380468 - Crash in tests during xpcom-shutdown

Status: RESOLVED INVALID

(Core :: Networking: HTTP, defect)

Description

[Dan Mills [:thunder]]

I'm adding to the places tests, and created a test which imports a microsummary from a bookmarks.html.

When xpcshell exits, I get an "Abort trap" message from the shell script.  Upon further investigation, it seems that something like the following is happening:

- An event is broadcast to inform listeners that a shutdown is taking place.
- The cache is properly shut down
- An xpcom-shutdown event is sent to a thread, and its pending events are processed until it acks the shutdown.
- The thread runs an event which causes it do a network connection, which hits the cache after it has shut down.

Doing some testing there were some variations depending on my code - sometimes the backtrace showed that the pending event was an xmlhttprequest failing because sThreadJSContextStack was null (because nsContentUtils::Shutdown had already happened), but essentially this seems to me to be the same problem: we should clear out the event queues of threads *before* issuing the general xpcom-shutdown event.

Then again, my knowledge of xpcom internals is very limited, so take my suggestion with several grains of salt.

To reproduce this problem:

* Apply 'wip patch mk III' from bug 373501.
* build
* cd objdir/browser/components/places
* make check

To test in gdb:

* cd tests
* TOPSRCDIR=/path/to/mozilla NATIVE_TOPSRCDIR=/path/to/mozilla gdb ../../../../dist/bin/xpcshell
* run -f /Users/thunder/sources/mozilla-trunk/mozilla/tools/test-harness/xpcshell-simple/head.js -f ../../../../_tests/xpcshell-simple/test_browser_places/unit/head_bookmarks.js -f ../../../../_tests/xpcshell-simple/test_browser_places/unit/test_bookmarks_html.js -f /Users/thunder/sources/mozilla-trunk/mozilla/tools/test-harness/xpcshell-simple/tail.js -f ../../../../_tests/xpcshell-simple/test_browser_places/unit/tail_bookmarks.js

Comment 1

[Dan Mills [:thunder]]

Attachment: Stack trace 1

Whoops, forgot to change my /Users/thunder/... paths above, but you get the idea.

Comment 2

[Dan Mills [:thunder]]

Attachment: Stack trace 2

Comment 3

[Dan Mills [:thunder]]

After talking with Seth S. today I think this might be a duplicate of bug 319934.

Comment 4

[Boris Zbarsky [:bzbarsky]]

No, it's different.  Same very general underlying problem (shutdown race), totally different crash location and exact details of _what_ is racing.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Oh, "stack trace 2" would be the same thing as bug 319934, yes.  The first stack trace is a different issue, though.  One that should probably be assigned to necko.

Comment 6

[Boris Zbarsky [:bzbarsky]]

To be precise, nsHttpChannel::OnStartRequest should not be processing redirections after shutdown, imo.

Comment 7

[Mike Connor [:mconnor]]

We should block on this, we have a unit test that can't be enabled without triggering this crash.

Comment 8

[Benjamin Smedberg]

I *should* have fixed stack #2 in bug 319934. I cannot reproduce the other one on Windows.

Comment 9

[Benjamin Smedberg]

This bug shouldn't be reproducable in the browser (because we shut down the network well before xpcom-shutdown), and there's a workaround for unit tests (explicitly go offline before shutdown), so I'm not going to block on this.

Comment 10

[Wayne Mery (:wsmwk)]

so is what's left only related to tests?  still wanted?

Comment 11

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk, use Needinfo for questions) from comment #10)
> so is what's left only related to tests?  still wanted?

given comment 8 and comment 9 I'd guess this is no longer valid