Last Comment Bug 319934 - Crash on quit just as an nsXMLHttpRequest is fired [@ nsContentUtils::GetDocShellFromCaller]
: Crash on quit just as an nsXMLHttpRequest is fired [@ nsContentUtils::GetDocS...
Status: RESOLVED FIXED
: crash, fixed1.8.1.5, topcrash
Product: Core
Classification: Components
Component: XML (show other bugs)
: Trunk
: PowerPC Mac OS X
: P2 critical (vote)
: mozilla1.9alpha5
Assigned To: Benjamin Smedberg [:bsmedberg]
: Hixie (not reading bugmail)
Mentors:
http://www.wired.com
Depends on: 316414
Blocks: 323939
  Show dependency treegraph
 
Reported: 2005-12-11 22:41 PST by Simon Fraser
Modified: 2007-07-11 08:34 PDT (History)
13 users (show)
benjamin: blocking1.9?
jwalden+bmo: in‑testsuite?
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Hold the layout module alive while there are xmlhttprequest objects, rev. 1 (1.04 KB, patch)
2007-05-16 08:29 PDT, Benjamin Smedberg [:bsmedberg]
dbaron: review+
dbaron: superreview+
dveditz: approval1.8.1.5+
Details | Diff | Splinter Review

Description Simon Fraser 2005-12-11 22:41:22 PST
I just had a crash on quit while sitting on a wired.com page. The stack is interesting:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   libgklayout.dylib        	0x0a1c00ac nsContentUtils::GetDocShellFromCaller() + 48 (nsContentUtils.cpp:888)
1   libgklayout.dylib        	0x0a1d48d8 nsDOMImplementation::CreateDocument(nsAString_internal const&, nsAString_internal const&, nsIDOMDocumentType*, nsIDOMDocument**) + 832 (nsDocument.cpp:594)
2   libxmlextras.dylib       	0x2399df44 nsXMLHttpRequest::OnStartRequest(nsIRequest*, nsISupports*) + 688 (nsXMLHttpRequest.cpp:1227)
3   libnecko.dylib           	0x082cb2f4 nsHttpChannel::CallOnStartRequest() + 748 (nsHttpChannel.cpp:760)
4   libnecko.dylib           	0x082d8684 nsHttpChannel::OnStartRequest(nsIRequest*, nsISupports*) + 624 (nsHttpChannel.cpp:4010)
5   libnecko.dylib           	0x082105f4 nsInputStreamPump::OnStateStart() + 280 (nsInputStreamPump.cpp:381)
6   libnecko.dylib           	0x082103bc nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) + 200 (nsInputStreamPump.cpp:337)
7   libxpcom_core.dylib      	0x01945dac nsInputStreamReadyEvent::EventHandler(PLEvent*) + 168 (nsStreamUtils.cpp:120)
8   libxpcom_core.dylib      	0x0188c928 PL_HandleEvent + 116 (plevent.c:688)
9   libxpcom_core.dylib      	0x0188c740 PL_ProcessPendingEvents + 260 (plevent.c:624)
10  libxpcom_core.dylib      	0x0189001c nsEventQueueImpl::ProcessPendingEvents() + 144 (nsEventQueue.cpp:421)
11  libxpcom_core.dylib      	0x01819fb0 NS_ShutdownXPCOM_P + 420 (nsXPComInit.cpp:827)
12  libxpcom.dylib           	0x00d95240 NS_ShutdownXPCOM + 32 (nsXPComStub.cpp:140)
13  org.mozilla.camino       	0x000e8bb0 NS_TermEmbedding + 204 (nsEmbedAPI.cpp:215)
...

