Closed Bug 39747 Opened 24 years ago Closed 24 years ago

crash in RDFServiceImpl::GetDataSource

Categories

(Core Graveyard :: RDF, defect, P3)

Product:
Core Graveyard
Component:
RDF
Platform:
DEC
OSF/1
Type:
defect

Tracking

(Not tracked)

Status:
VERIFIED INVALID

People

(Reporter: jim_nance, Assigned: waterson)

Details

(Keywords: crash)

Attachments

(1 file)

how to not pollute the cache when timer creation fails
1.16 KB, patch
Details | Diff | Splinter Review 
I am getting a reproducable crash at startup under Tru64 unix in the function
RDFServiceImpl::GetDataSource.  I have traced the problem back to a bad
value comming out of a cache lookup:

NS_IMETHODIMP
RDFServiceImpl::GetDataSource(const char* aURI, nsIRDFDataSource** aDataSource)
{
    NS_PRECONDITION(aURI != nsnull, "null ptr");
    if (! aURI)
        return NS_ERROR_NULL_POINTER;

    nsresult rv;

    // First, check the cache to see if we already have this
    // datasource loaded and initialized.
    {
        nsIRDFDataSource* cached =
            NS_STATIC_CAST(nsIRDFDataSource*, PL_HashTableLookup(mNamedDataSourc
es, aURI));

        if (cached) {
            NS_ADDREF(cached);

We crash on the NS_ADDREF line because cached is bad.  The value of cached is
not 0, but seems to contain corrupt data.  Using it causes a memory access at
0xa0
Here is a stack trace:

---------------------------------------------------------------- ror -- 21 --
/tmp/jln/mozilla/rdf/base/src/nsRDFService.cpp: 1086: 
reading memory at 0xa0 in first 64KB (not accessible)
reading memory at 0xa0
    RDFServiceImpl::GetDataSource(const char*, nsIRDFDataSource**)
                                       librdf.so, nsRDFService.cpp, line 1086
    nsXULDocument::CheckTemplateBuilder(nsIContent*)
                                       librdf.so, nsXULDocument.cpp, line 5617
    nsXULDocument::ResumeWalk(void) librdf.so, nsXULDocument.cpp, line 4857
    nsXULDocument::OnStreamComplete(nsIStreamLoader*, nsISupports*, unsigned
int, unsigned int, const char*)
                                       librdf.so, nsXULDocument.cpp, line 5250
    nsStreamLoader::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const
unsigned short*)
                                       libnecko.so, nsStreamLoader.cpp, line 118
    nsFileChannel::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const
unsigned short*)
                                       libnecko.so, nsFileChannel.cpp, line 625
    nsOnStopRequestEvent::HandleEvent(void)
                                libnecko.so, nsAsyncStreamListener.cpp, line 306
    nsStreamListenerEvent::HandlePLEvent(PLEvent*)
                                 libnecko.so, nsAsyncStreamListener.cpp, line 97
    PL_HandleEvent                 libxpcom.so, plevent.c, line 575
    PL_ProcessPendingEvents        libxpcom.so, plevent.c, line 520
    nsEventQueueImpl::ProcessPendingEvents(void)
                                       libxpcom.so, nsEventQueue.cpp, line 316
    event_processor_callback(void*, int, GdkInputCondition)
                                      libwidget_gtk.so, nsAppShell.cpp, line 143
    our_gdk_io_invoke(_GIOChannel*, GIOCondition, void*)
                                       libwidget_gtk.so, nsAppShell.cpp, line 55
    g_io_unix_dispatch             libglib-1.2.so, giounix.c, line 135
    g_main_dispatch                libglib-1.2.so, gmain.c, line 656
    g_main_iterate                 libglib-1.2.so, gmain.c, line 877
    g_main_run                     libglib-1.2.so, gmain.c, line 935
    gtk_main                       libgtk-1.2.so, gtkmain.c, line 476
    nsAppShell::Run(void) libwidget_gtk.so, nsAppShell.cpp, line 313
    nsAppShellService::Run(void)
                               libnsappshell.so, nsAppShellService.cpp, line 371
    main1(int, char**, nsISupports*) mozilla-bin, nsAppRunner.cpp, line 904
    main                           mozilla-bin, nsAppRunner.cpp, line 1187
    __start                        mozilla-bin

I'm pretty sure that sfraser fixed this bug early Wednesday morning. Update 
xpfe/components/bookmarks/src, maybe?
For me, this crash was caused by timers failing to get created.

