476457 - Crash [@ nsTArray_base::Length]

Status: VERIFIED DUPLICATE of bug 476349

(Core :: Graphics: ImageLib, defect)

Description

[Bob Clary [:bc] (inactive)]

This crash occurs in a number of the JavaScript Tests in the browser only. Occurs on mozilla-central and mozilla-1.9.1

<http://test.bclary.com/tests/mozilla.org/js/js-test-driver-standards.html?test=js1_5/GC/regress-338653.js;language=type;text/javascript> is just one example of many.

#0  0x05b482ba in nsTArray_base::Length (this=0xa4d7258) at ../../../dist/include/xpcom/nsTArray.h:66
#1  0x05b58761 in nsExpirationTracker<imgCacheEntry, 3u>::RemoveObject (this=0xa4d7218, aObj=0xa6003e8) at ../../../dist/include/xpcom/nsExpirationTracker.h:152
#2  0x05b4e61c in imgLoader::RemoveFromCache (entry=0xa6003e8) at /work/mozilla/builds/1.9.2/mozilla/modules/libpr0n/src/imgLoader.cpp:1055
#3  0x05b4e758 in imgLoader::EvictEntries (aCacheToClear=@0x5baeb00, aQueueToClear=@0x5baeb20) at /work/mozilla/builds/1.9.2/mozilla/modules/libpr0n/src/imgLoader.cpp:1090
#4  0x05b4e7f8 in imgLoader::ClearChromeImageCache () at /work/mozilla/builds/1.9.2/mozilla/modules/libpr0n/src/imgLoader.cpp:664
#5  0x05b4e815 in imgLoader::Shutdown () at /work/mozilla/builds/1.9.2/mozilla/modules/libpr0n/src/imgLoader.cpp:655
#6  0x05b42dbb in imglib_Shutdown (aSelf=0xa091068) at /work/mozilla/builds/1.9.2/mozilla/modules/libpr0n/build/nsImageModule.cpp:323
#7  0x0018e1e2 in nsGenericModule::Shutdown (this=0xa091068) at nsGenericFactory.cpp:340
#8  0x0018e210 in ~nsGenericModule (this=0xa091068) at nsGenericFactory.cpp:237
#9  0x0018e3e5 in nsGenericModule::Release (this=0xa091068) at nsGenericFactory.cpp:245
#10 0x001f82b6 in nsCOMPtr<nsIModule>::assign_assuming_AddRef (this=0xa0d0b50, newPtr=0x0) at ../../dist/include/xpcom/nsCOMPtr.h:495
#11 0x001f833a in nsCOMPtr<nsIModule>::assign_with_AddRef (this=0xa0d0b50, rawPtr=0x0) at ../../dist/include/xpcom/nsCOMPtr.h:1171
#12 0x001fb408 in nsCOMPtr<nsIModule>::operator= (this=0xa0d0b50, rhs=0x0) at ../../dist/include/xpcom/nsCOMPtr.h:640
#13 0x001fa7e7 in nsNativeModuleLoader::ReleaserFunc (aHashedFile=0xa094e34, aLoadData=@0xa0d0b50)
    at /work/mozilla/builds/1.9.2/mozilla/xpcom/components/nsNativeComponentLoader.cpp:240
#14 0x001fb209 in nsBaseHashtable<nsHashableHashKey, nsNativeModuleLoader::NativeLoadData, nsNativeModuleLoader::NativeLoadData>::s_EnumStub (table=0xa05dcb8, hdr=0xa0d0b48, 
    number=51, arg=0xbfcbbf5c) at ../../dist/include/xpcom/nsBaseHashtable.h:346
#15 0x0017c805 in PL_DHashTableEnumerate (table=0xa05dcb8, 
    etor=0x1fb1c8 <nsBaseHashtable<nsHashableHashKey, nsNativeModuleLoader::NativeLoadData, nsNativeModuleLoader::NativeLoadData>::s_EnumStub(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*)>, arg=0xbfcbbf5c) at pldhash.c:754
#16 0x001fb30e in nsBaseHashtable<nsHashableHashKey, nsNativeModuleLoader::NativeLoadData, nsNativeModuleLoader::NativeLoadData>::Enumerate (this=0xa05dcb8, 
    enumFunc=0x1fa7ce <nsNativeModuleLoader::ReleaserFunc(nsIHashable*, nsNativeModuleLoader::NativeLoadData&, void*)>, userArg=0x0)
    at ../../dist/include/xpcom/nsBaseHashtable.h:221
#17 0x001fa7a8 in nsNativeModuleLoader::UnloadLibraries (this=0xa05dcb4) at /work/mozilla/builds/1.9.2/mozilla/xpcom/components/nsNativeComponentLoader.cpp:281
#18 0x001f40a4 in nsComponentManagerImpl::Shutdown (this=0xa05dc48) at /work/mozilla/builds/1.9.2/mozilla/xpcom/components/nsComponentManager.cpp:748
#19 0x00192615 in NS_ShutdownXPCOM_P (servMgr=0x0) at /work/mozilla/builds/1.9.2/mozilla/xpcom/build/nsXPComInit.cpp:847
#20 0x001305fe in ~ScopedXPCOMStartup (this=0xbfcbc13c) at /work/mozilla/builds/1.9.2/mozilla/toolkit/xre/nsAppRunner.cpp:881
#21 0x001319e4 in ShowProfileManager (aProfileSvc=0xa034b50, aNative=0xa0287d8) at /work/mozilla/builds/1.9.2/mozilla/toolkit/xre/nsAppRunner.cpp:1751
#22 0x00132b70 in SelectProfile (aResult=0xbfcbc6f8, aNative=0xa0287d8, aStartOffline=0xbfcbc6f4, aProfileName=0xbfcbc548)
    at /work/mozilla/builds/1.9.2/mozilla/toolkit/xre/nsAppRunner.cpp:1986
#23 0x00134630 in XRE_main (argc=4, argv=0xbfcbc984, aAppData=0xa00b9a8) at /work/mozilla/builds/1.9.2/mozilla/toolkit/xre/nsAppRunner.cpp:2934
#24 0x08048df1 in main (argc=4, argv=0xbfcbc984) at /work/mozilla/builds/1.9.2/mozilla/browser/app/nsBrowserApp.cpp:156

Comment 2

[Tyler Downer [He/Him]]

v.

Comment 3

[Joe Drew (not getting mail)]

Bob, I was never able to reproduce this crash, but I've put up attachment 361697 [details] [diff] [review] on bug 466586 as a possibility to fix it. Can you give that patch a try, and let me know if it fixes this set of crashes for you?

Comment 4

[Bob Clary [:bc] (inactive)]

Joe, I'll take a look this morning.

Comment 5

[Bob Clary [:bc] (inactive)]

Joe, I've been running tests on 1.9.2 with attachment 361697 [details] [diff] [review] and so far after about 1/2 complete it looks ok. Is that attachment the full patch or should I have applied it in addition to the original?

Comment 6

[Joe Drew (not getting mail)]

It's the full patch. That's good news!