310955 - nsIObserverService.removeObserver exception when quickly opening and closing a window with js, also seen on some automatic tests

Status: RESOLVED FIXED

(Firefox :: General, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase.
When quickly opening a window which is immediately closed again with javascript,
I get an error:
Error: uncaught exception: [Exception... "Component returned failure code:
0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult:
"0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame ::
chrome://browser/content/browser.js :: BrowserShutdown :: line 881"  data: no]

This is also happening in Mozilla1.7

What I also noticed is that when you do that a lot (opening windows and closing
directly), you get an increase of memory usage that not seems to get freed.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

Martijn, are you still seeing this?

Comment 3

[Martijn Wargers (dead)]

(In reply to comment #2)
> Martijn, are you still seeing this?

Yes, to be precise, I'm now getting these error messages when using the testcase:
Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: BrowserShutdown :: line 856"  data: no]
Error: this._bms has no properties
Source File: chrome://browser/content/places/toolbar.xml
Line: 61
Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/search/search.xml ::  :: line 64"  data: no]

Comment 4

[Boris Zbarsky [:bzbarsky]]

Hmm... I'm having trouble reproducing... Martijn, do you see this in a debug build too?  Can you breakpoint to figure out why removeObserver is throwing?

Comment 5

[Martijn Wargers (dead)]

Attachment: Backtrace

Backtrace from debug build.
I'm getting an assertion too when the testcase is carried out:
###!!! ASSERTION: Oops!  You're asking for a weak reference to an object that do
esn't support that.: 'factoryPtr', file c:/mozilla/mozilla/xpcom/build/nsWeakRef
erence.cpp, line 73
This is a backtrace from that assertion.

Comment 6

[Boris Zbarsky [:bzbarsky]]

OK, so JS calls removeObserver.  What does |call DumpJSStack()| show?  That should give the JS code involved.

Comment 7

[Martijn Wargers (dead)]

I'm getting this:
(gdb) call DumpJSStack()
Warning:
Cannot insert breakpoint 0.
Error accessing memory address 0x0: Input/Output error.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Ok, in gdb when you hit the stack from comment 5, go to frame 11 (js_Invoke).  Then look at cx->fp->script (and cx->fp->down->script and so forth).  The script struct should at least have the URI in it.

Getting the line number is possible if you can call js_PCToLineNumber(cx, cx->fp->script, cx->fp->pc), but if you can't call DumpJSStack() then that might not work either...

Comment 9

[Martijn Wargers (dead)]

I'm getting this:
(gdb) frame 11
#11 0x6f24da56 in js_Invoke (cx=0x100f4580, argc=2, flags=0)
    at c:/mozilla/mozilla/js/src/jsinterp.c:1246
1246            ok = native(cx, frame.thisp, argc, frame.argv, &frame.rval);
(gdb) p cx->fp->script
$1 = (JSScript *) 0x0
(gdb) p cx->fp->down->script
$2 = (JSScript *) 0x103f07a0
(gdb) p cx->fp->down->down->script
$3 = (JSScript *) 0x103bb860
(gdb) p cx->fp->down->down->down->script
$4 = (JSScript *) 0x0
(gdb) p cx->fp->down->down->down->down->script
Cannot access memory at address 0xc
(gdb) p cx->fp->script->URI
There is no member named URI.
(gdb) p cx->fp->script->mURI
There is no member named mURI.
(gdb) p cx->fp->script->muri
There is no member named muri.
(gdb) p cx->fp->script->uri
There is no member named uri.
(gdb) js_PCToLineNumber(cx,
Undefined command: "js".  Try "help".
(gdb) js_PCToLineNumber(cx, cx->fp->script, cx->fp->pc)
Undefined command: "js".  Try "help".
(gdb) call js_PCToLineNumber(cx, cx->fp->script, cx->fp->pc)
Warning:
Cannot insert breakpoint 0.
Error accessing memory address 0x0: Input/Output error.

(gdb)

Comment 10

[Boris Zbarsky [:bzbarsky]]

(gdb) p cx->fp->down->script
$2 = (JSScript *) 0x103f07a0

OK.  What's *cx->fp->down->script?

There's not "URI" member in that struct; the URI is stored as "filename" or something... so just dump out the whole struct.  ;)

Comment 11

[Martijn Wargers (dead)]

(In reply to comment #10)
> (gdb) p cx->fp->down->script
> $2 = (JSScript *) 0x103f07a0
> 
> OK.  What's *cx->fp->down->script?

