440002 - crash on exit if popups have been blocked

Status: RESOLVED FIXED

(Camino Graveyard :: Annoyance Blocking, defect)

Description

[Jason Madden]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8) Gecko/20051111 Firefox/2.0.0.1
Build Identifier: Version 2.0a1pre (1.9pre 2008061223)

Camino crashes on normal exit if you have visited a page that resulted in a blocked popup. This is true whether or not the page that triggered the popup is still displayed and whether or not the popup warning has been dismissed.

Noticed in both 1.6.1 and nightly builds.

The stack trace varies from crash to crash, and so I wasn't sure how to reproduce this. Then I saw a stack that mentioned a nsDOMPopupBlockedEvent, and that turned out to be a clue.

Reproducible: Always

Comment 1

[Jason Madden]

Attachment: Crash report showing nsDOMPopupBlockedEvent

Comment 2

[Jason Madden]

Attachment: Crash report for same problem, nightly build, random stack

Comment 3

[Stuart Morgan]

Comment on attachment 325571 [details]
Crash report for same problem, nightly build, random stack

This stack isn't the same problem; it's a different trunk-only bug.

Comment 4

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

The first report is bug 349463; the second is bug 433644.

If you can reproduce these types of crashes on 1.6.1 (and they aren't the PL_DHash... variety; that exists on 1.6.x and trunk), please do file another bug.

Bug 433644 has a rather old Camino build with the patch to fix that crash linked in one of the comments; duping there, since that's more serious.

Comment 5

[Stuart Morgan]

While this does look like a dup of bug 349463, if this is a common source of the crash we could probably improve the situation by setting up an XPCOM shutdown observer in BW, and clearing out the popup blocking array at that point; reopening to consider that.

However, I'm confused about this statement:
> This is true whether or not the page that triggered the popup is
> still displayed

We clear the array on navigation, so I really doubt that this stack could actually happen when no open page had blocked popups. Could you give minimal steps that show that that case is really always reproducible, and attach the corresponding stack?

Comment 6

[Jason Madden]

(In reply to comment #5)
 
> We clear the array on navigation, so I really doubt that this stack could
> actually happen when no open page had blocked popups. Could you give minimal
> steps that show that that case is really always reproducible, and attach the
> corresponding stack?

Indeed, you are correct. I tried to reproduce this in 1.6.1 on a clean account and could not, after having navigated away from the page. Looking back at my crash reports for 1.6.1, I think I chalked most of the PL_DHashTableOperate crashes from bug 349463 to this. Sorry for the confusion.

Comment 7

[Jason Madden]

I found out why this appeared to be always reproducible in my account but not in a different one. 

I had somehow ended up with a Camino window that was one pixel wide by about 50 pixels tall, and flush against the right side of the screen. This window was labeled "..." in the Window menu, and ultimately seemed to contain more than one tab. I hypothesize that this mini-window was loading a URL that tried to display a popup. After getting this window closed (not easy!) I haven't had a mysterious crash-on-exit.

Comment 8

[Jonathan S Abrams]

Seeing this with v1.6.1 on OS X v10.5.3.  CrashReporter data below.

Process:         Camino [4746]
Path:            /Applications/Camino/Camino.app/Contents/MacOS/Camino
Identifier:      org.mozilla.camino
Version:         1.6.1 (1608.05.12)
Code Type:       X86 (Native)
Parent Process:  launchd [71]

Date/Time:       2008-07-19 00:23:50.185 -0400
OS Version:      Mac OS X 10.5.3 (9D34)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000000000c
Crashed Thread:  0

