183069 - trunk topcrash when quitting [@ nsPrefBranch::RemoveObserver]

Status: VERIFIED FIXED

(SeaMonkey :: Preferences, defect)

Description

[Jan Carpenter]

This stack signature is a topcrasher for trunk

Rank    StackSignature    Count  

2   nsPrefBranch::RemoveObserver   222 

 
 	Source File : c:/builds/seamonkey/mozilla/modules/libpref/src/nsPrefBranch.cpp
line : 723
 
====================================================================================================
     Count   Offset    Real Signature
[ 60   nsPrefBranch::RemoveObserver 213c043a - nsPrefBranch::RemoveObserver ]
[ 58   nsPrefBranch::RemoveObserver 90cf8732 - nsPrefBranch::RemoveObserver ]
[ 17   nsPrefBranch::RemoveObserver b0e40fcf - nsPrefBranch::RemoveObserver ]
[ 13   nsPrefBranch::RemoveObserver 6a3b2dbd - nsPrefBranch::RemoveObserver ]
[ 9   nsPrefBranch::RemoveObserver 137fc3e2 - nsPrefBranch::RemoveObserver ]
[ 8   nsPrefBranch::RemoveObserver 711320c5 - nsPrefBranch::RemoveObserver ]
[ 7   nsPrefBranch::RemoveObserver a70ea6ef - nsPrefBranch::RemoveObserver ]
[ 7   nsPrefBranch::RemoveObserver 1d08f2af - nsPrefBranch::RemoveObserver ]
[ 6   nsPrefBranch::RemoveObserver 252fd912 - nsPrefBranch::RemoveObserver ]
[ 3   nsPrefBranch::RemoveObserver e98b696d - nsPrefBranch::RemoveObserver ]
[ 2   nsPrefBranch::RemoveObserver f2a36415 - nsPrefBranch::RemoveObserver ]
[ 2   nsPrefBranch::RemoveObserver 34757af8 - nsPrefBranch::RemoveObserver ]
 
     Crash date range: 2002-11-26 to 2002-12-01
     Min/Max Seconds since last crash: 79 - 166802
     Min/Max Runtime: 90 - 590056
     Keyword List : browser(8), crash(8), install(4), shut(4),  
     Count   Platform List 
     102   Windows NT 5.0 build 2195
     90   Windows NT 5.1 build 2600
 
     Count   Build Id List 
     53   2002112607
     33   2002113004
     26   2002112808
     23   2002112908
     14   2002112804
     14   2002112708
     13   2002112704
     10   2002120108
     3   2002112904
     2   2002120104
     1   2002112606
 
     No of Unique Users       135
 
 Stack trace(Frame) 

	 nsPrefBranch::RemoveObserver
[c:/builds/seamonkey/mozilla/modules/libpref/src/nsPrefBranch.cpp  line 723] 
	 nsPrefService::RemoveObserver
[c:/builds/seamonkey/mozilla/modules/libpref/src/nsPrefService.cpp  line 282] 
	 nsDOMWindowController::~nsDOMWindowController
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp  line 6044] 
	 nsDOMWindowController::`scalar deleting destructor'  
	 nsDOMWindowController::Release
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp  line 6014] 
	 nsPrefBranch::freeObserverList
[c:/builds/seamonkey/mozilla/modules/libpref/src/nsPrefBranch.cpp  line 814] 
	 nsPrefBranch::Observe
[c:/builds/seamonkey/mozilla/modules/libpref/src/nsPrefBranch.cpp  line 758] 
	 nsObserverService::NotifyObservers
[c:/builds/seamonkey/mozilla/xpcom/ds/nsObserverService.cpp  line 213] 
	 NS_ShutdownXPCOM	[c:/builds/seamonkey/mozilla/xpcom/build/nsXPComInit.cpp 
line 694] 
	 main	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1915] 
	 WinMain	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1925] 
	 WinMainCRTStartup()  
	 KERNEL32.dll + 0x2847c (0x77ea847c)   
 