OK, I can verify that this is still a problem on Tru64 Unix using
code pulled at 10:00 PM EDT, on Thurs, 18 May.  Whats the chances
that the timer code is still broken on the alpha?
add pavlov to cc list. I doubt that timers are broken on Tru64, but who knows. 
The issue we were seeing was that bookmarks.dll was failing to initialize 
properly because it couldn't create a timer, and instead of gracefully cleaning 
up after itself, it left a dangling pointer from the RDFServiceImpl to its 
destroyed self.

So, I'd start debugging right around here:

http://lxr.mozilla.org/mozilla/source/xpfe/components/bookmarks/src/nsBookmarks
Service.cpp#1865

and make sure that things go smoothly.

I think we should also move the RegisterDataSource() call to the end of 
nsBookmarksService::Init() to recover more gracefully from problems like this 
in the future. rjc, does that seem reasonable?
<nod>
I realized that my memory profiler tool actually knows when this block
was allocated and freed.  It looks like something like what you said
is happening.  I am going to look at the code, but if anyone looks
at these stacktraces and instantly knows whats going on, please
let me know.

---------------------------------------------------------------- rih -- 20 --
/tmp/jln/mozilla/rdf/base/src/nsRDFService.cpp: 1086: 
reading invalid heap at byte 8 of 136-byte block
    RDFServiceImpl::GetDataSource(const char*, nsIRDFDataSource**)
                                       librdf.so, nsRDFService.cpp, line 1086
    nsXULDocument::CheckTemplateBuilder(nsIContent*)
                                       librdf.so, nsXULDocument.cpp, line 5617
    nsXULDocument::ResumeWalk(void) librdf.so, nsXULDocument.cpp, line 4857
    nsXULDocument::OnStreamComplete(nsIStreamLoader*, nsISupports*, unsigned
int, unsigned int, const char*)
                                       librdf.so, nsXULDocument.cpp, line 5250
    nsStreamLoader::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const
unsigned short*)
                                       libnecko.so, nsStreamLoader.cpp, line 118
    nsFileChannel::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const
unsigned short*)
                                       libnecko.so, nsFileChannel.cpp, line 625
    nsOnStopRequestEvent::HandleEvent(void)
                                libnecko.so, nsAsyncStreamListener.cpp, line 306
    nsStreamListenerEvent::HandlePLEvent(PLEvent*)
                                 libnecko.so, nsAsyncStreamListener.cpp, line 97
    PL_HandleEvent                 libxpcom.so, plevent.c, line 575
    PL_ProcessPendingEvents        libxpcom.so, plevent.c, line 520
    nsEventQueueImpl::ProcessPendingEvents(void)
                                       libxpcom.so, nsEventQueue.cpp, line 316
    event_processor_callback(void*, int, GdkInputCondition)
                                      libwidget_gtk.so, nsAppShell.cpp, line 143
    our_gdk_io_invoke(_GIOChannel*, GIOCondition, void*)
                                       libwidget_gtk.so, nsAppShell.cpp, line 55
    g_io_unix_dispatch             libglib-1.2.so, giounix.c, line 135
    g_main_dispatch                libglib-1.2.so, gmain.c, line 656
    g_main_iterate                 libglib-1.2.so, gmain.c, line 877
    g_main_run                     libglib-1.2.so, gmain.c, line 935
    gtk_main                       libgtk-1.2.so, gtkmain.c, line 476
    nsAppShell::Run(void) libwidget_gtk.so, nsAppShell.cpp, line 313
    nsAppShellService::Run(void)
                               libnsappshell.so, nsAppShellService.cpp, line 371
    main1(int, char**, nsISupports*) mozilla-bin, nsAppRunner.cpp, line 904
    main                           mozilla-bin, nsAppRunner.cpp, line 1187
    __start                        mozilla-bin