(gdb) frame 11
#11 0x6f24da56 in js_Invoke (cx=0x10359958, argc=2, flags=0)
    at c:/mozilla/mozilla/js/src/jsinterp.c:1246
1246            ok = native(cx, frame.thisp, argc, frame.argv, &frame.rval);
(gdb) p *cx->fp->down->script
$1 = {code = 0x103bde60 ";", length = 636, main = 0x103bde60 ";",
  version = 4096, numGlobalVars = 0, atomMap = {vector = 0x103dd818,
    length = 62}, filename = 0xf4d54c1 "chrome://browser/content/browser.js",
  lineno = 854, depth = 4, trynotes = 0x103be1fc, principals = 0xed5b2c,
  object = 0x0}
(gdb)

So that is this line, I guess:
http://lxr.mozilla.org/seamonkey/source/browser/base/content/browser.js#854
854     gPrefService = Components.classes["@mozilla.org/preferences-service;1"]
855                              .getService(Components.interfaces.nsIPrefBranch);

Comment 12

[Boris Zbarsky [:bzbarsky]]

No, the line number in *script is post-preprocessing.  So lxr is of no use.  Of course line 854 in the actual browser.js in my chrome seems to be 

   }

But that's likely to be OS-dependent. What's your line 854 look like?  ;)

Comment 13

[Boris Zbarsky [:bzbarsky]]

Note that the search.xml thing seems to be that it's removing an observer that's not in the list; I get that just by starting and quitting firefox... The browser.js one is the one I don't see.

Comment 14

[Martijn Wargers (dead)]

(In reply to comment #12)
> But that's likely to be OS-dependent. What's your line 854 look like?  ;)
{

This time I saved my browser.js from the debug build and looked at it in my text editor.
The "{" is from the function BrowserShutdown() which is removing all kinds of observer (without checking whether the observer service exists, btw). 

Comment 15

[Boris Zbarsky [:bzbarsky]]

OK.  Do you want to try to figure out which exact observer removal in there fails?

Comment 16

[Martijn Wargers (dead)]

Well, there are multiple of them failing, I need to remove/uncomment these to get only one assertion instead of two (the one assertion is the search.xml thing, like you already said):
  os.removeObserver(gSessionHistoryObserver, "browser:purge-session-history");
  os.removeObserver(gXPInstallObserver, "xpinstall-install-blocked");
  os.removeObserver(gXPInstallObserver, "xpinstall-install-edit-permissions");
  os.removeObserver(gXPInstallObserver, "xpinstall-install-edit-prefs");
  os.removeObserver(gMissingPluginInstaller, "missing-plugin");
and:
  BrowserOffline.uninit();

Comment 17

[Boris Zbarsky [:bzbarsky]]

Hmm... Is BrowserShutdown() getting called before delayedStartup()?  Could happend depending on timing... Maybe put dumps in both (in a debug build dumping |window| will give you a unique pointer to identify each window, so you can correlate shutdown and startup)?

Comment 18

[Martijn Wargers (dead)]

I get this with the dumps:
startup: [object ChromeWindow @ 0x14cae828 (native @ 0x149cfd58)]
WARNING: getting z level of unregistered window: file c:/mozilla/mozilla/xpfe/ap
pshell/src/nsWindowMediator.cpp, line 635
WARNING: getting z level of unregistered window: file c:/mozilla/mozilla/xpfe/ap
pshell/src/nsWindowMediator.cpp, line 635
shutdown: [object ChromeWindow @ 0x14cae828 (native @ 0x149cfd58)]
After that I get the assertions.

Comment 19

[:Gavin Sharp [email: [e-mail]]]

The observers are added in delayedStartup (which is run from onload using setTimeout with a delay of 0 milliseconds), but removed in BrowserShutdown, so if you close the window quickly enough (like right after opening it), you'll be trying to remove observers that were never added.

Comment 20

[:Gavin Sharp [email: [e-mail]]]

(delayedStartup was apparently an attempt at reducing startup time, but it's caused similar problems in the past)

Comment 21

[:Gavin Sharp [email: [e-mail]]]

I should have mentioned that making delayedStartup not be delayed fixed this for me.

Comment 22

[Boris Zbarsky [:bzbarsky]]

But per comment 18 delayedStartup _is_ running before BrowserShutdown(), no?

Comment 23

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #22)
> But per comment 18 delayedStartup _is_ running before BrowserShutdown(), no?

I don't know - Martijn? Did you perhaps put the dump in BrowserStartup instead of in delayedStartup?

Comment 24

[Martijn Wargers (dead)]

(In reply to comment #23)
> I don't know - Martijn? Did you perhaps put the dump in BrowserStartup instead
> of in delayedStartup?
Yes. I misread comment 17. Sorry.

Comment 25

[Martijn Wargers (dead)]

I guess this is more or less the same as bug 291261.

Comment 26

[:Gavin Sharp [email: [e-mail]]]

Attachment: don't call removeObserver if we haven't added one

Comment 27

[Jim Salter]

still seeing this error in Firefox 2 RC1 - Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: BrowserShutdown :: line 980"  data: no]

Comment 28

[Ryuichi KUBUKI]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061201 Minefield/3.0a1 ID:2006120113 [cairo]

Though not with JavaScript I saw

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: BrowserShutdown :: line 988"  data: no]

in the Error Console.

In the testcase in the comment #2 I saw

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/search/search.xml ::  :: line 110"  data: no]

Comment 29

[Wayne Mery (:wsmwk)]

Gavin in comment #26:
> Created an attachment (id=226568) [details]
> don't call removeObserver if we haven't added one

Gavin, is your patch OK for review?

