366528 - crash at NSSRWLock_LockRead() at nssrwlk.c:212, rwlock is 0x0

Status: VERIFIED DUPLICATE of bug 321024

(Core :: General, defect)

Description

[(not reading, please use [e-mail] instead)]

crash at NSSRWLock_LockRead() at nssrwlk.c:212, rwlock is 0x0

here comes the stack:

0x2ef64689 in NSSRWLock_LockRead (rwlock=0x0) at nssrwlk.c:212
212         PZ_Lock(rwlock->rw_lock);
(gdb) where
#0  0x2ef64689 in NSSRWLock_LockRead (rwlock=0x0) at nssrwlk.c:212
#1  0x2ef2bc1e in SECMOD_GetReadLock (modLock=0x0) at pk11list.c:71
#2  0x2ef494e1 in PK11_GetAllTokens (type=528, needRW=0, loadCerts=1, wincx=0x0) at pk11slot.c:1949
#3  0x2ef4972c in PK11_GetBestSlotMultiple (type=0xbfffd880, mech_count=1, wincx=0x0) at pk11slot.c:2039
#4  0x2ef49974 in PK11_GetBestSlot (type=528, wincx=0x0) at pk11slot.c:2100
#5  0x2ef29f87 in PK11_CreateDigestContext (hashAlg=SEC_OID_MD5) at pk11cxt.c:410
#6  0x2ef19d25 in md5_NewContext () at sechash.c:86
#7  0x2ef19fe0 in HASH_Create (type=HASH_AlgMD5) at sechash.c:289
#8  0x2e50d07d in nsCryptoHash::Init (this=0x39657b70, algorithm=2) at /Users/sspitzer/Desktop/trunk/mozilla/security/manager/ssl/src/nsNSSComponent.cpp:2175
#9  0x015fc8e6 in NS_InvokeByIndex (that=0x39657b70, methodIndex=3, paramCount=1, params=0xbfffdb84) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
#10 0x32ba4f6f in XPCWrappedNative::CallMethod (ccx=@0xbfffdda4, mode=CALL_METHOD) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2209
#11 0x32bac9f8 in XPC_WN_CallMethod (cx=0x33fb5a30, obj=0x283bd40, argc=1, argv=0x3a16ea4c, vp=0xbfffdeb4) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1455
#12 0x013020d2 in js_Invoke (cx=0x33fb5a30, argc=1, flags=0) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/jsinterp.c:1348
#13 0x01312c70 in js_Interpret (cx=0x33fb5a30, pc=0x239d566 ":", result=0xbfffe4f0) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/jsinterp.c:4059
#14 0x0130215d in js_Invoke (cx=0x33fb5a30, argc=1, flags=6) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/jsinterp.c:1367
#15 0x012f8c0c in fun_apply (cx=0x33fb5a30, obj=0x3a0aace0, argc=1, argv=0x3a16e844, rval=0xbfffe6b4) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/jsfun.c:1695
#16 0x013020d2 in js_Invoke (cx=0x33fb5a30, argc=2, flags=0) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/jsinterp.c:1348
#17 0x01312c70 in js_Interpret (cx=0x33fb5a30, pc=0x238f8dc ":", result=0xbfffecf0) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/jsinterp.c:4059
#18 0x0130215d in js_Invoke (cx=0x33fb5a30, argc=1, flags=2) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/jsinterp.c:1367
#19 0x32ba0341 in nsXPCWrappedJSClass::CallMethod (this=0x396b9770, wrapper=0x3c685ac0, methodIndex=3, info=0x2bbdb60, nativeParams=0xbffff1a4) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1419
#20 0x32b99279 in nsXPCWrappedJS::CallMethod (this=0x3c685ac0, methodIndex=3, info=0x2bbdb60, params=0xbffff1a4) at /Users/sspitzer/Desktop/trunk/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:530
#21 0x015fcba0 in PrepareAndDispatch (self=0x38c452b0, methodIndex=3, args=0xbffff2c4) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
#22 0x015fcbfe in nsXPTCStubBase::Stub3 (this=0x38c452b0) at ../../../../../../dist/include/xpcom/xptcstubsdef.inc:5
#23 0x015fc8e6 in NS_InvokeByIndex (that=0x38c452b0, methodIndex=3, paramCount=1, params=0x38ace1c0) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
#24 0x015f1dd5 in nsProxyObjectCallInfo::Run (this=0x3c6ccce0) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181
#25 0x015eb276 in nsThread::ProcessNextEvent (this=0x2318e70, mayWait=1, result=0xbffff3fc) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/threads/nsThread.cpp:482
#26 0x01593d98 in NS_ProcessNextEvent_P (thread=0x2318e70, mayWait=1) at nsThreadUtils.cpp:225
#27 0x015eb7fe in nsThread::Shutdown (this=0x396711f0) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/threads/nsThread.cpp:442
#28 0x309afb83 in nsUrlClassifierDBService::Shutdown (this=0x38c6fbd0) at /Users/sspitzer/Desktop/trunk/mozilla/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:1003
#29 0x309afc0f in nsUrlClassifierDBService::Observe (this=0x38c6fbd0, aSubject=0x23196c4, aTopic=0x162a4a4 "xpcom-shutdown", aData=0x0) at /Users/sspitzer/Desktop/trunk/mozilla/toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp:977
#30 0x015a1ac7 in nsObserverList::NotifyObservers (this=0x28366dc, aSubject=0x23196c4, aTopic=0x162a4a4 "xpcom-shutdown", someData=0x0) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/ds/nsObserverList.cpp:128
#31 0x015a2171 in nsObserverService::NotifyObservers (this=0x2321d30, aSubject=0x23196c4, aTopic=0x162a4a4 "xpcom-shutdown", someData=0x0) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/ds/nsObserverService.cpp:181
#32 0x01597f63 in NS_ShutdownXPCOM_P (servMgr=0x23196c4) at /Users/sspitzer/Desktop/trunk/mozilla/xpcom/build/nsXPComInit.cpp:716
#33 0x0020704f in ScopedXPCOMStartup::~ScopedXPCOMStartup (this=0xbffff83c) at /Users/sspitzer/Desktop/trunk/mozilla/toolkit/xre/nsAppRunner.cpp:596
#34 0x0020e002 in XRE_main (argc=3, argv=0xbffff9f8, aAppData=0x2040) at /Users/sspitzer/Desktop/trunk/mozilla/toolkit/xre/nsAppRunner.cpp:2552
#35 0x00001f32 in main (argc=3, argv=0xbffff9f8) at /Users/sspitzer/Desktop/trunk/mozilla/browser/app/nsBrowserApp.cpp:61