This block at address 0x1411f73a0 was allocated at:
    malloc                         libc.so
    __stdnw(unsigned long)         libcxx.so
    nsBookmarksServiceConstructor(nsISupports*, const nsID&, void**)
                              libbookmarks.so, nsBookmarksService.cpp, line 4861
    nsGenericFactory::CreateInstance(nsISupports*, const nsID&, void**)
                                      libxpcom.so, nsGenericFactory.cpp, line 47
    nsComponentManagerImpl::CreateInstance(const nsID&, nsISupports*, const
nsID&, void**)
                                  libxpcom.so, nsComponentManager.cpp, line 1198
    nsComponentManager::CreateInstance(const nsID&, nsISupports*, const nsID&,
void**)
                                       libxpcom.so, nsRepository.cpp, line 81
    nsServiceManagerImpl::GetService(const nsID&, const nsID&, nsISupports**,
nsIShutdownListener*)
                                     libxpcom.so, nsServiceManager.cpp, line 294
    nsServiceManagerImpl::GetService(const char*, const nsID&, nsISupports**,
nsIShutdownListener*)
                                     libxpcom.so, nsServiceManager.cpp, line 432
    nsServiceManager::GetService(const char*, const nsID&, nsISupports**,
nsIShutdownListener*)
                                     libxpcom.so, nsServiceManager.cpp, line 545
    RDFServiceImpl::GetDataSource(const char*, nsIRDFDataSource**)
                                       librdf.so, nsRDFService.cpp, line 1122
    nsXULDocument::CheckTemplateBuilder(nsIContent*)
                                       librdf.so, nsXULDocument.cpp, line 5617
    nsXULDocument::ResumeWalk(void) librdf.so, nsXULDocument.cpp, line 4857
    nsXULDocument::OnStreamComplete(nsIStreamLoader*, nsISupports*, unsigned
int, unsigned int, const char*)
                                       librdf.so, nsXULDocument.cpp, line 5250
    nsStreamLoader::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const
unsigned short*)
                                       libnecko.so, nsStreamLoader.cpp, line 118
    nsFileChannel::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const
unsigned short*)
                                       libnecko.so, nsFileChannel.cpp, line 625
    nsOnStopRequestEvent::HandleEvent(void)
                                libnecko.so, nsAsyncStreamListener.cpp, line 306
    nsStreamListenerEvent::HandlePLEvent(PLEvent*)
                                 libnecko.so, nsAsyncStreamListener.cpp, line 97
    PL_HandleEvent                 libxpcom.so, plevent.c, line 575
    PL_ProcessPendingEvents        libxpcom.so, plevent.c, line 520
    nsEventQueueImpl::ProcessPendingEvents(void)
                                       libxpcom.so, nsEventQueue.cpp, line 316
    event_processor_callback(void*, int, GdkInputCondition)
                                      libwidget_gtk.so, nsAppShell.cpp, line 143
    our_gdk_io_invoke(_GIOChannel*, GIOCondition, void*)
                                       libwidget_gtk.so, nsAppShell.cpp, line 55
    g_io_unix_dispatch             libglib-1.2.so, giounix.c, line 135
    g_main_dispatch                libglib-1.2.so, gmain.c, line 656
    g_main_iterate                 libglib-1.2.so, gmain.c, line 877
    g_main_run                     libglib-1.2.so, gmain.c, line 935
    gtk_main                       libgtk-1.2.so, gtkmain.c, line 476
    nsAppShell::Run(void) libwidget_gtk.so, nsAppShell.cpp, line 313
    nsAppShellService::Run(void)
                               libnsappshell.so, nsAppShellService.cpp, line 371
    main1(int, char**, nsISupports*) mozilla-bin, nsAppRunner.cpp, line 904
    main                           mozilla-bin, nsAppRunner.cpp, line 1187
    __start                        mozilla-bin

