300000 - Shutdown crash [@ ObjectPrincipalFinder]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[timeless]

ObjectPrincipalFinder needs to be cleared when sScriptSecurityManager is
released. If you don't release it, we'll crash:
       gklayout.dll!ObjectPrincipalFinder(JSContext * cx=0x00b872b8, JSObject *
obj=0x01e234a0)  Line 2165 + 0x26       C++
       js3250.dll!JS_EvalFramePrincipals(JSContext * cx=0x00b872b8, JSStackFrame *
fp=0x0012da08, JSStackFrame * caller=0x0012e470)  Line 715 + 0x1a       C
       js3250.dll!obj_eval(JSContext * cx=0x00b872b8, JSObject * obj=0x01e23438,
unsigned int argc=1, long * argv=0x02007a6c, long * rval=0x0012da28)  Line
1092 + 0x11     C
       js3250.dll!js_Invoke(JSContext * cx=0x00b872b8, unsigned int argc=1, unsigned
int flags=0)  Line 1178 + 0x20  C
       js3250.dll!js_Interpret(JSContext * cx=0x00b872b8, unsigned char *
pc=0x01e5d2ed, long * result=0x0012e514)  Line 3471 + 0xf       C
       js3250.dll!js_Invoke(JSContext * cx=0x00b872b8, unsigned int argc=3, unsigned
int flags=2)  Line 1198 + 0x13  C
       xpc3250.dll!nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS *
wrapper=0x01e510d0, unsigned short methodIndex=3, const nsXPTMethodInfo *
info=0x00c35d78, nsXPTCMiniVariant * nativeParams=0x0012e828)  Line 1413 + 0x14 C++
       xpc3250.dll!nsXPCWrappedJS::CallMethod(unsigned short methodIndex=3, const
nsXPTMethodInfo * info=0x00c35d78, nsXPTCMiniVariant * params=0x0012e828)
Line 462        C++
       xpcom_core.dll!PrepareAndDispatch(nsXPTCStubBase * self=0x01e510d0, unsigned
int methodIndex=3, unsigned int * args=0x0012e8f0, unsigned int *
stackBytesToPop=0x0012e8e0)  Line 117 + 0x1c    C++
       xpcom_core.dll!SharedStub()  Line 147   C++
       xpc3250.dll!mozJSComponentLoader::GetFactory(const nsID & aCID={...}, const
char * aLocation=0x00bbd6e0, const char * aType=0x00bb76a0, nsIFactory * *
_retval=0x0012ea34)  Line 260 + 0x26    C++
       xpcom_core.dll!nsFactoryEntry::GetFactory(nsIFactory * * aFactory=0x0012ea34,
nsComponentManagerImpl * mgr=0x0034b738)  Line 302 + 0x3a       C++
       xpcom_core.dll!nsComponentManagerImpl::CreateInstance(const nsID &
aClass={...}, nsISupports * aDelegate=0x00000000, const nsID & aIID={...}, void
* * aResult=0x0012eabc)  Line 1911 + 0x10       C++
       xpcom_core.dll!nsComponentManagerImpl::GetService(const nsID & aClass={...},
const nsID & aIID={...}, void * * result=0x0012eb6c)  Line 2119 + 0x32  C++
       xpc3250.dll!nsJSCID::GetService(nsISupports * * _retval=0x0012ece8)  Line
899 + 0x48      C++
       xpcom_core.dll!XPTC_InvokeByIndex(nsISupports * that=0x01eabc40, unsigned int
methodIndex=11, unsigned int paramCount=1, nsXPTCVariant * params=0x0012ece8)
 Line 102       C++
       xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...},
XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2122 + 0x1e  C++
       xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x00b872b8, JSObject *
obj=0x01e232d8, unsigned int argc=1, long * argv=0x02007a20, long *
vp=0x0012efbc)  Line 1374 + 0xb C++
       js3250.dll!js_Invoke(JSContext * cx=0x00b872b8, unsigned int argc=1, unsigned
int flags=0)  Line 1178 + 0x20  C
       js3250.dll!js_Interpret(JSContext * cx=0x00b872b8, unsigned char *
pc=0x01eb32c4, long * result=0x0012faa8)  Line 3471 + 0xf       C
       js3250.dll!js_Invoke(JSContext * cx=0x00b872b8, unsigned int argc=3, unsigned
int flags=2)  Line 1198 + 0x13  C
       xpc3250.dll!nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS *
wrapper=0x01ee2720, unsigned short methodIndex=3, const nsXPTMethodInfo *
info=0x00c46330, nsXPTCMiniVariant * nativeParams=0x0012fdbc)  Line 1413 + 0x14 C++
>       xpc3250.dll!nsXPCWrappedJS::CallMethod(unsigned short methodIndex=3, const
nsXPTMethodInfo * info=0x00c46330, nsXPTCMiniVariant * params=0x0012fdbc)
Line 462        C++
       xpcom_core.dll!PrepareAndDispatch(nsXPTCStubBase * self=0x01ee2720, unsigned
int methodIndex=3, unsigned int * args=0x0012fe84, unsigned int *
stackBytesToPop=0x0012fe74)  Line 117 + 0x1c    C++
       xpcom_core.dll!SharedStub()  Line 147   C++
       xpcom_core.dll!nsObserverService::NotifyObservers(nsISupports *
aSubject=0x0034b73c, const char * aTopic=0x00511cd4, const unsigned short *
someData=0x00000000)  Line 235  C++
       xpcom_core.dll!NS_ShutdownXPCOM_P(nsIServiceManager * servMgr=0x00000000)
Line 764        C++
       mozilla.exe!main(int argc=1, char * * argv=0x00348368)  Line 1788 + 0x8 C++
       mozilla.exe!mainCRTStartup()  Line 398 + 0x11   C
       kernel32.dll!_BaseProcessStart@4()  + 0x23

Comment 1

[timeless]

Attachment: clear the ObjectPrincipalsFinder before dropping the runtime service

Comment 2

[Johnny Stenback (:jst)]

Comment on attachment 188586 [details] [diff] [review]
clear the ObjectPrincipalsFinder before dropping the runtime service

r+sr=jst

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 188586 [details] [diff] [review]
clear the ObjectPrincipalsFinder before dropping the runtime service

Get this in for a respin.  Thanks,

/be

Comment 4

[timeless]

Comment on attachment 188586 [details] [diff] [review]
clear the ObjectPrincipalsFinder before dropping the runtime service

mozilla/dom/src/base/nsJSEnvironment.cpp	1.258

Comment 5

[Alex Hosking]

W00t