407533 - Camino 1.5.4 crashes [@ nsCOMPtr_base::assign_with_AddRef(nsISupports*)] [@ nsCOMPtr_base::~nsCOMPtr_base] [@ nsCOMArray_base::~nsCOMArray_base()] when closing Camino after closing all tabs

Status: RESOLVED FIXED

(Camino Graveyard :: General, defect)

Description

[Tobias Stohr]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4 (MultiLang)
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; de; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4 (MultiLang)

Camino 1.5.4 chrashes almost every time you do the steps to reproduce this bug.

This appears under Mac OS X 10.5.1, and Mac OS X 10.4.11 with all updates installed.
I use German as my default language.

It appeared directly after updating Camino from 1.5.3 ML.

The English version has this problem, too.

It could be because of the new site icon remove function. Almost everytime I open a website that's not within my bookmarks, Camino doesn't crash. If I open a bookmark, it does. So, perhaps, it crashes when not removing a site icon from icon cache.

Tried the whole thing also with a clean profile via Troubelshoot Camino: the same result.

Reproducible: Always

Steps to Reproduce:
1. Open some tabs. Doesn't matter if they contain a website or are blank
2. Close all tabs via Cmd+W
3. Quit Camino (vid Cmd+Q)
Actual Results:  
Camino crashes. Mac OS X offers ability to do a report.

Comment 1

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Tobias, can you please copy the Mac OS X crash log into a new plain-text file and attach the file to this bug?

Comment 2

[Tobias Stohr]

Attachment: Mac OS X crash log

Sorry I forgot this.

Crash and Log were made under Mac OS X 10.5.1
If you need one from 10.4.11 too or more infos, just tell me.

Comment 3

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Oh, yay, I think this is the bug Sam wanted someone who could repro reliably!

This is already the topcrash for Camino 1.5.4.

Comment 4

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

This has got the @#$##$@ missing symbols again for Camino code.  Talkback reports are showing

-[PreferenceManager refreshStyleSheet:load:]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/preferences/PreferenceManager.mm, line 1084]
-[PreferenceManager refreshAdBlockingStyleSheet:]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/preferences/PreferenceManager.mm, line 670]
-[PreferenceManager syncMozillaPrefs]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/preferences/PreferenceManager.mm, line 840]
-[PreferenceManager initMozillaPrefs]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/preferences/PreferenceManager.mm, line 648]
-[PreferenceManager init]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/preferences/PreferenceManager.mm, line 378]
+[PreferenceManager sharedInstance]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/preferences/PreferenceManager.mm, line 360]
-[SiteIconCache cacheDirectory]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/browser/SiteIconCache.mm, line 174]
-[SiteIconCache imageDataFileWithUUID:]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/browser/SiteIconCache.mm, line 179]
-[SiteIconCache removeImageForURL:uuid:]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/browser/SiteIconCache.mm, line 230]
-[SiteIconCache shutdownNotification:]() [/builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino//builds/tinderbox/Cm1.5.4/Darwin_8.10.1_Depend/build/ppc/camino/src/browser/SiteIconCache.mm, line 310]

for those frames; whether that is accurate or not, I don't know.

This may be a different nsCOMPtr crash than the one Sam was talking about, but the other nsCOMPtr crash is also implicating that same block of Camino code.

Comment 5

[Stuart Morgan]

Awesome, thanks for tracking down the symbols (they are indeed accurate. I know what's going on now, and I'll have a patch shortly. Tobias, good call on the change responsible ;)

Comment 6

[Stuart Morgan]

Attachment: fix

This should take care of it.

Comment 7

[Stuart Morgan]

Landed on trunk, MOZILLA_1_8_BRANCH, and CAMINO_1_5_BRANCH. Tobias, thanks for reporting this.

Comment 8

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

This is indeed showing up as the vast majority of the the nsCOMPtr_base::~nsCOMPtr_base stacks, too, in the 1.5.4 Talkback.

Comment 9

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Also as nsCOMArray_base::~nsCOMArray_base().