165867 - crash when visit URL: www.sina.com.cn - Trunk [@ nsBrowserStatusFilter::ProcessTimeout]

Status: RESOLVED FIXED

(SeaMonkey :: UI Design, defect)

Description

[leon.zhang]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; zh-CN; rv:1.0rc2) Gecko/20020512 Netscape/7.0b1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; zh-CN; rv:1.0rc2) Gecko/20020512 Netscape/7.0b1

when visit website: www.sina.com.cn,mozilla crash sometimes.
trunk: 20020819

when crash,status of func calling stack :
nsBrowserStatusFilter::ProcessTimeout() line 289 + 12 bytes
nsBrowserStatusFilter::TimeoutHandler(nsITimer * 0x0506e9b8, void * 0x03af1ac0)
line 308
nsTimerImpl::Fire() line 337 + 17 bytes
nsTimerManager::FireNextIdleTimer(nsTimerManager * const 0x017d08e8) line 579
nsAppShell::Run(nsAppShell * const 0x017a14b0) line 156
nsAppShellService::Run(nsAppShellService * const 0x017c6a38) line 452
main1(int 1, char * * 0x002d6ef8, nsISupports * 0x00000000) line 1509 + 32 bytes
main(int 1, char * * 0x002d6ef8) line 1873 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e77d08()


crash point of code:
at **** of code below

void
nsBrowserStatusFilter::ProcessTimeout()
{
    if (!mListener)
        return;

    if (mDelayedStatus) {
        mDelayedStatus = PR_FALSE;
        mListener->OnStatusChange(nsnull, nsnull, 0, mStatusMsg.get());
    }

    if (mDelayedProgress) {
        mDelayedProgress = PR_FALSE;
****        mListener->OnProgressChange(nsnull, nsnull, 0, 0, mCurProgress,
mMaxProgress);
    }
}

the values of varible:
1) mListener->mRawPtr: 0xdddddddd (invalid memory pointer!)
2) mDelayedStatus: PR_TRUIE--> PR_FALSE

Reproducible: Sometimes

Steps to Reproduce:
1.visit www.sina.com.cn 
2.crash often happens,but not always
3.if not happen, reload again.

Actual Results:  
crash

Comment 1

[leon.zhang]

sorry, crash point should be located at line indicated below:

void
nsBrowserStatusFilter::ProcessTimeout()
{
    if (!mListener)
        return;

    if (mDelayedStatus) {
        mDelayedStatus = PR_FALSE;
****     mListener->OnStatusChange(nsnull, nsnull, 0, mStatusMsg.get());
^^^^^^^^^^Crash here!!!!
    }

    if (mDelayedProgress) {
        mDelayedProgress = PR_FALSE;
        mListener->OnProgressChange(nsnull, nsnull, 0, 0, mCurProgress,
mMaxProgress);
    }
}

Comment 2

[Jay Patel [:jay]]

Adding topcrash+ and testcase keywords since it looks like the reporter has been
able to reproduce this crash at http://www.sina.com.cn .  

According to Talkback data, this is a current topcrasher on the Trunk for Linux
and Windows:

Rank    StackSignature    Count  

15   nsBrowserStatusFilter::ProcessTimeout   13 

 
 	Source File :
/builds/client/linux22/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp
line : 290
 
====================================================================================================
     Count   Offset    Real Signature
[ 4   nsBrowserStatusFilter::ProcessTimeout() 924a1f36 -
nsBrowserStatusFilter::ProcessTimeout() ]
 
     Crash date range: 2002-08-31 to 2002-09-02
     Min/Max Seconds since last crash: 265 - 7488
     Min/Max Runtime: 7488 - 47533
     Keyword List :  
     Count   Platform List 
     4   Linux 2.4.19   
 
