171782 - Crash in the download manager - M120B [@ nsDownloadManager::~nsDownloadManager]

Status: VERIFIED FIXED

(SeaMonkey :: Download & File Handling, defect, P1)

Description

[greer]

Starting in the 2002092804 Trunk builds, Talkback data is showing this signature
and stack (below) as a topcrash. I am not seeing a checkin (between 09-27 00h
and 09-28 04h) that looks like it causes this. What am I missing?

Stack Trace:
nsDownloadManager::~nsDownloadManager
[c:/builds/seamonkey/mozilla/xpfe/components/download-manager/src/nsDownloadManager.cpp
line 99]
nsDownloadManager::`scalar deleting destructor'
nsDownloadManager::Release
[c:/builds/seamonkey/mozilla/xpfe/components/download-manager/src/nsDownloadManager.cpp
line 88]
nsSupportsArray::Clear [c:/builds/seamonkey/mozilla/xpcom/ds/nsSupportsArray.cpp
line 560]
nsSupportsArray::DeleteArray
[c:/builds/seamonkey/mozilla/xpcom/ds/nsSupportsArray.cpp line 304]
nsSupportsArray::`vector deleting destructor'
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65]
ReleaseObserverList [c:/builds/seamonkey/mozilla/xpcom/ds/nsObserverService.cpp
line 110]
_hashEnumerateRemove [c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp line 381]
PL_HashTableEnumerateEntries [plhash.c line 430]
nsHashtable::Reset [c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp line 398]
nsObjectHashtable::Reset [c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp
line 926]
nsObjectHashtable::~nsObjectHashtable
[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp line 892]
nsObjectHashtable::`vector deleting destructor'
nsObserverService::`scalar deleting destructor'
nsCOMPtr_base::assign_with_AddRef
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 74]
PL_DHashTableEnumerate [c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c line 602]
0x00e53f30

Comment 1

[greer]

I see two incidents in N7.0 data (which dates back to 08/23) so this one has
been lurking a while. Adding qawanted. I will email users to see if they have
specific steps to reproduce.

Comment 2

[timeless]

my guess is that it's a shutdown crash, i looked at it earlier and couldn't find
anything to do about it.

suppose nsDownloadManager was already deleted before shutdown, then this crash
might make sense, but i can't find anything that could make that happen

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

A related stack from Mac talkback from a 2002090603 build:

Stack Trace:
.__ptr_glue
nsDownloadManager::Release() [nsDownloadManager.cpp line 88]
nsSupportsArray::Clear() [nsSupportsArray.cpp line 559]
nsSupportsArray::DeleteArray() [nsSupportsArray.cpp line 303]
nsSupportsArray::~nsSupportsArray() [nsSupportsArray.cpp line 146]
nsSupportsArray::Release() [nsSupportsArray.cpp line 238]
nsCOMPtr_base::~nsCOMPtr_base() [nsCOMPtr.cpp line 64]
nsObserverList::~nsObserverList() [nsObserverList.cpp line 57]
ReleaseObserverList() [nsObserverService.cpp line 109]
_hashEnumerateRemove() [nsHashtable.cpp line 376]
NSPR20 + 0x1290 (0x3d452460)
nsHashtable::Reset() [nsHashtable.cpp line 397]
nsObjectHashtable::Reset() [nsHashtable.cpp line 925]
nsObjectHashtable::~nsObjectHashtable() [nsHashtable.cpp line 891]
nsObserverService::~nsObserverService() [nsObserverService.cpp line 84]
nsObserverService::Release() [nsObserverService.cpp line 72]
nsCOMPtr_base::assign_with_AddRef() [nsCOMPtr.cpp line 73]
FreeServiceContractIDEntryEnumerate() [nsComponentManager.cpp line 1926]
PL_DHashTableEnumerate() [pldhash.c line 601]
nsComponentManagerImpl::FreeServices() [nsComponentManager.cpp line 1939]
NS_ShutdownXPCOM() [nsXPComInit.cpp line 718]
main() [nsAppRunner.cpp line 1876]
.__start

Build: 2002090603 CrashDate: 2002-09-10 UptimeMinutes: 800 Total: 5438
OS: MacOS version 9.2.2
URL:
Comment: It crashed while I was asleep
BBID: 10680642 

Both stacks look like an attempt to release a download manager that's already
been deleted (and partly mangled, in different ways, probably due to differences
in the allocators between the systems).

Comment 4

[greer]

This is now the topcrasher on M1.2B with over 1200 incidents and more than 1100
unique users. Blake/David can you take a closer look at this one?

