429215 - Crash while closing the Amazing Media Browser Window direct after Startup [@ PR_Lock - nsHashtable::Put - nsMenuBarX::RegisterForContentChanges][@ prmmap.c:52]

Status: VERIFIED FIXED

(Core :: Widget: Cocoa, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: crash stack

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9pre) Gecko/2008041522 Firefox/3.0pre ID:2008041522

Steps to reproduce:
-> Install the Amazing Media Browser Extension https://addons.mozilla.org/en-US/firefox/addon/1468
-> Restart Firefox to enable the Extension
-> Open the Amazing Media Browser via Tools Menu
-> Close Firefox direct after the Amazing Media Browser is displayed
--> Crash

You also get Assertion failure: 0 == rv, at /debug/mozilla/nsprpub/pr/src/pthreads/ptsynch.c:207 and then Firefox crashs

Comment 1

[Mike Beltzner [:beltzner, not reading bugmail]]

Not a top add-on, crash on quit, doesn't block.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

I'm only able to reproduce this if no other windows are open besides
the Amazing Media Browser settings window when I quit Minefield.  (If
there's also a browser window open, I don't see a crash.)

And you don't need to have just installed the Amazing Media Browser
extension -- the same crash happens if you start up the browser with
this extension already installed.

Comment 3

[Steven Michaud [:smichaud] (Retired)]

Attachment: Gdb trace made with debug symbols

Here's a trace made in gdb using a build with debug symbols.

The top of this trace is slightly different, and shows that the crash
happened because PR_Lock()'s "lock" had already been deleted.

Comment 4

[Steven Michaud [:smichaud] (Retired)]

This bug is a recent regression:

It doesn't happen with the 2008-04-07-04-trunk nightly.  It does
happen with the 2008-04-08-04-trunk nightly.

I wonder if it also happens on other platforms.

Comment 5

[Steven Michaud [:smichaud] (Retired)]

Josh, this could be fallout from bug 398514 -- it could be a bug which
that patch uncovered.

(I wasn't able to get the crash to happen in Linux, testing with
today's nightly.)

Comment 6

[Steven Michaud [:smichaud] (Retired)]

Here are two Breakpad logs:

bp-0620029c-0c0f-11dd-bc43-001cc45a2ce4
bp-befe907d-0c0c-11dd-82ef-001cc4e2bf68

I've tried to find out how common this crash is ... but the
crash-stats servers are bogged down and always time out.	

Tomcat, do the extensions you've seen often have "custom" settings
windows like the one for the Amazing Media Browser?  And do you also
see this crash if you quit Minefield with only the custom window open?

If so, we should probably re-nominate this bug for blocking-1.9.

In any case, it seems to have an easy fix.  I'll post a patch in my
next comment.

Comment 7

[Steven Michaud [:smichaud] (Retired)]

Attachment: Fix

Here's a patch that gets rid of this crash.

I haven't yet given it much testing (beyond making sure that it does
get rid of the crash).  But it does seem the right thing to do.

Josh, can you forsee it causing trouble?

A tryserver build will follow shortly.

Comment 8

[Steven Michaud [:smichaud] (Retired)]

Here's a tryserver build made with my patch:

https://build.mozilla.org/tryserver-builds/2008-04-17_09:[e-mail]-1208448857/[e-mail]

Comment 9

[Josh Aas]

Comment on attachment 316239 [details] [diff] [review]
Fix

Nice catch.

Comment 10

[Josh Aas]

This needs to go in for 1.9.

Comment 11

[Steven Michaud [:smichaud] (Retired)]

Landed on trunk:

Checking in widget/src/cocoa/nsMenuBarX.mm;
/cvsroot/mozilla/widget/src/cocoa/nsMenuBarX.mm,v  <--  nsMenuBarX.mm
new revision: 1.67; previous revision: 1.66
done

Comment 12

[Marcia Knous [:marcia]]

No crash for me using Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9pre) Gecko/2008042104 Minefield/3.0pre. Will test on Intel as well and then verify.

Comment 13

[Marcia Knous [:marcia]]

verified fixed using  Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9pre) Gecko/2008042104 Minefield/3.0pre. No crash on either PPC or Mac using the extension in the manner described in the bug.