This block was freed at:
    free                           libc.so
    operator delete(void*)         libcxx.so
    nsBookmarksService::~nsBookmarksService(void)
                              libbookmarks.so, nsBookmarksService.cpp, line 1861
    nsBookmarksService::Release(void)
                              libbookmarks.so, nsBookmarksService.cpp, line 2742
    nsSupportsArray::Clear(void) libxpcom.so, nsSupportsArray.cpp, line 319
    nsSupportsArray::DeleteArray(void)
                                       libxpcom.so, nsSupportsArray.cpp, line 63
    nsSupportsArray::~nsSupportsArray(void)
                                       libxpcom.so, nsSupportsArray.cpp, line 40
    nsSupportsArray::Release(void) libxpcom.so, nsSupportsArray.cpp, line 59
    nsCOMPtr_base::~nsCOMPtr_base(void) libxpcom.so, nsCOMPtr.cpp, line 49
    nsCOMPtr<nsISupportsArray>::~nsCOMPtr(void)
                             librdf.so, nsCOMPtr.h~alt~deccxx_71F8BB24, line 419
    InMemoryDataSource::~InMemoryDataSource(void)
                                   librdf.so, nsInMemoryDataSource.cpp, line 744
    InMemoryDataSource::Internal::Release(void)
                                   librdf.so, nsInMemoryDataSource.cpp, line 792
    InMemoryDataSource::Release(void)
                                   librdf.so, nsInMemoryDataSource.cpp, line 792
    nsBookmarksService::Release(void)
                              libbookmarks.so, nsBookmarksService.cpp, line 2738
    nsBookmarksServiceConstructor(nsISupports*, const nsID&, void**)
                              libbookmarks.so, nsBookmarksService.cpp, line 4861
    nsGenericFactory::CreateInstance(nsISupports*, const nsID&, void**)
                                      libxpcom.so, nsGenericFactory.cpp, line 47
    nsComponentManagerImpl::CreateInstance(const nsID&, nsISupports*, const
nsID&, void**)
                                  libxpcom.so, nsComponentManager.cpp, line 1198
    nsComponentManager::CreateInstance(const nsID&, nsISupports*, const nsID&,
void**)
                                       libxpcom.so, nsRepository.cpp, line 81
    nsServiceManagerImpl::GetService(const nsID&, const nsID&, nsISupports**,
nsIShutdownListener*)
                                     libxpcom.so, nsServiceManager.cpp, line 294
    nsServiceManagerImpl::GetService(const char*, const nsID&, nsISupports**,
nsIShutdownListener*)
                                     libxpcom.so, nsServiceManager.cpp, line 432
    nsServiceManager::GetService(const char*, const nsID&, nsISupports**,
nsIShutdownListener*)
                                     libxpcom.so, nsServiceManager.cpp, line 545
    RDFServiceImpl::GetDataSource(const char*, nsIRDFDataSource**)
                                       librdf.so, nsRDFService.cpp, line 1122
    nsXULDocument::CheckTemplateBuilder(nsIContent*)
                                       librdf.so, nsXULDocument.cpp, line 5617
    nsXULDocument::ResumeWalk(void) librdf.so, nsXULDocument.cpp, line 4857
    nsXULDocument::OnStreamComplete(nsIStreamLoader*, nsISupports*, unsigned
int, unsigned int, const char*)
                                       librdf.so, nsXULDocument.cpp, line 5250
    nsStreamLoader::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const
unsigned short*)
                                       libnecko.so, nsStreamLoader.cpp, line 118
    nsFileChannel::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const
unsigned short*)
                                       libnecko.so, nsFileChannel.cpp, line 625
    nsOnStopRequestEvent::HandleEvent(void)
                                libnecko.so, nsAsyncStreamListener.cpp, line 306
    nsStreamListenerEvent::HandlePLEvent(PLEvent*)
                                 libnecko.so, nsAsyncStreamListener.cpp, line 97
    PL_HandleEvent                 libxpcom.so, plevent.c, line 575
    PL_ProcessPendingEvents        libxpcom.so, plevent.c, line 520
    nsEventQueueImpl::ProcessPendingEvents(void)
                                       libxpcom.so, nsEventQueue.cpp, line 316
    event_processor_callback(void*, int, GdkInputCondition)
                                      libwidget_gtk.so, nsAppShell.cpp, line 143
    our_gdk_io_invoke(_GIOChannel*, GIOCondition, void*)
                                       libwidget_gtk.so, nsAppShell.cpp, line 55
    g_io_unix_dispatch             libglib-1.2.so, giounix.c, line 135
    g_main_dispatch                libglib-1.2.so, gmain.c, line 656
    g_main_iterate                 libglib-1.2.so, gmain.c, line 877
    g_main_run                     libglib-1.2.so, gmain.c, line 935
    gtk_main                       libgtk-1.2.so, gtkmain.c, line 476
    nsAppShell::Run(void) libwidget_gtk.so, nsAppShell.cpp, line 313
    nsAppShellService::Run(void)
                               libnsappshell.so, nsAppShellService.cpp, line 371
    main1(int, char**, nsISupports*) mozilla-bin, nsAppRunner.cpp, line 904
    main                           mozilla-bin, nsAppRunner.cpp, line 1187
    __start                        mozilla-bin