     Count   Build Id List 
     4   2002083005
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsBrowserStatusFilter::ProcessTimeout()
[/builds/client/linux22/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp
 line 289] 
	 nsBrowserStatusFilter::TimeoutHandler()
[/builds/client/linux22/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp
 line 308] 
	 nsTimerImpl::Fire()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 341] 
	 handleTimerEvent()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 399] 
	 PL_HandleEvent()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/plevent.c  line 643] 
	 PL_ProcessEventsBeforeID()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/plevent.c  line 1540] 
	 processQueue()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 448] 
	 nsVoidArray::EnumerateForwards()
[/builds/client/linux22/seamonkey/mozilla/xpcom/ds/nsVoidArray.cpp  line 660] 
	 nsAppShell::ProcessBeforeID()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 456] 
	 handle_gdk_event()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsGtkEventHandler.cpp 
line 926] 
	 libgdk-1.2.so.0 + 0x19075 (0x4039d075)  
	 libglib-1.2.so.0 + 0x12ad0 (0x403d0ad0)  
	 libglib-1.2.so.0 + 0x12fb9 (0x403d0fb9)  
	 libglib-1.2.so.0 + 0x13254 (0x403d1254)  
	 libgtk-1.2.so.0 + 0xa880e (0x402d280e)  
	 nsAppShell::Run()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 334] 
	 nsAppShellService::Run()
[/builds/client/linux22/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp
 line 472] 
	 main1()
[/builds/client/linux22/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line
1889] 
	 main()
[/builds/client/linux22/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line
1877] 
	 libc.so.6 + 0x18602 (0x40545602)   
 
 
====================================================================================================
     Count   Offset    Real Signature
[ 2   nsBrowserStatusFilter::ProcessTimeout() c0b545a1 -
nsBrowserStatusFilter::ProcessTimeout() ]
 
     Crash date range: 2002-09-07 to 2002-09-08
     Min/Max Seconds since last crash: 6304 - 28792
     Min/Max Runtime: 7863 - 28792
     Keyword List :  
     Count   Platform List 
     2   Linux 2.4.19   
 
     Count   Build Id List 
     1   2002090721
     1   2002090622
 
     No of Unique Users         2
 
 Stack trace(Frame) 

	 nsBrowserStatusFilter::ProcessTimeout()
[/builds/client/linux22/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp
 line 290] 
	 nsBrowserStatusFilter::TimeoutHandler()
[/builds/client/linux22/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp
 line 309] 
	 nsTimerImpl::Fire()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 368] 
	 handleTimerEvent()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 431] 
	 PL_HandleEvent()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/plevent.c  line 643] 
	 PL_ProcessEventsBeforeID()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/plevent.c  line 1540] 
	 processQueue()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 448] 
	 nsVoidArray::EnumerateForwards()
[/builds/client/linux22/seamonkey/mozilla/xpcom/ds/nsVoidArray.cpp  line 660] 
	 nsAppShell::ProcessBeforeID()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 456] 
	 handle_gdk_event()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsGtkEventHandler.cpp 
line 926] 
	 libgdk-1.2.so.0 + 0x19075 (0x4039e075)  
	 libglib-1.2.so.0 + 0x12ad0 (0x403d1ad0)  
	 libglib-1.2.so.0 + 0x12fb9 (0x403d1fb9)  
	 libglib-1.2.so.0 + 0x13254 (0x403d2254)  
	 libgtk-1.2.so.0 + 0xa880e (0x402d380e)  
	 nsAppShell::Run()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 334] 
	 nsAppShellService::Run()
[/builds/client/linux22/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp
 line 472] 
	 main1()
[/builds/client/linux22/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line
1880] 
	 main()
[/builds/client/linux22/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line
1868] 
	 libc.so.6 + 0x18602 (0x40547602)   
 
 
====================================================================================================
     Count   Offset    Real Signature
[ 1   nsBrowserStatusFilter::ProcessTimeout() 89b8222c -
nsBrowserStatusFilter::ProcessTimeout() ]
 
     Crash date range: 2002-09-06 to 2002-09-06
     Min/Max Seconds since last crash: 15140 - 15140
     Min/Max Runtime: 19589 - 19589
     Keyword List :  
     Count   Platform List 
     1   Linux 2.4.19   
 
