253973 - after heavy browsing, Firefox crashes upon exiting [@ nsHashtable::Reset ]

Status: RESOLVED DUPLICATE of bug 200119

(Firefox :: General, defect)

Description

[neguinho]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a3) Gecko/20040801 Firefox/0.9.1+
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a3) Gecko/20040801 Firefox/0.9.1+

After some heavy usage of Firefox, on quitting Firefox with tabs open, the
illegal operation is given:

FIREFOX caused a general protection fault in module DDEML.DLL at 0002:00002161. 

The error message is given on one of those '16-bit' error message (white window,
Ignore/Close buttons), not on a normal Win32 illegal operation dialog.

Reproducible: Couldn't Reproduce
Steps to Reproduce:
1. Do some heavy usage of Firefox, open big images, pages with Java... just
don't close tabs
2. Close it *without closing any tabs*
3. When returning to the Windows desktop, Firefox may crash.

Actual Results:  
Firefox crashed with this illegal operation. This isn't much of a problem as no
data is lost at all.

Expected Results:  
It should have closed cleanly.

I was using the default FireFox theme, FireFox running on a 233MHz Pentium with
64MB RAM and 6GB hard drive, on Windows 98 SE.

Comment 1

[Adam Hauner]

neguinho: Could you provide TalkBack incident ID?

Comment 2

[David Cornish]

Same thing here.  I turned off talkbalk it was happening so often.  I'll
re-enable talkback and post some incidents from my Windows XP machine. 

Comment 3

[David Cornish]

talkback ids for some instances today and yesterday on my machine
TB733160W
TB734615Y
TB742321K

Comment 4

[Adam Hauner]

All incidents have similar stack:
0x026632d4
nsHashtable::Reset 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/xpcom/ds/nsHashtable.cpp,
line 336]
nsHashtable::Reset 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/xpcom/ds/nsHashtable.cpp,
line 322]
nsObserverService::NotifyObservers 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/xpcom/ds/nsObserverService.cpp,
line 210]
nsXREDirProvider::DoShutdown 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/toolkit/xre/nsXREDirProvider.cpp,
line 495]
ScopedXPCOMStartup::~ScopedXPCOMStartup 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 880]
main 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

Should be related to bug 200119, but stack is a little bit different.

Comment 5

[David Cornish]

A few more talkbacks in case that helps.  I'm turning off TalkBack now as on a
dial-up it's really frustrating to keep submitting these talkbacks.

TB742391W TB749543Q TB749618Q TB749761K TB749766H TB749774W TB772107Z TB772162M
TB788113Z TB788116H TB788166X TB788755X TB789145E

Comment 6

[timeless]

*** Bug 266130 has been marked as a duplicate of this bug. ***

Comment 7

[David Cornish]

I wiped the profile folder (though I copied back a couple of files, like
bookmarks.html and cookies.txt) and this solved the problem for me.

Comment 8

[timeless]

*** Bug 273605 has been marked as a duplicate of this bug. ***

Comment 9

[timeless]

*** Bug 273605 has been marked as a duplicate of this bug. ***

Comment 10

[Frank Wein [:mcsmurf]]

*** Bug 279921 has been marked as a duplicate of this bug. ***

Comment 11

[Chris January]

Same problem here with FireFox 1.01 on Windows XP:
Talkback incident IDs:
4382154
4382879
4404991
The bug occurs about 75% of the time I close the browser.

Comment 12

[Adam Hauner]

All look similar as previous:
0x013551e5
clearHashEntry 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpcom/ds/nsHashtable.cpp,
line 81]
nsHashtable::Reset 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpcom/ds/nsHashtable.cpp,
line 336]
nsHashtable::Reset 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpcom/ds/nsHashtable.cpp,
line 322]
nsObserverService::NotifyObservers 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpcom/ds/nsObserverService.cpp,
line 210]
nsXREDirProvider::DoShutdown 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/toolkit/xre/nsXREDirProvider.cpp,
line 501]
ScopedXPCOMStartup::~ScopedXPCOMStartup 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 783]
main 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 13

[Chris January]

I have about a dozen talkback incidents caused by this bug now.
It would seem the problem occurs at this line in
/mozilla/xpcom/ds/nsHashtable.cpp (clearHashEntry):
delete hashEntry->key;
So my guess is either the key's virtual table is corrupted or a class does not
have a virtual deconstructor when it should do.

Comment 14

[Jesse Morgan]

I also had this problem for awhile. After reading this I played around with my
profile and got it to work by just deleteing the cache files, not the whole profile

Comment 15

[Henrik Gemal]

dupe of bug 200119 ?

Comment 16

[Wayne Mery (:wsmwk)]

reporter is gone. no crashes on talkback. duping as suggested makes sense