Thread 0 Crashed:
0   libxpcom_core.dylib           	0x00c93ca8 PL_DHashTableOperate + 24
1   libxpcom_core.dylib           	0x00c99498 AtomImpl::~AtomImpl() + 48
2   libxpcom_core.dylib           	0x00c998cd AtomImpl::Release() + 47
3   libxpcom_core.dylib           	0x00c94008 nsCOMPtr_base::~nsCOMPtr_base() + 20
4   org.mozilla.camino            	0x00385269 nsCSSSelector::Reset() + 73
5   org.mozilla.camino            	0x00385306 nsCSSSelector::~nsCSSSelector() + 20
6   org.mozilla.camino            	0x0038535f nsCSSSelectorList::~nsCSSSelectorList() + 25
7   org.mozilla.camino            	0x003853cb CSSStyleRuleImpl::~CSSStyleRuleImpl() + 39
8   org.mozilla.camino            	0x00599f27 nsCSSRule::Release() + 41
9   libxpcom_core.dylib           	0x00ca28c6 nsSupportsArray::Clear() + 44
10  libxpcom_core.dylib           	0x00ca2133 nsSupportsArray::DeleteArray() + 19
11  libxpcom_core.dylib           	0x00ca2297 nsSupportsArray::Release() + 47
12  org.mozilla.camino            	0x0038a81f nsCSSStyleSheetInner::~nsCSSStyleSheetInner() + 59
13  org.mozilla.camino            	0x003887cd nsCSSStyleSheet::~nsCSSStyleSheet() + 215
14  org.mozilla.camino            	0x00387da4 nsCSSStyleSheet::Release() + 44
15  libxpcom_core.dylib           	0x00c94008 nsCOMPtr_base::~nsCOMPtr_base() + 20
16  org.mozilla.camino            	0x0081d76e DeviceContextImpl::GetAltDevice(nsIDeviceContext**) + 50582
17  libxpcom_core.dylib           	0x00c93827 PL_DHashTableFinish + 73
18  org.mozilla.camino            	0x0036e06e CSSLoaderImpl::~CSSLoaderImpl() + 84
19  org.mozilla.camino            	0x0036de45 CSSLoaderImpl::Release() + 41
20  org.mozilla.camino            	0x0042a31c nsDocument::~nsDocument() + 898
21  org.mozilla.camino            	0x0048912a nsHTMLDocument::~nsHTMLDocument() + 398
22  org.mozilla.camino            	0x0042023f nsDocument::Release() + 53
23  libxpcom_core.dylib           	0x00c94008 nsCOMPtr_base::~nsCOMPtr_base() + 20
24  org.mozilla.camino            	0x0046ba17 nsDOMEvent::~nsDOMEvent() + 109
25  org.mozilla.camino            	0x0046fb8c nsDOMPopupBlockedEvent::~nsDOMPopupBlockedEvent() + 70
26  org.mozilla.camino            	0x0046af01 nsDOMEvent::Release() + 41
27  libxpcom_core.dylib           	0x00cad761 ReleaseObjects(void*, void*) + 21
28  libxpcom_core.dylib           	0x00ca96b6 nsVoidArray::EnumerateForwards(int (*)(void*, void*), void*) + 56
29  libxpcom_core.dylib           	0x00cad792 nsCOMArray_base::Clear() + 42
30  libxpcom_core.dylib           	0x00cadbc8 nsArray::Clear() + 20
31  libxpcom_core.dylib           	0x00cadbec nsArray::~nsArray() + 32
32  libxpcom_core.dylib           	0x00cadcfc nsArray::Release() + 42
33  org.mozilla.camino            	0x00003a6a -[BrowserWrapper dealloc] + 238
34  com.apple.AppKit              	0x94789b83 -[NSTabViewItem dealloc] + 92
35  org.mozilla.camino            	0x0004c595 -[BrowserTabViewItem dealloc] + 121
36  com.apple.CoreFoundation      	0x91c425da CFRelease + 90
37  com.apple.CoreFoundation      	0x91bd19e3 __CFArrayReleaseValues + 435
38  com.apple.CoreFoundation      	0x91c42788 _CFRelease + 216
39  com.apple.Foundation          	0x96af37bf NSPopAutoreleasePool + 1007
40  com.apple.Foundation          	0x96afdc42 +[NSAutoreleasePool releaseAllPools] + 50
41  com.apple.AppKit              	0x947e4183 -[NSApplication _deallocHardCore:] + 505
42  com.apple.AppKit              	0x947e2e59 -[NSApplication terminate:] + 742
43  com.apple.AppKit              	0x94703c23 -[NSApplication sendAction:to:from:] + 112
44  com.apple.AppKit              	0x947b2660 -[NSMenu performActionForItemAtIndex:] + 493
45  com.apple.AppKit              	0x947b2365 -[NSCarbonMenuImpl performActionWithHighlightingForItemAtIndex:] + 220
46  com.apple.AppKit              	0x947b1feb -[NSMenu performKeyEquivalent:] + 866
47  com.apple.AppKit              	0x947b0890 -[NSApplication _handleKeyEquivalent:] + 492
48  com.apple.AppKit              	0x946cd853 -[NSApplication sendEvent:] + 3999
49  com.apple.AppKit              	0x9462ae27 -[NSApplication run] + 847
50  com.apple.AppKit              	0x945f8030 NSApplicationMain + 574
51  org.mozilla.camino            	0x000034f4 main + 196
52  org.mozilla.camino            	0x00002dc6 _start + 216
53  org.mozilla.camino            	0x00002ced start + 41

Unlike the OP, I can't find a window that is triggering this.  Confirming bug on the grounds that I am not the OP, and nsDOMPopupBlockedEvent is in my crash log, and I can reproduce this 100% of the time.

Comment 9

[Stuart Morgan]

Comment 8 looks more like bug 349463.

Comment 10

[Stuart Morgan]

Taking so that I remember to implement comment 5.

Comment 11

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

There's a new Talkback incident for the stack in comment 0 in today's 2.0 Talkback.

Comment 12

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Since upgrading to 2.0b2, I've had this (the comment 0 variant of our old friend PL_DHashTableOperate) crash on quit every quit.  

I noticed on relaunch yesterday that one of the sites I had open in a minimized tab had the popup blocker bar visible, and it could well have been visible when I went to quit (this sort-of aligns with what Jason mentions in comment 7).

Comment 13

[Stuart Morgan]

Attachment: fix

Comment 5 goodness.

Comment 14

[Stuart Morgan]

This is really low-risk; shall we add it to 1.6.7?

Comment 15

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #14)
> This is really low-risk; shall we add it to 1.6.7?

Yes, please.

Comment 16

[Mike Pinkerton (not reading bugmail)]

Comment on attachment 365136 [details] [diff] [review]
fix

sr=pink

Comment 17

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Checked in for Stuart on cvs trunk and MOZILLA_1_8_BRANCH ahead of 1.6.7.