335024 - Firefox 1.5.0.2 shutdown topcrash [@ nsCOMPtr_base::~nsCOMPtr_base() | XPCWrappedNativeProto::`scalar deleting destructor''(unsigned int)] [@ nsCOMPtr_base::~nsCOMPtr_base() | XPCWrappedNativeProto::~XPCWrappedNativeProto()]

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

One of the top crashes for Firefox 1.5.0.2 is a shutdown crash with the following stack:

nsCOMPtr_base::~nsCOMPtr_base()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/xpcom/build/nsCOMPtr.cpp, line 81]
XPCWrappedNativeProto::~XPCWrappedNativeProto()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativeproto.cpp, line 88]
DyingProtoKiller()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcjsruntime.cpp, line 212]
JS_DHashTableEnumerate()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/jsdhash.c, line 621]
XPCJSRuntime::GCCallback()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/xpconnect/src/xpcjsruntime.cpp, line 561]
DOMGCCallback()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 2192]
js_GC()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/jsgc.c, line 1942]
js_ForceGC()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/jsgc.c, line 1514]
js_DestroyContext()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/jscntxt.c, line 284]
JS_DestroyContext()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/jsapi.c, line 933]
mozJSComponentLoader::UnloadAll()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/js/src/xpconnect/loader/mozJSComponentLoader.cpp, line 1008]
nsComponentManagerImpl::UnloadLibraries()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/xpcom/components/nsComponentManager.cpp, line 3114]
nsComponentManagerImpl::Shutdown()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/xpcom/components/nsComponentManager.cpp, line 900]
NS_ShutdownXPCOM_P()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/xpcom/build/nsXPComInit.cpp, line 854]
ScopedXPCOMStartup::~ScopedXPCOMStartup()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 553]
XRE_main()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 848]
main()  [/builds/tinderbox/Fx-Mozilla1.8.0/Linux_2.4.21-37.ELsmp_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 62]

I'm wondering if the problem here is that the release that we're crashing on (presumably XPCNativeScriptableInfo::mCallback) can trigger a recursive GC and should thus use the deferred releases mechanism.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: Analysis of TB17821431

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I believe these crashes are showing up in significant numbers on Windows as well (the clear reports are on Linux): although the only the first, fifth, and sixth, and eighth frames of the stack are identifiable.  (I've seen stacks reliably mangled in similar ways for other crashes on Windows.)

Comment 3

[Hermann Schwab]

Attachment: TB17821431 with links (in case it's deleted from the server)

don't know if it is of any use, but I like the links into LXR

Comment 4

[Daniel Veditz [:dveditz]]

Looks like this is missing 1.8.0.3, try 1.8.0.4

Comment 5

[Daniel Veditz [:dveditz]]

Minusing, no patch and a shutdown crash isn't critical enough to push hard for.

Comment 6

[Hubert Gajewski]

Talkback TB21571362

It's probably the same problem.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

A number of the user comments for this stack don't mention shutdown; they mention sites like gmail, google.com, etc.  See:

http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsCOMPtr_base::~nsCOMPtr_base&vendor=MozillaOrg&product=Firefox2&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Actually, never mind the previous comment.  The stacks are different; the ones not within XPCOM shutdown are destroying a wrapped native, not a wrapped native proto.

Comment 9

[Mardeg]

A windows user with incident - http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=26109651 - reported that disabling an extension called "My Global Search" stopped the crashing on exit. Apparently it appeared automatically after installing BearShare, and uninstalling BearShare didn't remove the malware.
References:

http://security-central.us/SafeHex/prevention.htm
http://research.sunbelt-software.com/threatdisplay.aspx?name=MyGlobalSearch.Toolbar&threatid=41891
http://www.file.net/process/mgsbar.dll.html
http://www.spyware-browser.com/items/-/9184/

Comment 10

[Jesse Ruderman]

Very few of these crashes nowadays.  It sounds like dbaron never identified a likely cause (except maybe the last paragraph of comment 0?).