380968 - crash in [@ nsCacheService::SearchCacheDevices][@ nsCacheService::CreateOfflineDevice] when closing Firefox just after starting with clean profile

Status: VERIFIED FIXED

(Core :: Networking, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I've only seen this crash once.

Steps:
  Start firefox on a clean profile:
    cd /path/to/firefox
    mkdir profiledir
    ./firefox -no-remote -profile profiledir
  Make the dialogs that come up go away, and shut down firefox as quickly
  as possible

WARNING: cannot post event if not initialized: file /builds/trunk/mozilla/netwerk/protocol/http/src/nsHttpConnectionMgr.cpp, line 167

Program ./firefox-bin (pid = 3216) received signal 11.
Stack:
UNKNOWN 0x382420
nsCacheService::SearchCacheDevices(nsCString*, int, int*) (/builds/trunk/mozilla/netwerk/cache/src/nsCacheService.cpp:1455)
nsCacheService::ActivateEntry(nsCacheRequest*, nsCacheEntry**) (/builds/trunk/mozilla/netwerk/cache/src/nsCacheService.cpp:1352)
nsCacheService::ProcessRequest(nsCacheRequest*, int, nsICacheEntryDescriptor**) (/builds/trunk/mozilla/netwerk/cache/src/nsCacheService.cpp:1244)
nsCacheService::OpenCacheEntry(nsCacheSession*, nsACString_internal const&, int, int, nsICacheListener*, nsICacheEntryDescriptor**) (/builds/trunk/mozilla/netwerk/cache/src/nsCacheService.c
nsCacheSession::OpenCacheEntry(nsACString_internal const&, int, int, nsICacheEntryDescriptor**) (/builds/trunk/mozilla/netwerk/cache/src/nsCacheSession.cpp:108)
nsHttpChannel::OpenCacheEntry(int, int*) (/builds/trunk/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp:1320)
nsHttpChannel::Connect(int) (/builds/trunk/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp:288)
nsHttpChannel::AsyncOpen(nsIStreamListener*, nsISupports*) (/builds/trunk/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp:3556)
nsUrlClassifierStreamUpdater::DownloadUpdates(nsIUrlClassifierCallback*, nsIUrlClassifierCallback*, int*) (/builds/trunk/mozilla/toolkit/components/url-classifier/src/nsUrlClassifierStreamU
NS_InvokeByIndex_P (./libxpcom_core.so)
.L1540 (/builds/trunk/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2245)
XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) (/builds/trunk/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1467)
js_Invoke (/builds/trunk/mozilla/js/src/jsinterp.c:1333)
js_Interpret (/builds/trunk/mozilla/js/src/jsinterp.c:4027)
js_Invoke (/builds/trunk/mozilla/js/src/jsinterp.c:1351)
fun_apply (/builds/trunk/mozilla/js/src/jsfun.c:1706)
js_Invoke (/builds/trunk/mozilla/js/src/jsinterp.c:1333)
js_Interpret (/builds/trunk/mozilla/js/src/jsinterp.c:4027)
js_Invoke (/builds/trunk/mozilla/js/src/jsinterp.c:1351)
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (/builds/trunk/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1419)
nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) (/builds/trunk/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:565)
PrepareAndDispatch (/builds/trunk/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:97)
NS_InvokeByIndex_P (./libxpcom_core.so)
nsProxyObjectCallInfo::Run() (/builds/trunk/mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181)
nsThread::ProcessNextEvent(int, int*) (/builds/trunk/mozilla/xpcom/threads/nsThread.cpp:483)
NS_ProcessNextEvent_P(nsIThread*, int) (/builds/trunk/obj/firefox-debugopt/xpcom/build/nsThreadUtils.cpp:227)
nsThread::Shutdown() (/builds/trunk/mozilla/xpcom/threads/nsThread.cpp:441)
nsSocketTransportService::Shutdown() (/builds/trunk/mozilla/netwerk/base/src/nsSocketTransportService2.cpp:413)
nsIOService::SetOffline(int) (/builds/trunk/mozilla/netwerk/base/src/nsIOService.cpp:629)
nsIOService::Observe(nsISupports*, char const*, unsigned short const*) (/builds/trunk/mozilla/netwerk/base/src/nsIOService.cpp:786)
nsObserverList::NotifyObservers(nsISupports*, char const*, unsigned short const*) (/builds/trunk/mozilla/xpcom/ds/nsObserverList.cpp:127)
nsObserverService::NotifyObservers(nsISupports*, char const*, unsigned short const*) (/builds/trunk/mozilla/xpcom/ds/nsObserverService.cpp:184)
nsXREDirProvider::DoShutdown() (/builds/trunk/mozilla/toolkit/xre/nsXREDirProvider.cpp:750)
~ScopedXPCOMStartup (/builds/trunk/mozilla/toolkit/xre/nsAppRunner.cpp:793)
XRE_main (/builds/trunk/mozilla/toolkit/xre/nsAppRunner.cpp:2868)
main (/builds/trunk/mozilla/browser/app/nsBrowserApp.cpp:66)
__libc_start_main (/usr/src/debug/glibc-2.5-20061008T1257/csu/libc-start.c:262)
Sleeping for 300 seconds.
Type 'gdb ./firefox-bin 3216' to attach your debugger to this thread.

Could this somehow be related to bug 319934 (which I just picked up the fix for)?

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I just hit this again, on my real profile (i.e., years of cruft in it), and not at shutdown either.  The stack is the same down to NS_ProcessNextEvent_P, but then it's not the shutdown path:

nsBaseAppShell::Run() (/builds/trunk/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:153)
nsAppStartup::Run() (/builds/trunk/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:172)
XRE_main (/builds/trunk/mozilla/toolkit/xre/nsAppRunner.cpp:2823)
main (/builds/trunk/mozilla/browser/app/nsBrowserApp.cpp:66)
__libc_start_main (/usr/src/debug/glibc-2.5-20061008T1257/csu/libc-start.c:262)

Comment 3

[Jesse Ruderman]

I'm seeing timeless's crash a lot on Mac (not during normal browsing).

Comment 4

[Jesse Ruderman]

Oops, Seth's crash (which timeless duped to this bug).

Comment 5

[Benjamin Smedberg]

This shows up as nsCacheService::CreateOfflineDevice() in breakpad, see for instance bp-197b0f6e-1393-11dc-aae5-001a4bd46e84 and bp-197b0f6e-1393-11dc-aae5-001a4bd46e84

Dave, can you take a look?

Comment 6

[Dave Camp (:dcamp)]

Attachment: properly disable caches on shutdown

The cache shutdown code fails to disable caches if they haven't been created yet.  The offline cache isn't usually created unless you're browsing offline or using an offline-enabled page.  On shutdown the ioservice is offline, so it tries to access the not-properly-disabled cache.

This patch should fix the shutdown crash.  If dbaron is seeing this during normal browsing that's likely a different crash (unless he's working offline it probably isn't trying to create the offline cache device)

Comment 7

[Dave Camp (:dcamp)]

I committed this and opened bug 385861 to follow up on the not-at-shutdown crash.

Comment 8

[Rob Campbell [:rc] (:robcee)]

I can't reproduce this with the steps listed above in the first comment on a recent build.