note, this was on my trunk debug build (details coming) 

but here's something odd:  at the time, Firefox 2.0 was up and running!  So perhaps, I clicked on a link in thunderbird, and since my trunk debug build is my default browser, it quickly started up (but quit)?

Comment 1

[(not reading, please use [e-mail] instead)]

the build that crashed was my own, debug, mac 10.4.8 build:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a2pre) Gecko/20070108 Minefield/3.0a2pre

Comment 2

[(not reading, please use [e-mail] instead)]

note, I have not been able to reproduce this.

Comment 3

[Wan-Teh Chang]

The reason rwlock is 0x0 is that NSS isn't initialized at that time.
The value of rwlock comes from a static variable (moduleLock in
mozilla/security/nss/lib/pk11wrap/pk11util.c) that is created in
NSS initialization.

Either NSS never was initialized, or NSS has been shut down.  Kai,
can you tell from the stack trace which case is true?

Comment 4

[timeless]

i'm pretty sure this is a duplicate. cryptohash or its factory is to blame for not ensuring nss is available.

Comment 6

[Kai Engert [:KaiE:]]

Wan-Teh, the stack indicates this happens during a shutdown.

While this bug is similar, I do not think it is an exact duplicate of bug 321024. This bug is about shutdown, while the other crash happens during startup. However, they might of course be related to the same underlying issue.

Looking at the stack, I can see we are currently executing a shutdown, and we probably have already executed the NSS shutdown - explaining the crash.

I can also see that this code is trying to execute pending events within the URL classifier.

I think, the Mozilla code outside of PSM is trying to make use of PSM objects while the NSS component has already been shut down.

Comment 7

[Mats Palmgren (inactive)]

Attachment: Linux stack

I got this crash today, I have never seen it before, it's reproducible -
let me know if you want variable values etc. Steps to reproduce:
1. Start Firefox (gtk2)
2. click on the X in the window upper right corner

Comment 8

[timeless]

DumpJSStack() from one of the xpconnect frames would be useful. if we can see what the js code is doing and prove that it should know better, we could at least fix the js.

Comment 10

[Robert Sayre]

Attachment: DumpJSStack

Comment 11

[Snala]

I got this bug after compiling and running my own build of Minefield on Mac OS X 10.4.9    The problem was solved for me by starting profile manager and creating a new profile separate from my previous FireFox 2.0.0.3 profile.

Intel Core Duo 2.16 Ghz
1 GB 667 MHz RAM