26608 - occasional crash when exiting.

Status: VERIFIED WORKSFORME

(Core :: Networking: Cache, defect, P3)

Description

[(not reading, please use [e-mail] instead)]

I'm seeing this on exit.  we are accessing a null pointer.  

I've checked in a bullet proofing fix.

Index: nsWebShellWindow.cpp
===================================================================
RCS file: /cvsroot/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,v
retrieving revision 1.263
diff -r1.263 nsWebShellWindow.cpp
2179c2179
<         if
(NS_SUCCEEDED(docViewer->GetPresContext(*getter_AddRefs(presContext)))) {
---
>         if (docViewer &&
NS_SUCCEEDED(docViewer->GetPresContext(*getter_AddRefs(presContext)))) {


#0  0x405ad47f in nsWebShellWindow::ExecuteCloseHandler (this=0x88aeff0) at
nsWebShellWindow.cpp:2179
#1  0x405a4ba9 in nsWebShellWindow::HandleEvent (aEvent=0xbfffa5f8) at
nsWebShellWindow.cpp:469
#2  0x4071095b in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#3  0x40717833 in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#4  0x407da719 in ?? () from /usr/lib/libgtk-1.2.so.0
#5  0x40807fdd in ?? () from /usr/lib/libgtk-1.2.so.0
#6  0x40807422 in ?? () from /usr/lib/libgtk-1.2.so.0
#7  0x40805575 in ?? () from /usr/lib/libgtk-1.2.so.0
#8  0x4083a77c in ?? () from /usr/lib/libgtk-1.2.so.0
#9  0x407d9700 in ?? () from /usr/lib/libgtk-1.2.so.0
#10 0x4070281b in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#11 0x4088400b in ?? () from /usr/lib/libgdk-1.2.so.0
#12 0x408b1be6 in ?? () from /usr/lib/libglib-1.2.so.0
#13 0x408b21a1 in ?? () from /usr/lib/libglib-1.2.so.0
#14 0x408b2254 in ?? () from /usr/lib/libglib-1.2.so.0
#15 0x406f780d in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#16 0x405aa2fd in nsWebShellWindow::ShowModalInternal (this=0x86071f8) at
nsWebShellWindow.cpp:1456
#17 0x405aa0ed in nsWebShellWindow::ShowModal (this=0x86071f8) at
nsWebShellWindow.cpp:1418
#18 0x405aa57a in nsWebShellWindow::ShowModally (this=0x86071f8, aPrepare=0) at
nsWebShellWindow.cpp:1494
#19 0x40474744 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#20 0x40473ab0 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#21 0x40466798 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#22 0x4008e667 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#23 0x4009d071 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#24 0x4008e6c5 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#25 0x4009d071 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#26 0x4008e6c5 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#27 0x4008e9fc in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#28 0x40062927 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#29 0x4045e371 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#30 0x4049c2d9 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#31 0x410bb7d9 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#32 0x410bbdba in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#33 0x40af85bb in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/librdf.so
#34 0x410c2564 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#35 0x410c0168 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#36 0x41113360 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#37 0x4155d919 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorview.so
#38 0x41569b23 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorview.so
#39 0x4155b054 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorview.so
#40 0x4071095b in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#41 0x4071058c in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#42 0x40710a15 in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#43 0x40711f7f in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#44 0x40716f85 in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#45 0x4070280d in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#46 0x4088400b in ?? () from /usr/lib/libgdk-1.2.so.0
#47 0x408b1be6 in ?? () from /usr/lib/libglib-1.2.so.0
#48 0x408b21a1 in ?? () from /usr/lib/libglib-1.2.so.0
#49 0x408b2254 in ?? () from /usr/lib/libglib-1.2.so.0
#50 0x406f780d in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#51 0x405aa2fd in nsWebShellWindow::ShowModalInternal (this=0x88aeff0) at
nsWebShellWindow.cpp:1456
#52 0x405aa0ed in nsWebShellWindow::ShowModal (this=0x88aeff0) at
nsWebShellWindow.cpp:1418
#53 0x405aa57a in nsWebShellWindow::ShowModally (this=0x88aeff0, aPrepare=0) at
nsWebShellWindow.cpp:1494
#54 0x40474744 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#55 0x40473ab0 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#56 0x40466798 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#57 0x4008e667 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#58 0x4009d071 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#59 0x4008e6c5 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#60 0x4009d071 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#61 0x4008e6c5 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#62 0x4008e9fc in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#63 0x40062927 in ?? () from /builds/sspitzer/mozilla/dist/bin/libmozjs.so
#64 0x4045e371 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#65 0x4049c2d9 in ?? () from /builds/sspitzer/mozilla/dist/bin/libjsdom.so
#66 0x410bb7d9 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#67 0x410bd63a in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#68 0x40af85bb in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/librdf.so
#69 0x412f0072 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#70 0x412ed119 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#71 0x411132f4 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorhtml.so
#72 0x4155d919 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorview.so
#73 0x4155d8ad in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorview.so
#74 0x41569b23 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorview.so
#75 0x4155b054 in ?? () from
/builds/sspitzer/mozilla/dist/bin/components/libraptorview.so
#76 0x4071095b in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#77 0x4071058c in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#78 0x40710a15 in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#79 0x40711f7f in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#80 0x40716f85 in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#81 0x4070280d in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#82 0x4088400b in ?? () from /usr/lib/libgdk-1.2.so.0
#83 0x408b1be6 in ?? () from /usr/lib/libglib-1.2.so.0
#84 0x408b21a1 in ?? () from /usr/lib/libglib-1.2.so.0
#85 0x408b2341 in ?? () from /usr/lib/libglib-1.2.so.0
#86 0x407d9209 in ?? () from /usr/lib/libgtk-1.2.so.0
#87 0x406f7787 in ?? () from /builds/sspitzer/mozilla/dist/bin/libwidget_gtk.so
#88 0x405a1f6d in nsAppShellService::Run (this=0x80aecf8) at
nsAppShellService.cpp:443
#89 0x804d628 in main1 (argc=1, argv=0xbffff934, splashScreen=0x0) at
nsAppRunner.cpp:741
#90 0x804dc41 in main (argc=1, argv=0xbffff934) at nsAppRunner.cpp:843