I think I found the problem, but my understanding of the code is very
weak.  Here is what I think is happening.

nsBookmarksService::Init()
   is invoked, and this method calls 
   gRDF->RegisterDataSource(this, PR_FALSE), which puts the object into the
   hash table.

nsBookmarksService::Release()
    is called which destroys the object.  This method does not make any
    calls to UnRegisterDataSource(), so the object stays in the hash
    table even though it gets deleted.

RDFServiceImpl::GetDataSource()
    is called, which looks up the object in the hash table and tries to
    use it even though it has been deleted.

I think all we need to fix this bug is a call to gRDF->RegisterDataSource()
in the Release() method.  I may try that in a few minutes and see if
it works.  Comments?
We crash someplace else now.  Anybody got any ideas?

stopped at [virtual nsresult nsBookmarksService::ReadBookmarks(void):4134
0x300131916bc]
   4134         rv = gRDFC->MakeSeq(mInner, kNC_BookmarksRoot, nsnull);
(ladebug) p mInner
0x140688300
(ladebug) p gRDFC
0x0
(ladebug) where
>0  0x300131916bc in ((nsBookmarksService*)0x140692480)->ReadBookmarks()
"/tmp/jln/mozilla/xpfe/components/bookmarks/src/nsBookmarksService.cpp":4134
#1  0x30013188134 in ((nsBookmarksService*)0x140692480)->Init()
"/tmp/jln/mozilla/xpfe/components/bookmarks/src/nsBookmarksService.cpp":1945
#2  0x30013193a20 in nsBookmarksServiceConstructor(aOuter=0x0, aIID=const struct
{ ... }, aResult=0x11fffaa38)
"/tmp/jln/mozilla/xpfe/components/bookmarks/src/nsBookmarksService.cpp":4862
#3  0x300000c30cc in
((nsGenericFactory*)0x140641700)->CreateInstance(aOuter=0x0, aIID=const struct {
... }, aResult=0x11fffaa38)
"/tmp/jln/mozilla/xpcom/components/nsGenericFactory.cpp":47
#4  0x300000bf6a8 in
((nsComponentManagerImpl*)0x140016be0)->CreateInstance(aClass=const struct { ...
}, aDelegate=0x0, aIID=const struct { ... }, aResult=0x11fffaa38)
"/tmp/jln/mozilla/xpcom/components/nsComponentManager.cpp":1198
#5  0x300000ccef4 in nsComponentManager::CreateInstance(aClass=const struct {
... }, aDelegate=0x0, aIID=const struct { ... }, aResult=0x11fffaa38)
"/tmp/jln/mozilla/xpcom/components/nsRepository.cpp":81
#6  0x300000ce7a8 in
((nsServiceManagerImpl*)0x14000c2e0)->GetService(aClass=const struct { ... },
aIID=const struct { ... }, result=0x11fffabc8, shutdownListener=0x0)
"/tmp/jln/mozilla/xpcom/components/nsServiceManager.cpp":294
#7  0x300000cede0 in
((nsServiceManagerImpl*)0x14000c2e0)->GetService(aProgID=0x11fffabd0="component://netscape/rdf/datasource?name=bookmarks",
aIID=const struct { ... }, result=0x11fffabc8, shutdownListener=0x0)
"/tmp/jln/mozilla/xpcom/components/nsServiceManager.cpp":432