     Count   Build Id List 
     1   2002090522
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsBrowserStatusFilter::ProcessTimeout()
[/builds/client/linux22/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp
 line 294] 
	 nsBrowserStatusFilter::TimeoutHandler()
[/builds/client/linux22/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp
 line 308] 
	 nsTimerImpl::Fire()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 341] 
	 handleTimerEvent()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 399] 
	 PL_HandleEvent()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/plevent.c  line 643] 
	 PL_ProcessEventsBeforeID()
[/builds/client/linux22/seamonkey/mozilla/xpcom/threads/plevent.c  line 1540] 
	 processQueue()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 448] 
	 nsVoidArray::EnumerateForwards()
[/builds/client/linux22/seamonkey/mozilla/xpcom/ds/nsVoidArray.cpp  line 660] 
	 nsAppShell::ProcessBeforeID()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 456] 
	 handle_gdk_event()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsGtkEventHandler.cpp 
line 926] 
	 libgdk-1.2.so.0 + 0x19075 (0x4039e075)  
	 libglib-1.2.so.0 + 0x12ad0 (0x403d1ad0)  
	 libglib-1.2.so.0 + 0x12fb9 (0x403d1fb9)  
	 libglib-1.2.so.0 + 0x13254 (0x403d2254)  
	 libgtk-1.2.so.0 + 0xa880e (0x402d380e)  
	 nsAppShell::Run()
[/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp  line 334] 
	 nsAppShellService::Run()
[/builds/client/linux22/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp
 line 472] 
	 main1()
[/builds/client/linux22/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line
1880] 
	 main()
[/builds/client/linux22/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line
1868] 
	 libc.so.6 + 0x18602 (0x40546602)   
 
 
====================================================================================================
     Count   Offset    Real Signature
[ 1   nsBrowserStatusFilter::ProcessTimeout ef49b342 -
nsBrowserStatusFilter::ProcessTimeout ]
[ 1   nsBrowserStatusFilter::ProcessTimeout dcc164ed -
nsBrowserStatusFilter::ProcessTimeout ]
 
     Crash date range: 2002-08-30 to 2002-09-05
     Min/Max Seconds since last crash: 7218 - 25993
     Min/Max Runtime: 7218 - 189078
     Keyword List :  
     Count   Platform List 
     1   Windows NT 4.0 build 1381
     1   Windows 98 4.90 build 73010104
 
     Count   Build Id List 
     1   2002083008
     1   2002083004
 
     No of Unique Users         2
 
 Stack trace(Frame) 

	 nsBrowserStatusFilter::ProcessTimeout
[c:/builds/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp  line 287] 
	 nsTimerManager::FireNextIdleTimer
[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 579] 
	 nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp  line 472] 
	 main1	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1529]  
 
     (10104781)	Comments: Just after I send a pop-up ad flying
 
====================================================================================================
     Count   Offset    Real Signature
[ 1   nsBrowserStatusFilter::ProcessTimeout e02c3db7 -
nsBrowserStatusFilter::ProcessTimeout ]
[ 1   nsBrowserStatusFilter::ProcessTimeout 9d53056b -
nsBrowserStatusFilter::ProcessTimeout ]
 
     Crash date range: 2002-09-02 to 2002-09-05
     Min/Max Seconds since last crash: 65 - 24989
     Min/Max Runtime: 31614 - 127497
     Keyword List :  
     Count   Platform List 
     1   Windows 98 4.10 build 67766446
     1   Windows 95 4.0 build 67306684
 
     Count   Build Id List 
     1   2002090208
     1   2002083008
 
     No of Unique Users         2
 
 Stack trace(Frame) 

	 nsBrowserStatusFilter::ProcessTimeout
[c:/builds/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp  line 292] 
	 nsTimerImpl::Fire	[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp 
line 338] 
	 USER32.DLL + 0x4d8d (0xbff64d8d)  
	 nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp  line 472] 
	 main1	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1529] 
	 main	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1880] 
	 WinMain	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1898] 
	 WinMainCRTStartup()  
	 KERNEL32.DLL + 0x19349 (0xbff89349)  
	 KERNEL32.DLL + 0x191fb (0xbff891fb)  
	 KERNEL32.DLL + 0x17c38 (0xbff87c38)   
 
     (10249183)	Comments: ARRRAAAAAGGGG!!!!!!
 