Comment 1

[(not reading, please use [e-mail] instead)]

bullet proofing fix checked in.

Comment 2

[leger]

Putting crash in the keyword field.

Comment 3

[leger]

Also, occurs with 2000021609m14 Linux.  shrir, can you get us a stack trace with 
today's crash please?  thanks!

Comment 4

[shrirang khanzode]

Stack trace for today 's linux crash:


 Trigger Type:  Program Crash 

 Trigger Reason:  SIGSEGV: Segmentation Fault: (signal 11) 

 Call Stack:    (Signature = 0x00000001 1ac6c116) 
     
   0x00000001                                                   
     
   InMemoryDataSource::DeleteForwardArcsEntry() 
                                                     
     
   libplds3.so + 0x1300 (0x40137300) 
                                                     
     
   InMemoryDataSource::~InMemoryDataSource() 
                                                     
     
   Release() 
                                                     
     
   InMemoryDataSource::Release() 
                                                     
     
   nsBookmarksService::Release() 
                                                     
     
   DeleteEntry() 
                                                     
     
   _hashEnumerateRemove__FP11PLHashEntryiPv() 
                                                     
     
   libplds3.so + 0x1300 (0x40137300) 
                                                     
     
   nsHashtable::Reset() 
                                                     
     
   nsObjectHashtable::Reset() 
                                                     
     
   nsObjectHashtable::~nsObjectHashtable() 
                                                     
     
   nsServiceManagerImpl::~nsServiceManagerImpl() 
                                                     
     
   nsServiceManagerImpl::Release() 
                                                     
     
   nsServiceManager::ShutdownGlobalServiceManager() 
                                                     
     
   NS_ShutdownXPCOM() 
                                                     
     
   main() 
                                                     
     
   libc.so.6 + 0x181eb (0x4021f1eb) 
                                                     


 Registers: 
 EAX:      00000001
 EBX:      408a13d8
 ECX:      402f4401
 EDX:      083bd918
 ESI:      00000003
 EDI:      083bc280                                         
 ESP:      bffff72c
 EBP:      bffff740
 EIP:      00000001
 
    cf PF AF zf sf of IF df nt RF vm   IOPL: 0 

  

Comment 5

[shrirang khanzode]

Attachment: Somewhat better stack trace

Comment 6

[leger]

Adding trudelle and don.  Putting on beta1 radar.

shrir, can you get a Talkback specific trace?