I have confirmed that this is caused by the timer failing to be created.  So
there are two issues: Why does the timer not work, and how not to pollute the
cache if the timer fails.

My debugger can not follow the code through the inline functions inside of
do_CreateInstance().  Does anyone (Pav?) know where I can put a breakpoint to
see whats going wrong with the timer?  Here is the code I am talking
about:(ladebug) w
   1949         busyResource = nsnull;
   1950 
   1951         if (!mTimer)
   1952         {
   1953                 busySchedule = PR_FALSE;
>  1954                 mTimer = do_CreateInstance("component://netscape/timer",
&rv);
   1955                 if (NS_FAILED(rv)) return rv;
   1956                 mTimer->Init(nsBookmarksService::FireTimer, this,
BOOKMARK_TIMEOUT, NS_PRIORITY_LOWEST, NS_TYPE_REPEATING_SLACK);
   1957                 // Note: don't addref "this" as we'll cancel the timer
in the nsBookmarkService destructor
   1958         }

Chris, thanks for the patch.  I tried it out, and it crashes in the same place
that it did when I played with it on Sat night:

Thread received signal SEGV
stopped at [virtual nsresult nsBookmarksService::ReadBookmarks(void):4133
0x30006823da0]
   4133         rv = gRDFC->MakeSeq(mInner, kNC_BookmarksRoot, nsnull);
(ladebug) p gRDFC
0x0(ladebug) where
>0  0x30006823da0 in ((nsBookmarksService*)0x1406f9b80)->ReadBookmarks()
"/tmp/jln/mozilla/xpfe/components/bookmarks/src/nsBookmarksService.cpp":4133
#1  0x3000681a2a4 in ((nsBookmarksService*)0x1406f9b80)->Init()
"/tmp/jln/mozilla/xpfe/components/bookmarks/src/nsBookmarksService.cpp":1941

Its not real obvious to me how gRDF could be non-null and gRDFC could be null
unless the bm_AddRefGlobals() function is failing, but I think we check for
that.  If the timer code worked, it would mask this problem because we would
not have to figure out how to back out of the bookmark creation.  Given that
the timer code needs to be fixed, is it worth spending time figuring out how
to make mozilla not crash if it fails?

I am learning a lot here, but I am in way over my head.  This is the first time
I have looked at XPCOM code.  I really appreciate your help.  Thanks again,  Jim
In an ideal world, the code could recover gracefully from being slapped over the 
head with a wet trout :-). That said, your comments are right on the mark: our 
efforts are much better spent fixing timers than bullet-proofing the bookmarks 
module.
hmm... I have no idea why timers would fail to get created.  What does it
return?
Pav, Here is the rv value.  If you give me a function to break in inside the
timer code, I can trace through this.  ladebug will not step through inlined
functions very well.