     (14609637)	Comments: Exiting Mozilla aftwer installing and selecting a new
theme.  Theme was "Glightspeed" from http://deskmod.com
     (14607314)	Comments: closing last page of browser.  Just installed latest
Mozilla version. (1.3a; Gecko/20021201)
     (14603103)	Comments: Closing browser.
     (14592877)	Comments: just closed it after surfing
     (14589533)	Comments: Closing the browser.
     (14584961)	URL: theregister.co.uk
     (14584804)	Comments: Just exiting.
     (14577632)	URL: komodo.mozilla.org/random
     (14577632)	Comments: click the choffmans menu-link in Mozilla    running
random page loader test for 20 pages or  so (see url)  opening a few windows  by
clicking the Quick Launch icon  closing everything (all Mozilla windows)  *boom*
     (14575142)	URL: Extremetech.com
     (14575142)	Comments: I just closed Mozilla :-/
     (14574727)	URL: www.anandtech.com
     (14574727)	Comments: Was just closing two open windows of the browser and
the error appeared.
     (14573146)	Comments: closing mail&news
     (14571707)	Comments: was browsing for like an hour  then quit  *boom*    I
had been browsing:    random page loader test  ie komodo.mozilla.org (browser
buster)  www.google.org  www.newz.dk  www.brygge.net
     (14540918)	URL:
http://www.ancestry.com/search/io/plugin.htm?image/x-mrsid-image
     (14540918)	Comments: Trying to install MrSID Browser Plug-in 1.3.
     (14537596)	URL: www.neopets.com
     (14537596)	Comments: logging out of the site after some errors in certain
parts where I can win items.
     (14533325)	URL: http://www.telcordia.com
     (14526876)	Comments: closing it
     (14514509)	URL: using telefon-treff.de-forum
     (14514509)	Comments: I was closing Mozilla when error occured
     (14513788)	URL: www.sina.com
     (14513788)	Comments: When I close Mozilla  it crashed and return a bug
     (14513118)	Comments: Changing themes
     (14512514)	Comments: crash on shutdown
     (14511858)	Comments: crash on quit
     (14504270)	URL: http://news.bbc.co.uk
     (14504270)	Comments: page was displayed fine. I read it  and then closed
the browser  it crashed
     (14500895)	Comments: closed mozilla mail
     (14496087)	Comments: closing the browser
     (14493882)	URL: www.tweakers.net
     (14492667)	Comments: Just shut down mozilla
     (14490483)	Comments: XPCOM:EventReceiver on exit
     (14485737)	Comments: I was reading bug 159494 and as a result linked to
uabar.mozdev.org for the user-agent spoofing XPI.    I installed the XPI and
closed Moz. It then crashed.    I also earlier added a comment on bug 182433.
This is to do with a complex German site. It
     (14485737)	Comments:  think it's likely to have caused the problem.
     (14485449)	Comments: shutting down
     (14482416)	Comments: I wasn't doing anything with Mozilla. Only Quickstart
was running.
     (14468657)	URL: http://www.pigwheels.com/
     (14456652)	Comments: closing downloadmanager  
     (14453617)	Comments: closing down quick launcher
     (14449867)	Comments: crash on exit
     (14431853)	Comments: Crash on shutdown  
     (14426016)	Comments: crash on exit.

Comment 1

[Andrew Schultz]

this bug is 6 days old and not reproducible and so not eligible for zt4newcrash

Comment 2

[timeless]

*** Bug 183408 has been marked as a duplicate of this bug. ***

Comment 3

[Christopher Aillon (sabbatical, not receiving bugmail)]

Attachment: Proposed patch

Comment 4

[timeless]

use a weak observer

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 108171 [details] [diff] [review]
Proposed patch

r=bzbarsky; please have jst sr...

Comment 6

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 108171 [details] [diff] [review]
Proposed patch

timeless gave r= on irc.

Comment 7

[Christopher Aillon (sabbatical, not receiving bugmail)]

Attachment: new patch after talking with jst

Comment 8

[Johnny Stenback (:jst)]

Comment on attachment 108181 [details] [diff] [review]
new patch after talking with jst

-	     NS_RELEASE(pCallback->pObserver);
-	     nsMemory::Free(pCallback);
	     mObservers->RemoveElementAt(i);
	     mObserverDomains.RemoveCStringAt(i);

Add a comment above these two lines saying that this needs to happen to avoid
an observer from removing itself while it's being removed.

+	     NS_RELEASE(pCallback->pObserver);
+	     nsMemory::Free(pCallback);

...

+	   mObservers->ReplaceElementAt(nsnull, i);

Same here, add a comment saying that this observer needs to be removed from
mObservers to avoid having the observer try to remove what we're in the process
of removing right now.

	   PREF_UnregisterCallback(pref, NotifyObserver, pCallback);
	   NS_RELEASE(pCallback->pObserver);
	   nsMemory::Free(pCallback);

sr=jst

Comment 9

[Christopher Aillon (sabbatical, not receiving bugmail)]

Jst got the sherrif (#mozilla) to approve this landing into the closed tree, and
it was done.  Fixed.

Comment 10

[sairuh (rarely reading bugmail)]

i haven't seen this for a while...