382350 - Crash [@ NS_LogCOMPtrRelease_P]

Status: RESOLVED WORKSFORME

(Core :: XSLT, defect)

Description

[Bob Clary [:bc] (inactive)]

Linux|Mac only crash on shutdown. This regressed (I think around 5/27-5/28)

<http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=js1_5/Regress/regress-355344.js;language=type;text/javascript>

guessing on component.

(gdb) bt
#0  0x00575402 in __kernel_vsyscall ()
#1  0x44385cb6 in nanosleep () from /lib/libc.so.6
#2  0x44385adf in sleep () from /lib/libc.so.6
#3  0x00a7d959 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:135
#4  0x00a92f40 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:210
#5  <signal handler called>
#6  0x0045ae05 in NS_LogCOMPtrRelease_P (aCOMPtr=0x853ecdc, aObject=0x8539138)
    at /work/mozilla/builds/1.9.0/mozilla/xpcom/base/nsTraceRefcntImpl.cpp:1205
#7  0x0168d019 in ~nsCOMPtr (this=0x853ecdc)
    at ../../dist/include/xpcom/nsCOMPtr.h:581
#8  0x01a98e8e in ~MapItem (this=0x853ecd8)
    at /work/mozilla/builds/1.9.0/mozilla/content/xslt/src/base/txExpandedNameMa
p.h:129
#9  0x01a98ea1 in nsTArrayElementTraits<txExpandedNameMap_base::MapItem>::Destru
ct (e=0x853ecd8) at ../../../../dist/include/xpcom/nsTArray.h:198
#10 0x01a98ee8 in nsTArray<txExpandedNameMap_base::MapItem>::DestructRange (
    this=0x853ecc4, start=0, count=2)
    at ../../../../dist/include/xpcom/nsTArray.h:699
#11 0x01a98fca in nsTArray<txExpandedNameMap_base::MapItem>::RemoveElementsAt (
    this=0x853ecc4, start=0, count=2)
    at ../../../../dist/include/xpcom/nsTArray.h:550
#12 0x01ac52c6 in nsTArray<txExpandedNameMap_base::MapItem>::Clear (
---Type <return> to continue, or q <return> to quit---
    this=0x853ecc4) at ../../../../dist/include/xpcom/nsTArray.h:561
#13 0x01ac52e9 in ~nsTArray (this=0x853ecc4)
    at ../../../../dist/include/xpcom/nsTArray.h:268
#14 0x01ac530b in ~txExpandedNameMap_base (this=0x853ecc4)
    at /work/mozilla/builds/1.9.0/mozilla/content/xslt/src/xslt/../base/txExpandedNameMap.h:46
#15 0x01ae1fd3 in ~txExpandedNameMap (this=0x853ecc4)
    at /work/mozilla/builds/1.9.0/mozilla/content/xslt/src/xslt/../base/txExpandedNameMap.h:140
#16 0x01ae1fea in ~txHandlerTable (this=0x853ecb8)
    at /work/mozilla/builds/1.9.0/mozilla/content/xslt/src/xslt/txStylesheetCompileHandlers.h:67
#17 0x01ad4ae0 in txHandlerTable::shutdown ()
    at /work/mozilla/builds/1.9.0/mozilla/content/xslt/src/xslt/txStylesheetCompileHandlers.cpp:3069
#18 0x01aef220 in txXSLTProcessor::shutdown ()
    at /work/mozilla/builds/1.9.0/mozilla/content/xslt/src/xslt/txXSLTProcessor.cpp:93
#19 0x01b0248b in txMozillaXSLTProcessor::Shutdown ()
    at /work/mozilla/builds/1.9.0/mozilla/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:1268
#20 0x016686ee in nsLayoutStatics::Shutdown ()
    at /work/mozilla/builds/1.9.0/mozilla/layout/build/nsLayoutStatics.cpp:233

Comment 1

[Bob Clary [:bc] (inactive)]

Also js1_5/extensions/regress-361558.js

Comment 2

[Bob Clary [:bc] (inactive)]

I can't reproduce this with a fresh debug build on linux. If it is still not crashing tomorrow, I'll WFM.

Comment 3

[Bob Clary [:bc] (inactive)]

I crashed with a linux minefield nightly and fresh debug build with the same stack, so this is real.

Comment 4

[Robert Sayre]

Bob, are you still seeing this?

Comment 5

[Bob Clary [:bc] (inactive)]

(In reply to comment #4)
> Bob, are you still seeing this?
> 

No, not with yesterday's build on fc7. Thanks for reminding me. I was catching up on the old js bugs but forgot about this one. -> WFM