[1] stopped at [nsresult nsBookmarksService::Init(void):1954 0x3000681a35c]
   1954                 mTimer = do_CreateInstance("component://netscape/timer",
&rv);
(ladebug) n
stopped at [nsresult nsBookmarksService::Init(void):1955 0x3000681a37c]
   1955                 if (NS_FAILED(rv)) return rv;
(ladebug) p rv
2147746132

i'm pretty sure that is succeed...  unless i'm missing something.  I suppose you
could break in nsTimerGtk::nsTimerGtk() and see if it gets constructed
I think the problem has to do with MOZ_MONOLITHIC_TOOLKIT.  The timer
code does not seem to get linked in if that is defined.  I am seeing
if Tru64 will build without that flag now, but thats just a workaround.
It is MOZ_MONOLYTHIC_TOOLKIT.  I am going to check in a change to
configure.in to make it not use that flag under Tru64, but since every
platform that does not explicitly turn it off gets this option, this
should really be fixed.
I guess I should be more explicit.  The library that is supposed to define
nsTimerGtk does not contain that class if MOZ_MONOLYTHIC_TOOLKIT is defined.
Its pretty obvious from the Makefile down in widget/timers/src/unix/gtk whats
going on, but its not clear what the original intention was, so I want to let
someone else decide what the right way to fix this problem is.  This bug is
probably going to kill IRIX and HPUX too.  MOZ_MONOLYTHIC_TOOLKIT is set for
every platform that is not explicitly listed as not needing it.  I added Tru64
to the list since it seems to work fine with out it.
I am seeing this on HPUX as you suspected. The timer doesn't get created when 
attempting to load 'rdf:bookmarks' and 'rdf:internetsearch', however it appears 
the bookmarks are getting loaded ( haven't stepped through the internetsearch 
occurence) at least according to the output.

output from command line:

Obtained name of Personal Toolbar from bookmarks string bundle.
Start reading in bookmarks.html
Finished reading in bookmarks.html  (138701 microseconds)
WARNING: unable to load datasource 'rdf:bookmarks', file nsXULDocument.cpp, line 
5652
WARNING: unable to load datasource 'rdf:internetsearch', file nsXULDocument.cpp, 
line 5652


Adding crash keyword
Keywords: crash
When trying to get a data source for rdf:bookmarks init gets called, followed by 
a call to release, which releases the references to bookmark service object ( i 
think ). I don't understand why it gets called, I assume since the init call is 
returning a failure code ( from the failed timer init ).

HP is crashing not on the initial attempt to load the bookmarks, but when we 
call GetDataSource ( nsRDFService.cpp ) a second time and the check is made to 
see if the bookmarks are cached. When an attempt to addref the return value of 
the NS_STATIC_CAST (line 1086 )is made it cores. So whatever is coming out of 
the PL_HashTableLookup ( line 1083 ) is bad in some way. We had a similar 
problem that dealt with mis-aligned data ( not on a word boundary ) but that 
doesn't seem to be the case here.
jgaunt: you need to fix timers.
See if the HP really needs  MOZ_MONOLYTHIC_TOOLKIT defined in configure.  If it
does not then thats a simple workaround.  The problem is the timer object is not
in any library if that is defined.  Its a Makefile problem.
unsetting MOZ_MONOLITHIC_TOOLKIT did the trick. Everything seems to be running 
fine. Of course this is just a workaround.


Index: configure.in
===================================================================
RCS file: /cvsroot/mozilla/configure.in,v
retrieving revision 1.648
diff -r1.648 configure.in
2732a2733
> dnl hpux11 added by John Gaunt  -  workaround for timer problems - bug 39747
2738a2740
>     *-hpux11.*)   MOZ_MONOLITYIC_TOOLKIT= ;;

This bug really isn't invalid, but...I'm marking it as such because there isn't
any better thing to call it.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → INVALID
verif. INVALID
Status: RESOLVED → VERIFIED
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: