373464 - Shutdown crash [@ nsContentUtils::DropScriptObject]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Run a debug Firefox build with -P to bring up profile manager.
2. Create a new profile.
3. Click the button to start Firefox with the new profile.

Result: Firefox crashes while trying to restart itself.  aObject passed to nsContentUtils::DropScriptObject is null.

Thread 0 Crashed:
0   libgklayout.dylib   	0x15442d49 nsContentUtils::DropScriptObject(unsigned, void*) + 33 (nsContentUtils.cpp:3430)
1   libgklayout.dylib   	0x159ccc45 nsContentUtils::ScriptObjectHolder::~ScriptObjectHolder [in-charge]() + 29 (nsXULElement.cpp:972)
2   libgklayout.dylib   	0x156e760a nsXULPrototypeScript::~nsXULPrototypeScript [in-charge deleting]() + 40 (nsXULElement.cpp:2784)
3   libgklayout.dylib   	0x1599b430 nsXULPrototypeNode::Release() + 100 (nsXULElement.h:228)
4   libgklayout.dylib   	0x1599b445 nsXULPrototypeNode::ReleaseSubtree() + 17 (nsXULElement.h:229)
5   libgklayout.dylib   	0x159ccf2d nsXULPrototypeElement::ReleaseSubtree() + 97 (nsXULElement.h:267)
6   libgklayout.dylib   	0x15607ebd nsXULPrototypeDocument::~nsXULPrototypeDocument [in-charge deleting]() + 205 (nsXULPrototypeDocument.cpp:190)
7   libgklayout.dylib   	0x156058c7 nsXULPrototypeDocument::Release() + 269 (nsXULPrototypeDocument.cpp:212)
8   libgklayout.dylib   	0x1599fa69 nsRefPtr<nsXULPrototypeDocument>::~nsRefPtr [in-charge]() + 37 (nsIXULContentSink.h:956)
9   libgklayout.dylib   	0x15600253 nsXULDocument::~nsXULDocument [in-charge deleting]() + 1309 (nsXULDocument.cpp:268)
10  libgklayout.dylib   	0x1545a0c9 nsDocument::LastRelease() + 63 (nsDocument.cpp:895)
11  libgklayout.dylib   	0x1545a936 nsDocument::Release() + 266 (nsDocument.cpp:943)
12  libgklayout.dylib   	0x1556b359 nsXMLDocument::Release() + 17 (nsXMLDocument.cpp:211)
13  libgklayout.dylib   	0x155f257d nsXULDocument::Release() + 17 (nsXULDocument.cpp:366)
14  libnecko.dylib      	0x2d46ab7a nsCOMPtr<nsIStreamLoaderObserver>::assign_assuming_AddRef(nsIStreamLoaderObserver*) + 94 (nsStreamLoader.cpp:568)
15  libnecko.dylib      	0x2d46abac nsCOMPtr<nsIStreamLoaderObserver>::assign_with_AddRef(nsISupports*) + 48 (nsStreamLoader.cpp:1236)
16  libnecko.dylib      	0x2d46acde nsCOMPtr<nsIStreamLoaderObserver>::operator=(nsIStreamLoaderObserver*) + 24 (nsStreamLoader.cpp:714)
17  libnecko.dylib      	0x2d3ae114 nsStreamLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 210 (nsStreamLoader.cpp:112)
18  libjar50.dylib      	0x2d0fc041 nsJARChannel::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 187 (nsJARChannel.cpp:753)
19  libnecko.dylib      	0x2d3897d1 nsInputStreamPump::OnStateStop() + 271 (nsInputStreamPump.cpp:572)
20  libnecko.dylib      	0x2d3898ef nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) + 153 (nsInputStreamPump.cpp:396)
21  libxpcom_core.dylib 	0x013a841c nsInputStreamReadyEvent::Run() + 100 (nsStreamUtils.cpp:112)
22  libxpcom_core.dylib 	0x0134ae9c nsThread::ProcessNextEvent(int, int*) + 556 (nsThread.cpp:483)
23  libxpcom_core.dylib 	0x012f384f NS_ProcessPendingEvents_P(nsIThread*, unsigned) + 145 (nsThreadUtils.cpp:179)
24  libxpcom_core.dylib 	0x012f88b7 NS_ShutdownXPCOM_P + 481 (nsXPComInit.cpp:722)
25  XUL                 	0x00207d01 ScopedXPCOMStartup::~ScopedXPCOMStartup [in-charge]() + 57 (nsAppRunner.cpp:778)
26  XUL                 	0x0020ed59 XRE_main + 5297 (nsAppRunner.cpp:2889)
27  org.mozilla.firefox 	0x00002eec main + 40 (nsBrowserApp.cpp:62)
28  org.mozilla.firefox 	0x00002852 _start + 216
29  org.mozilla.firefox 	0x00002779 start + 41

Comment 1

[Jesse Ruderman]

A similar crash happens when I exit a debug build of Firefox about 50% of the time if I have Greasemonkey installed.

Comment 2

[Jesse Ruderman]

Attachment: add null check to ScriptObjectHolder::~ScriptObjectHolder

This fixes the crash for me.  I don't know if it's the right fix.

Comment 3

[Peter Van der Beken [:peterv]]

Comment on attachment 258123 [details] [diff] [review]
add null check to ScriptObjectHolder::~ScriptObjectHolder

Sure. r+sr=peterv.

Comment 4

[Jesse Ruderman]

Fixed on trunk.