14622 - ref counting problem with pref migration service.

Status: VERIFIED FIXED

(Core Graveyard :: Profile: Migration, defect, P3)

Description

[(not reading, please use [e-mail] instead)]

here's the stack trace from windows

nsDebug::Assertion(const char * 0x100855f4, const char * 0x100855d8, const char
* 0x10085598, int 302) line 181 + 13 bytes
nsServiceManagerImpl::ReleaseService(nsServiceManagerImpl * const 0x00bb48a0,
const nsID & {...}, nsISupports * 0x00000000, nsIShutdownListener * 0x00000000)
line 302 + 37 bytes
nsServiceManager::ReleaseService(const nsID & {...}, nsISupports * 0x028294c0,
nsIShutdownListener * 0x00000000) line 458 + 29 bytes
nsPrefMigration::~nsPrefMigration() line 199 + 29 bytes
nsPrefMigration::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsPrefMigration::Release(nsPrefMigration * const 0x02783350) line 256 + 99 bytes
nsCOMPtr<nsIPrefMigration>::~nsCOMPtr<nsIPrefMigration>() line 458
nsProfile::MigrateProfile(nsProfile * const 0x01df1e80, const char * 0x02783ab0)
line 2405 + 35 bytes
ProfileServicesImpl::MigrateProfile(ProfileServicesImpl * const 0x0243c120,
const char * 0x02783ab0) line 174 + 22 bytes
XPTC_InvokeByIndex(nsISupports * 0x0243c120, unsigned int 10, unsigned int 1,
nsXPTCVariant * 0x0012e154) line 135
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x020400a0,
nsXPCWrappedNative * 0x0243d0f0, const XPCNativeMemberDescriptor * 0x0243d330,
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 1, long *
0x00d4a354, long * 0x0012e2f4) line 751 + 44 bytes
WrappedNative_CallMethod(JSContext * 0x020400a0, JSObject * 0x024679e8, unsigned
int 1, long * 0x00d4a354, long * 0x0012e2f4) line 170 + 34 bytes
js_Invoke(JSContext * 0x020400a0, unsigned int 1, unsigned int 0) line 655 + 26
bytes
js_Interpret(JSContext * 0x020400a0, long * 0x0012eb6c) line 2232 + 15 bytes
js_Invoke(JSContext * 0x020400a0, unsigned int 0, unsigned int 0) line 671 + 13
bytes
js_Interpret(JSContext * 0x020400a0, long * 0x0012f3a0) line 2232 + 15 bytes
js_Invoke(JSContext * 0x020400a0, unsigned int 1, unsigned int 2) line 671 + 13
bytes
js_InternalCall(JSContext * 0x020400a0, JSObject * 0x00cf6d20, long 13593896,
unsigned int 1, long * 0x0012f520, long * 0x0012f4d8) line 748 + 15 bytes
JS_CallFunction(JSContext * 0x020400a0, JSObject * 0x00cf6d20, JSFunction *
0x023f10f0, unsigned int 1, long * 0x0012f520, long * 0x0012f4d8) line 2634 + 32
bytes
nsJSContext::CallFunction(nsJSContext * const 0x02040210, void * 0x00cf6d20,
void * 0x023f10f0, unsigned int 1, void * 0x0012f520, int * 0x0012f51c) line 231
+ 39 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x02783240) line 103 + 48 bytes
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012f820, nsIDOMEvent * * 0x0012f7e8, unsigned int 7, nsEventStatus &
nsEventStatus_eIgnore) line 633 + 21 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x023f1750, nsIPresContext
& {...}, nsEvent * 0x0012f820, nsIDOMEvent * * 0x0012f7e8, unsigned int 1,
nsEventStatus & nsEventStatus_eIgnore) line 2875
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const
0x0240c8e0, nsIPresContext & {...}, nsMouseEvent * 0x0012fb48, nsEventStatus &
nsEventStatus_eIgnore) line 947 + 42 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x0240c8e0,
nsIPresContext & {...}, nsGUIEvent * 0x0012fb48, nsIFrame * 0x0240e2f0,
nsEventStatus & nsEventStatus_eIgnore, nsIView * 0x022a43b0) line 418 + 24 bytes
PresShell::HandleEvent(PresShell * const 0x022a5f14, nsIView * 0x022a43b0,
nsGUIEvent * 0x0012fb48, nsEventStatus & nsEventStatus_eIgnore) line 2091 + 43
bytes
nsView::HandleEvent(nsView * const 0x022a43b0, nsGUIEvent * 0x0012fb48, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 828
nsViewManager::DispatchEvent(nsViewManager * const 0x022a45d0, nsGUIEvent *
0x0012fb48, nsEventStatus & nsEventStatus_eIgnore) line 1667
HandleEvent(nsGUIEvent * 0x0012fb48) line 63
nsWindow::DispatchEvent(nsWindow * const 0x022a4274, nsGUIEvent * 0x0012fb48,
nsEventStatus & nsEventStatus_eIgnore) line 338 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fb48) line 359
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3228 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line
3446
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 30081299, long *
0x0012fd6c) line 2458 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x027e0094, unsigned int 514, unsigned int 0, long
30081299) line 454 + 27 bytes
USER32! 77e71250()
01cb0113()

Comment 1

[(not reading, please use [e-mail] instead)]

here's the asserion I see on the console on unix:

Assertion: "*** Service in hash table but is being deleted. Dangling
pointer
*** in service manager hash table." (cnt > 0 || !serviceFound) at file
nsService

Comment 2

[Doug Turner (:dougt)]

dbragg is the owner.

Comment 3

[dbragg]

The fix is to do an NS_ADDREF(mInstance) in the GetInstance method of the
nsPrefMigration class.  Will check this in if I get approval.

Comment 4

[dbragg]

Hah! I was wrong.  The problem was a NS_RELEASE of the wrong thing.  Now the
destructor for nsPrefMigration has:

if(m_prefs)
  NS_RELEASE(m_prefs);

This decrements the refcount correctly and the Assert goes away.  This was
reviewed by Dan Veditz.

Comment 5

[(not reading, please use [e-mail] instead)]

excellent!  please check that in.

Comment 6

[(not reading, please use [e-mail] instead)]

I tried out your fix, and it worked for me.

I accidentally checked it in, along with a bunch of other changes.

when you update, please verify that I checked in the right thing.

leaving this bug for you to marked fixed, since you fixed it.

nice work.

Comment 7

[dbragg]

Thanks Seth.  And thanks for checking it in.  I had asked for permission last
night but wasn't able to get it checked in before I had to leave.

Marking fixed.

Comment 8

[Grace Bush]

Don,
Will you point me to the file changed so I can verify this?

Thanks,
Grace

Comment 9

[dbragg]

Grace, the file is nsPrefMigration.cpp.  The function is the destructor
nsPrefMigration::~nsPrefMigration()