Here are the registers:

EAX: 00000000 EBX: 03a681e0 ECX: 03a681d0 EDX: 61916574
ESI: 03a681d0 EDI: 007a7d90 ESP: 0064fbe4 EBP: 007bd200
EIP: 6190392e cf pf af zf sf of IF df nt RF vm   IOPL: 0
CS: 015f DS: 0167 SS: 0167 ES: 0167 FS: 3997 GS: 0000

Code Around the PC: 
6190392e 8b08             mov     ecx,[eax]  <== **Crashes here**.
61903930 50               push    eax
61903931 ff5138           call    dword ptr [ecx+0x38]
61903934 a1600a9261       mov     eax,[61920a60]
61903939 33ff             xor     edi,edi
6190393b 3bc7             cmp     eax,edi
6190393d 740c             jz      6190394b
6190393f 8b08             mov     ecx,[eax]
61903941 50               push    eax
61903942 ff5108           call    dword ptr [ecx+0x8]
61903945 893d600a9261     mov     [61920a60],edi
6190394b a1740af162       mov     eax,[62f10a74]

Comment 5

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

That shows the crash is because |gRDFService| is null.

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I see two things that could cause that:
  1) Somebody creates a download manager and doesn't call Init
  2) There's another file somewhere that also has a non-static |gRDFService|
global variable.  (I don't see any others -- there are a bunch of class-statics
and a bunch of file-statics.)

Comment 7

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: patch

This fixes both problems that I noticed.  Hopefully this will fix it...

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Taking.

Comment 9

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: patch

Slightly clearer comment, and explicitly note |= nsnull| in case some compilers
don't know that they're supposed to do that anyway (although null need not be
zero, technically...).

Comment 10

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: patch

Yet more bulletproofing: enforce service-ness in non-DEBUG builds, and assert
in DEBUG builds too.  (bz noticed this potential problem, although there don't
seem to be any callers that do this either)

Comment 11

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: patch

Fix an == vs. != error.

Comment 12

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 103657 [details] [diff] [review]
patch

sr=bzbarsky

Comment 13

[Blake Ross]

Comment on attachment 103657 [details] [diff] [review]
patch

r=blake

Comment 14

[Matthias Versen [:Matti]]

*** Bug 176047 has been marked as a duplicate of this bug. ***

Comment 15

[Matthias Versen [:Matti]]

nice informations from the dupe:
The reporter crashes if he close his connection (dialup) and close mozilla after
that (and possible while he is downloading)

Comment 16

[Christopher Blizzard (:blizzard)]

Comment on attachment 103657 [details] [diff] [review]
patch

a=blizzard on behalf of drivers for 1.2final

Comment 17

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Comment on attachment 103657 [details] [diff] [review]
patch

Checked in, 2002-10-23 19:19 PDT.

Comment 18

[Brian Ryner (not reading)]

> 1) Somebody creates a download manager and doesn't call Init

The factory contructor ensures that Init is called, so I'm not sure how that
could happen.

Is it possible for the nsDownloadManager to still be alive when the service
manager is shut down? That could cause gRDFService to be a dangling pointer.

Comment 19

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

> > 1) Somebody creates a download manager and doesn't call Init
> 
> The factory contructor ensures that Init is called, so I'm not sure how that
> could happen.

Yeah, I realized that (and thus changed the comment between two versions of the
patch to mention early failure of init rather than failure to call entirely).

> Is it possible for the nsDownloadManager to still be alive when the service
> manager is shut down? That could cause gRDFService to be a dangling pointer.

It won't be dangling since it's an owning pointer.

Comment 20

[Diethelm Schneider]

I just want to assigne, that in mozilla 1.a Downloadmanger worked fine, but in
mozilla1.2b, it crashes.
Even if you try contextmenue 'save target link', this only opens dialog 'Save
as', but after OK it doesn`t save anything.

So with mozilla 1.2b to get files you have to use other browser.

Comment 21

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Marking FIXED.  No reports in 10-24 builds.

Comment 22

[Jay Patel [:jay]]

v.fixed per talkback data...no recent crashes on the mozillatrunk.

Comment 23

[Jay Patel [:jay]]

Adding  Trunk M120B to summary for future reference.  This was a topcrasher on
the Trunk and the #1 topcrasher with Mozilla 1.2 Beta.

