443554 - Locking freed nsProxyObjectManager lock causes hang

Status: RESOLVED WONTFIX

(Core :: XPCOM, defect)

Description

[Boris Sukholitko]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9) Gecko/2008061015 Firefox/3.0
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9) Gecko/2008061015 Firefox/3.0

There is a possiblity of locking nsProxyObjectManager lock after the
instance was released.

The following is the code from nsProxyObject::LockedRelease() function
(at xpcom/proxy/src/nsProxyEvent.cpp):

398     nsProxyObjectManager *pom = nsProxyObjectManager::GetInstance();
399     pom->LockedRemove(this);
400
401     nsAutoUnlock unlock(pom->GetLock());
402     delete this;
403     pom->Release();

Note that unlock variable from line 401 will acquire pom->lock on function
exit. On other hand, pom->Release() on line 403 can delete pom instance
if pom reference count goes to 0.

Reproducible: Sometimes

Steps to Reproduce:
It sometimes happen when I call destroy on embedding GtkWidget. It doesn't hang when exiting the program. My guess would be that it depends on specific garbage
which gets passed into kernel.

Comment 1

[Boris Sukholitko]

Attachment: Patch that fixes the problem for me

Comment 2

[Benjamin Smedberg]

If you're holding a proxy object that late into XPCOM shutdown, you're screwed. All proxies should be released by the time we get to http://mxr.mozilla.org/mozilla-central/source/xpcom/build/nsXPComInit.cpp#778, ("xpcom-shutdown" and "xpcom-shutdown-threads" have already been fired).

I don't see a way to protect against this without going through some serious gyrations with nsProxyObjectManager::GetInstance, which I'd prefer to avoid.

I think this bug should probably be WONTFIX, and we should fix whatever code is holding/leaking a proxy.

Comment 3

[Boris Sukholitko]

Turns out I've had an instance on nsIConsoleListener registered during the destroy. Unregistering it before shutdown fixes the problem for me.

Comment 4

[Benjamin Smedberg]

Valid bug, but WONTFIX.