Comment 30

[:Gavin Sharp [email: [e-mail]]]

Probably. I wanted to make sure there wasn't a better way to do this, and double check that there weren't any other cases where this bug could hit before asking for review, but I'm not sure that I'll get around to doing that anytime soon so I guess we should probably just do this for now. I don't know if the patch still applies; if you want to take this bug and find out, by all means go ahead :)

Comment 31

[Duncan Loveday]

Attachment: Another test HTML source

Comment 32

[Duncan Loveday]

Attachment: Test HTML source illustrating problem still present in FF3 nightlies when referencing document

The original test case just opens and closes the window, never uses the document at all. This now seems to be OK in the recent FF3 nightlies...HOWEVER attaching a test case that opens the window, writes to the document, closes the document then closes the window. This test case still produces an error on FF3.

With FF2.0.0.3 I get two messages :

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/search/search.xml ::  :: line 109"  data: no]

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: BrowserShutdown :: line 965"  data: no]

With FF3 (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a3pre) Gecko/20070316 Minefield/3.0a3pre) I get one error, not the same as either of the above

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/search/search.xml ::  :: line 113"  data: no]

Take away the references to the document and the errors on FF3 go away.

Comment 33

[Duncan Loveday]

Attachment: Reattaching same file again....stupidly left the crucial references to the document commented out

Comment 34

[Oliver Stöneberg]

Attachment: Another testcase

This code was working until 2.0.0.16 and with 2.0.0.17 it always fails. 3.0.x excutes the code without any problems.

The complete version:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17

Comment 35

[Oliver Stöneberg]

The errors messages are:

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/search/search.xml ::  :: line 109"  data: no]

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: BrowserShutdown :: line 987"  data: no]

Comment 39

[Serge Gautherie (:sgautherie)]

{
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1246882480.1246889689.29547.gz&fulltext=1
Linux mozilla-central unit test on 2009/07/06 05:14:40
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1246880096.1246883979.30704.gz&fulltext=1
OS X 10.5.2 mozilla-central unit test on 2009/07/06 04:34:56
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1246882480.1246888671.17310.gz&fulltext=1
WINNT 5.2 mozilla-central unit test on 2009/07/06 05:14:40

TEST-INFO | chrome://mochikit/content/browser/browser/base/content/test/browser_bug491431.js | Console message: [JavaScript Error: "[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: FullZoom_destroy :: line 7122"  data: no]" {file: "chrome://browser/content/browser.js" line: 1245}]
+
TEST-INFO | chrome://mochikit/content/browser/browser/base/content/test/browser_bug491431.js | Console message: [JavaScript Error: "uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: BrowserShutdown :: line 1250"  data: no]"]

TEST-INFO | chrome://mochikit/content/browser/docshell/test/browser/browser_bug388121-2.js | Console message: [JavaScript Error: "[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: FullZoom_destroy :: line 7122"  data: no]" {file: "chrome://browser/content/browser.js" line: 1245}]
+
TEST-INFO | chrome://mochikit/content/browser/docshell/test/browser/browser_bug388121-2.js | Console message: [JavaScript Error: "uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/browser.js :: BrowserShutdown :: line 1250"  data: no]"]
}

m-1.9.1 has even more of theses...

Comment 40

[asmpgmr]

SeaMonkey 2.0.4 (Gecko 1.9.1.9) gives the following error in the error console immediately upon closing a mail window:

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://navigator/content/tabbrowser.xml ::  :: line 2364"  data: no]

Comment 41

[alex_mayorga]

Got this error twice on the Error Console on Mozilla/5.0 (Windows NT 6.0; rv:2.0b12pre) Gecko/20110206 Firefox/4.0b12pre ID:20110206030345 after the nightly update.

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://browser/content/search/search.xml ::  :: line 91"  data: no]

Hope it's useful.

Comment 42

[Cristian Nicolae (:xti)]

I've noticed 2 errors while I went to http://cbe001.chat.mibbit.com/?server=irc.mozilla.org&channel=%23mobile

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]" nsresult: "0x80004005 (NS_ERROR_FAILURE)" location: "JS frame :: chrome://browser/content/content.js :: findHandlerReceiveMessage :: line 1022" data: no]

and 

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]" nsresult: "0x80004005 (NS_ERROR_FAILURE)" location: "JS frame :: chrome://browser/content/content.js :: findHandlerReceiveMessage :: line 1129" data: no]

It seems that Fennec can not load that page and the opened tab just crashes every time. Are those errors related to this bug?

Build id : Mozilla/5.0 (Android;Linux armv7l;rv:6.0a2)Gecko/201100609
Firefox/6.0a2 Fennec/6.0a2
Device: Motorola Droid 2
OS: Android 2.2

Comment 43

[:Gavin Sharp [email: [e-mail]]]

That would likely be the fennec equivalent of this bug, please file it separately.

Comment 45

[:Gavin Sharp [email: [e-mail]]]

Fixed by bug 631447