Comment 7

[shrirang khanzode]

I got these traces from QFA (talkback).

Comment 8

[travis]

How did this get assigned to me?  This seems like a cache thing.

Comment 9

[don]

I agree.

Comment 10

[don]

Re-assigning to the cache guru ...

Comment 11

[gordon]

I don't see what this has to do with the NECKO cache.  Maybe I'm missing 
something...

Comment 12

[leger]

Putting on the PDT- radar for beta1.  Unless you can confirm data loss.

Comment 13

[Daniel Bratell]

I get this crash almost always in Win2k so I mark this an all-platform bug.

What happens is that mSource is pointing to illegal memory making the line

  NS_RELEASE(mSource);

fail in Assertion::~Assertion()

Looking back to DeleteForwardArcsEntry, the object deleted seems to be the last 
in the list (if there ever was any more than one).

Assertion::~Assertion() line 136 + 13 bytes
Assertion::`scalar deleting destructor'(unsigned int 1) + 15 bytes
InMemoryDataSource::DeleteForwardArcsEntry(PLHashEntry * 0x0221c7e0, int 29, 
void * 0x00000000) line 670 + 28 bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x0221a6f8, int (PLHashEntry *, int, 
void *)* 0x015c3a50 InMemoryDataSource::DeleteForwardArcsEntry(PLHashEntry *, 
int, void *), void * 0x00000000) line 368 + 15 bytes
InMemoryDataSource::~InMemoryDataSource() line 645 + 19 bytes
InMemoryDataSource::`scalar deleting destructor'(unsigned int 1) + 15 bytes
InMemoryDataSource::Internal::Release(InMemoryDataSource::Internal * const 
0x02227044) line 678 + 143 bytes
InMemoryDataSource::Release(InMemoryDataSource * const 0x02227028) line 678 + 21 
bytes
nsBookmarksService::Release(nsBookmarksService * const 0x02215c00) line 2568 + 
18 bytes
DeleteEntry(nsHashKey * 0x022a3450, void * 0x022a2c90, void * 0x00000000) line 
210 + 18 bytes
_hashEnumerateRemove(PLHashEntry * 0x0221b018, int 65, void * 0x0012fdc8) line 
227 + 26 bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x00b771f8, int (PLHashEntry *, int, 
void *)* 0x10013e20 _hashEnumerateRemove(PLHashEntry *, int, void *), void * 
0x0012fdc8) line 368 + 15 bytes
nsHashtable::Reset(int (nsHashKey *, void *, void *)* 0x1004d950 
DeleteEntry(nsHashKey *, void *, void *), void * 0x00000000) line 243 + 20 bytes
nsObjectHashtable::Reset() line 344
nsObjectHashtable::~nsObjectHashtable() line 310
nsObjectHashtable::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsServiceManagerImpl::~nsServiceManagerImpl() line 235 + 31 bytes
nsServiceManagerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsServiceManagerImpl::Release(nsServiceManagerImpl * const 0x00b77168) line 244 
+ 132 bytes
nsServiceManager::ShutdownGlobalServiceManager(nsIServiceManager * * 0x00000000) 
line 484 + 17 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 570 + 7 bytes
main(int 1, char * * 0x00b76d40) line 801 + 8 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87903()

Comment 14

[don]

Hmmmm, I don't see this one anymore.  Can anyone reproduce this?  If so, please
add the data to bug #7799, the "crash on exit" tracking bug.

Comment 15

[Tom Everingham]

verified 

Comment 16

[Pulsebot]

Pushed by ffxbld-merge:
https://hg.mozilla.org/releases/mozilla-beta/rev/2884f999caf9
[fenix] For https://github.com/mozilla-mobile/fenix/issues/26608 - Update recent bookmarks homepage title