart

these crash signatures start to show up in 55.0a1 build 20170604030205 from a number of different installations.
this is the pushlog to the day before - out of this, bug 1369419 would be a change related to TSF:
https://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2017-06-02&tochange=130efc657df7e7fe291cc42307f3eb3cb0484dfc

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Wow, interesting. Perhaps, it means that ThreadMgr has been released by TSF itself but we still grab it... So, internal TSF crash may be caused by such odd refcount management.

But anyway, this will be fixed by bug 1370198 which will back out the patch for bug 1369419.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

No instances of this crash since bug 1370198 landed.