255494 - selecting tools/options crashes browser

Status: RESOLVED FIXED

(Other Applications Graveyard :: ChatZilla, defect)

Description

[jonathan chetwynd]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

This is a general report of problems with 0.9 series firefox

in particular 0.9.1 with chatzilla f (latest) repeatedly caused crashes of
firefox when selecting tools options. preferences is greyed out.

without this chatzilla is very tedious to use, so should be critical

upgrading firefox to 0.9.3 was not feasible as whilst the application launches,
and one can access the toolbar, a browser window isn't opened and file new
window doesn't perform.

I am using firefox 0.8 with earlier chatzilla fine on the same machine

Reproducible: Always
Steps to Reproduce:
1. launch firefox
2. open irc channel
3. select tools options

Actual Results:  
application crashes

Expected Results:  
hopefully offer means to configure application

NB: preferences is greyed out

Comment 1

[James Ross]

This is Tools > Options *in* ChatZilla, right? Does it happen if you open the
options from the browser's Tools > Extensions window?

Comment 2

[Asaf Romano (gone)]

(In reply to comment #1)

Yep

Comment 3

[Mark Harviston]

i have this same bug, however firefox remains usable, the toolbar still exists,
and a window launches and such, firefox as a whole acts normal.
it also happens when I go Tool>extensions and click on the little check next to
Chatzilla, or if i go Tools>Options from within Chatzilla.
I have used chatzilla on version 0.9 before, i am checking to see if the bug is
fixed if i use version 0.9.64a. But it does exist in the e and f versions(and
presumably g) of Chatzilla.

Comment 4

[Jason Collins]

I have the same problem, using Firefox 0.10.1 and Chatzilla 0.9.65.

I've sent several talkback incidents, I'll start marking them with this bug number.

Comment 5

[jonathan chetwynd]

I have given up on using chatzilla, until this bug is fixed.

so please let us know, when it is...

Comment 6

[Jason Collins]

Nuking the contents of ~/Library/Application Support/Firefox and starting from
scratch appears to remove this bug.  I can now access Chatzilla again. 
Hopefully I can isolate the particular cause for this bug, but it may be due to
the many Firefox versions I've been using and cruft in the profile.  I have
saved the profile that breaks ChatZilla but it contains personal information
that I'd have to strip before attaching here.

If someone can suggest things to look for or try, I can investigate.

Note also, many things do _not_ seem to remove this bug, however, including:

1) uninstall and reinstall of chatzilla
2) deleting the chrome subdirectory of the in-use Firefox profile
3) Removal of lines containing chatzilla from prefs.js in the Firefox profile

Comment 7

[James Ross]

If someone could try this special version of ChatZilla 0.9.65, and see if it
still crashes, I'd be very grateful:

    http://twpol.dyndns.org/temp/chatzilla-0.9.65-mac.xpi

Is it the same as normal 0.9.65, except that it has two lines commented out
(based on TB1296477 and TB1296635 information) and is identified by the version
"0.9.65-mac". The preferences window won't nessessarily perform all of it's
magic, but basic functionality will be ok (I'm only really interested in what's
triggering the crash).

Comment 8

[Aron Beal]

(In reply to comment #7)
> If someone could try this special version of ChatZilla 0.9.65, and see if it
> still crashes, I'd be very grateful:
...(I'm only really interested in what's
> triggering the crash).

I've installed your version on my system (Firefox 1.0pr, OSX 10.3.5), and the
changes you made appear to have worked.  As you say, the options menu is now the
only choice under Tools, but it successfully brings up the options menu for
Chatzilla, and a simple font change worked nicely.  Willing to test this
installation further on request.

Aron

Comment 9

[James Ross]

Thanks to Caelion in #chatzilla I was able to test a different change... instead
of commenting out the line that changes the pref (132/133), I changed 130 (and
repeated similar lines) to:

this.prefManager.onPrefChanged = function(){};

(http://lxr.mozilla.org/mozilla/source/extensions/irc/xul/content/config.js#113)

The problem is that deleting the function means the callback code then tries to
call a undefined value on line 69
(http://lxr.mozilla.org/mozilla/source/extensions/irc/js/lib/pref-manager.js#61).
Naturally I would expect such a screw-up to just spew a JS error to the JS
console. Apparently it crashes instead. :)

Comment 10

[James Ross]

Hardware/OS --> All.

Caelian is on FreeBSD/i386 6.0-CURRENT where it crashes too.

Stacks may be found in (from Mac):
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=1296635
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=1296477

Comment 11

[James Ross]

From my intial investigations on windbg/XULrunner/debug/Win32, it looks like the
pref observer list memory is being freed /during/ the callback. Very bad mojo.

I'm still unsure why it's not crashing on Win32, but it does use the HeapFree()
0xFEEEFEEE code so maybe that's cleverly ignored somehow.

Comment 12

[James Ross]

Aah, this is a good one.

What's happening is the code is not stopping the pref changed observers being
called, and they are removing the observer that's currently being called!

Lines 842 and 843 are freeing the observer entry being run in
http://lxr.mozilla.org/mozilla/source/modules/libpref/src/prefapi.cpp#821

The question is, how can we guard against this? Do we even want to?

ChatZilla's code will obviously be fixed to actually prevent it try to remove
the observer in this case (http://twpol.dyndns.org/temp/chatzilla-0.9.66-mac.xpi
has that proper fix).

Comment 13

[James Ross]

Attachment: Native stack at PR_Free

Comment 14

[James Ross]

Attachment: JavaScript stack at PR_Free

Comment 15

[James Ross]

Attachment: Correctly prevent pref observer callbacks in options window

The old code worked before the Pref Manager's observer system was changed. It
works no more, and is causing the crash. Replacing the function with a dummy
has been tested to stop the crash on FreeBSD, and stops the 'free while in use'
in my debugger on Win32.

Comment 16

[Robert Ginda]

Comment on attachment 163146 [details] [diff] [review]
Correctly prevent pref observer callbacks in options window

r=rginda on the chatzilla workaround, but, is there going to be another bug for
the "real" prbolem?

Comment 17

[James Ross]

Yes... I think they'll have to be. Will bug 265788 do?

Comment 18

[Robert Ginda]

yeah, that looks great.

Comment 19

[James Ross]

Checked in --> FIXED. The pref system bug 265788 will deal with the crash itself.