392782 - Intermittent crashes during bloat test on "bm-xserve11" Tinderbox

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Mats Palmgren (inactive)]

firefox-bin(22206,0xa000cfe0) malloc: ***  Deallocation of a pointer not malloced: 0x730075; This could be a double free(), or free() called with the middle of an allocated block;

The first crash occurred at 2007-08-16 15:46 AFAICT

Comment 1

[Jesse Ruderman]

I'm hitting the same crash locally on about a third of the time, just starting up and shutting down.

Comment 2

[Jesse Ruderman]

The crash is preceded by a few of these:

WARNING: failed to construct proxy to main thread: file /Users/jruderman/trunk/mozilla/xpcom/threads/nsThreadPool.cpp, line 148

(That warning appears every time shutdown crashes; it doesn't appear at all on shutdowns that succeed.)

Comment 3

[Jesse Ruderman]

Attachment: stack traces

A stack for the warning, and stacks for the malloc_printf stuff.

The warning means it's going to fail to kill the thread...

Comment 5

[Mats Palmgren (inactive)]

dbaron have additional details in bug 392824, he suspects it could be
a regression from bug 350132.

Comment 6

[Mats Palmgren (inactive)]

If there was a race and we delete the new object here:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp&rev=1.62&root=/cvsroot&mark=267#236
then we will add the deleted object on line 270, no?
We should return NS_OK after the marked line I think.

Comment 7

[Mats Palmgren (inactive)]

Attachment: fix?

I can't reproduce the crash, but if someone that can could try this
patch and see if that helps that would be great.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 277403 [details] [diff] [review]
fix?

I think this is pretty clearly what was intended, so r+sr+a1.9=dbaron...

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 277403 [details] [diff] [review]
fix?

...and Benjamin can review it when he gets back, just in case we're wrong.

Comment 10

[Mats Palmgren (inactive)]

mozilla/xpcom/proxy/src/nsProxyObjectManager.cpp 	1.63 

-> FIXED

Comment 11

[Benjamin Smedberg]

Comment on attachment 277403 [details] [diff] [review]
fix?

Yes, quite.