Comment 24

[Jan Carpenter]

reopening for M120B
changing OS to NT (crashes on NT and 98)

     Crash date range: 2002-11-14 to 2002-11-24
     Keyword List : browser(12), click(6), crash(7), download(12), load(15),
log(4), time(7),  
     Count   Platform List 
     25   Windows 98 4.10 build 67766446
     5   Windows NT 4.0 build 1381
     4   Windows 98 4.10 build 67766222
     3   Windows 98 4.90 build 73010104
 
     Count   Build Id List 
     37   2002101612
 
     No of Unique Users        33
 
 Stack trace(Frame) 

	 nsDownloadManager::~nsDownloadManager
[c:/builds/seamonkey/mozilla/xpfe/components/download-manager/src/nsDownloadManager.cpp
 line 99] 
	 nsDownloadManager::`scalar deleting destructor'  
	 nsDownloadManager::Release
[c:/builds/seamonkey/mozilla/xpfe/components/download-manager/src/nsDownloadManager.cpp
 line 88] 
	 nsSupportsArray::Clear
[c:/builds/seamonkey/mozilla/xpcom/ds/nsSupportsArray.cpp  line 560] 
	 nsSupportsArray::DeleteArray
[c:/builds/seamonkey/mozilla/xpcom/ds/nsSupportsArray.cpp  line 304] 
	 nsSupportsArray::`vector deleting destructor'  
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 65] 
	 ReleaseObserverList
[c:/builds/seamonkey/mozilla/xpcom/ds/nsObserverService.cpp  line 110] 
	 _hashEnumerateRemove	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp 
line 381] 
	 PL_HashTableEnumerateEntries	[plhash.c  line 430] 
	 nsHashtable::Reset	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp  line
398] 
	 0x00788a10  
	 nsSupportsHashtable::`vector deleting destructor'  
	 nsValueArray::Capacity
[c:/builds/seamonkey/mozilla/xpcom/build/../ds\nsValueArray.h  line 75] 
	 nsIDKey::`vector deleting destructor'  
	 nsValueArray::Capacity
[c:/builds/seamonkey/mozilla/xpcom/build/../ds\nsValueArray.h  line 75] 
	 nsFileSpecImpl::AddRef
[c:/builds/seamonkey/mozilla/xpcom/io/nsFileSpecImpl.cpp  line 48] 
	 0xf98b5708   
 
     (14281196)	URL: sbcglobal.prodigy.net
     (14275407)	Comments: Closing the browser.
     (14271783)	URL:
http://www.cisco.com/global/FR/cisco_library/sources/technos/guide_technos_complet.pdf
     (14271783)	Comments: Save as... for a PDF file (right click on the link)
     (14229837)	Comments: Exiting program.  Got grey windows box with error in
APPCOMPS.DLL?
     (14202007)	URL:
http://www.ktq.de/standardFrameset/index.html?/Homepage/Berichte/index.html
     (14202007)	Comments: Trying to download a pdf-file from the above website
     (14192110)	URL: www.azstarnet.com
     (14116980)	URL: Moz1.2b crash while closing it
     (14109483)	URL: www.hotmail.com
     (14109483)	Comments: I closed the mozilla without logout the service...  
     (14104527)	URL: http://www.spiegel.de
     (14094946)	Comments: Hit Alt-F4 to close the browser/window.  Only one
window open at the time  but others (up to 4) open earlier.
     (14066487)	URL: aircanada.com
     (14066487)	Comments: checking fares
     (14015926)	Comments: Attempting to download files by clicking on them. 
     (14013972)	Comments: Closing pop-up windows and shutting down
     (13990415)	Comments: i was using mozilla browser and couldn't save web
pages (they wouldn't download and the download manager wouldn't appear). so i
thought i'd report that as a bug. i created a new bugzilla account but couldn't
log in with the password sent to me. i'll check
     (13978870)	Comments: Download is not possible
     (13963609)	Comments: Save image as (right click on image) doesn't work  it
appears to work and no error message is generated but nothing is saved....   
Address bar sometimes goes into seach mode instead of sending to to the new
www.address  very annoying  
     (13951223)	Comments: Closing Mozilla  several other programs running at the
same time  including Winamp  mIRC and IE 6.0
     (13947513)	URL: www.johnwooden.com
     (13947513)	Comments: Closing the browser (Mozilla 1.2b)
 

Comment 25

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

What?  You're reopening because this crash is still occurring in the 1.2beta
release, even though this bug was fixed after than release?  FIXED.

Comment 26

[Matthias Versen [:Matti]]

*** Bug 183504 has been marked as a duplicate of this bug. ***

Comment 27

[Chris Petersen]

Verified in the 2003-01-03-08 trunk build under Windows XP.