We're servicing PLEvents from NS_ShutdownXPCOM, and happen to catch a plevent that involves nsXMLHttpRequest::OnStartRequest.
Comment 1 Boris Zbarsky [:bz] 2005-12-12 07:51:03 PST
People are calling into the layout module after it's shut down...  Should revisit this after bug 316414 is fixed and see whether we still have a problem.  I suspect we will not.
Comment 2 timeless 2005-12-12 11:01:54 PST
xmlhttprequest should probably be listening for some flavor of xpcomshutdown ... although that sounds strange. alternatively the input pump should listen and arrange to discard things when it's notified of shutdown.
Comment 3 Benjamin Smedberg [:bsmedberg] 2005-12-12 11:03:37 PST
Or going offline should fire stoprequest notifications on open HTTP channels...
Comment 4 Boris Zbarsky [:bz] 2005-12-12 11:19:23 PST
Well, if we fix bug 316414 this event processing thing will happen while we still have references to the various services in nsContentUtils... So we'll be fine.
Comment 5 Christian :Biesinger (don't email me, ping me on IRC) 2005-12-17 19:05:23 PST
(In reply to comment #3)
> Or going offline should fire stoprequest notifications on open HTTP channels...

and we do...

Comment 6 Christian :Biesinger (don't email me, ping me on IRC) 2005-12-17 19:07:05 PST
er, "it does". at least since bug 202638 was fixed, which was on 2004-08-04.
Comment 7 Felix Pahl 2006-09-20 01:21:00 PDT
A page containing the script below crashes Firefox 1.5.0.6 on Mac OS X 10.2.8 every once in a while when the window is closed. The crash seems to occur only on that platform; since this bug was reported for Mac OS X 10.2, it's seems likely that it's the same bug. This is forcing us to explicitly launch Safari instead. Is anyone working on this bug?

<script language="javascript">
function doExit () {
  if (self.XMLHttpRequest)
    req = new XMLHttpRequest();
  else
    req = new ActiveXObject("Microsoft.XMLHTTP");
  req.open("GET","/hastalavista");
  req.send (null);
  alert ("YOU ARE LEAVING\nTHE AMERICAN SECTOR");
}
window.onbeforeunload = doExit;
</script>
Comment 8 Felix Pahl 2006-09-20 06:11:28 PDT
A correction to comment #7 -- the crash occurs not only under OS X 10.2.8, also under OS X 10.4.7.
Comment 9 Boris Zbarsky [:bz] 2006-09-20 10:16:30 PDT
> Is anyone working on this bug?

See comment 1.

If people want to try to spot-hack this, you could make nsXMLHttpRequest observe some sort of shutdown notification that comes _before_ XPCOM_SHUTDOWN.  If we have one...

But what I really wonder is whether this is a problem on trunk.  I would bet it's not.
Comment 10 Mike Connor [:mconnor] 2007-05-14 08:48:37 PDT
bug 380468 implies that it is still present on trunk.
Comment 11 Benjamin Smedberg [:bsmedberg] 2007-05-16 08:29:09 PDT
Created attachment 264999 [details] [diff] [review]
Hold the layout module alive while there are xmlhttprequest objects, rev. 1
Comment 12 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2007-05-16 09:01:50 PDT
Comment on attachment 264999 [details] [diff] [review]
Hold the layout module alive while there are xmlhttprequest objects, rev. 1

r+sr=dbaron
Comment 13 Benjamin Smedberg [:bsmedberg] 2007-05-16 12:23:34 PDT
Fixed on trunk. Might be worth putting this on the 1.8.1 branch as well.
Comment 14 Daniel Veditz [:dveditz] 2007-06-13 12:09:56 PDT
Don't think this is a branch "blocker" but we'll look at the approval request.
Comment 15 Daniel Veditz [:dveditz] 2007-06-26 16:04:38 PDT
Comment on attachment 264999 [details] [diff] [review]
Hold the layout module alive while there are xmlhttprequest objects, rev. 1

approved for 1.8.1.5, a=dveditz for release-drivers
Comment 16 Benjamin Smedberg [:bsmedberg] 2007-07-11 08:34:50 PDT
Fixed on MOZILLA_1_8_BRANCH

Note You need to log in before you can comment on or make changes to this bug.