====================================================================================================
     Count   Offset    Real Signature
[ 1   nsBrowserStatusFilter::ProcessTimeout cea8ef28 -
nsBrowserStatusFilter::ProcessTimeout ]
 
     Crash date range: 2002-09-04 to 2002-09-04
     Min/Max Seconds since last crash: 2491 - 2491
     Min/Max Runtime: 8827 - 8827
     Keyword List :  
     Count   Platform List 
     1   Windows 98 4.10 build 67766446
 
     Count   Build Id List 
     1   2002090308
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsBrowserStatusFilter::ProcessTimeout
[c:/builds/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp  line 287]  
 
 
====================================================================================================
     Count   Offset    Real Signature
[ 1   nsBrowserStatusFilter::ProcessTimeout 5415a327 -
nsBrowserStatusFilter::ProcessTimeout ]
 
     Crash date range: 2002-09-07 to 2002-09-07
     Min/Max Seconds since last crash: 43140 - 43140
     Min/Max Runtime: 43140 - 43140
     Keyword List :  
     Count   Platform List 
     1   Windows 98 4.10 build 67766446
 
     Count   Build Id List 
     1   2002090604
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsBrowserStatusFilter::ProcessTimeout
[c:/builds/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp  line 296] 
	 nsTimerImpl::Fire	[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp 
line 338] 
	 USER32.DLL + 0x580d (0xbfc0580d)  
	 0x0065006c   

Comment 3

[Jay Patel [:jay]]

cc'ing dougt and jaggernaut since it looks like both of them have worked with
nsBrowserStatusFilter.cpp recently.  maybe one of them can shed some light on
this crash.

wasn't sure what component to pick or the right owner, so i'll leave it up to
someone who knows.

Comment 4

[Doug Turner (:dougt)]

I have only touched this file on and after Sept 6.  This bug was written up
prior to that date.

Looking at the code, this crash can occur if ProcessTimeout is ever called on a
non UI thread.  You will race with AddProgressListener in that case.

Comment 5

[jag (Peter Annema)]

Taking

Comment 6

[Sam Emrick]

Humm I think this has a straightforward fix. The line if code
mDelayedStatus = PR_FALSE;
needs be added to
nsBrowserStatusFilter::RemoveProgressListener 
and probably also to
nsBrowserStatusFilter::AddProgressListener
whenever listener comes or goes, need to start from not delayed state.

Comment 7

[jag (Peter Annema)]

Sam: I don't quite see how that fixes this crash.

When you RemoveProgressListener, |mListener = nsnull;|

Then in ProcessTimeout we do |if (!mListener) return;|

darin and I looked at this and we suspect that the timer is executing the
callback function after the filter object has been destroyed. I'm going to try
cancelling the timer from the destructor.

Comment 8

[Darin Fisher]

jag and i looked at this and the problem is that the timer "subsystem" doesn't
own a reference back to the nsBrowserStatusFilter object.  as a result, the
object can be destroyed before the timer fires, and the timer callback will
attempt to dereference a junk memory address.  the patch is trivial... we just
need to call Cancel on mTimer from ~nsBrowserStatusFilter.  jag said he would
write up the patch.

Comment 9

[Brendan Eich [:brendan]]

Can we get this fixed ASAP?  Thanks,

/be

Comment 10

[jag (Peter Annema)]

Attachment: Cancel timer when filter object is destroyed.

I haven't been able to crash my browser on this site, but I hope this patch
fixes it. leon.zhang, can you apply this patch and see if it fixes the problem
for you?

Comment 11

[Darin Fisher]

Comment on attachment 99262 [details] [diff] [review]
Cancel timer when filter object is destroyed.

r/sr=darin

Comment 12

[Peter Van der Beken [:peterv]]

Comment on attachment 99262 [details] [diff] [review]
Cancel timer when filter object is destroyed.

r=peterv

Comment 13

[bobj]

This looks like it is also a problem on the 1.0 branch, right?
If so, we need to get this checked in there too.

Comment 14

[jag (Peter Annema)]

Not really, since this hasn't been landed on the 1.0.x branch yet

Comment 15

[Christian :Biesinger (don't email me, ping me on IRC)]

http://bonsai.mozilla.org/cvslog.cgi?file=mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp
shows that this is already checked in. marking FIXED.

Comment 16

[jag (Peter Annema)]

Reopening. We don't know for sure that this patch fixes the problem. Thanks for
trying to help out, though.

Comment 17

[jag (Peter Annema)]

It seems to have fixed the crash (no more talkback reports for this stack since
the checkin).