545974 - nsILocalFile / nsIMIMEService Crash

Status: RESOLVED INVALID

(Core :: XPCOM, defect)

Description

[Michael Lelli]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6
Build Identifier: 

I'm not sure what exactly causes the crash, but I've been able to replicate it reliably in this script. It looks like something related to nsIMIMEService but I can't explain why it has a delayed effect.

Reproducible: Always

Steps to Reproduce:
1. Go to this page: http://www.toadking.com/nsIMIMEService.html
2. Save the page to your hard drive and open your saved copy in Firefox
3. Select a file (any file will do)
4. Choose "Accept" from the security dialog that pops up
5. Right click the link that appear and choose "Save Link As..."
6. If Firefox hasn't crashed, repeat step 5 several times. I've also found minimizing and restoring Firefox after doing it a couple times causes the crash
Actual Results:  
Firefox crashes

Expected Results:  
Firefox doesn't crash

Comment 1

[Boris Zbarsky [:bzbarsky]]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff6acb6e9 in nsExternalAppHandler::nsExternalAppHandler (this=
    0x7fffded28000, aMIMEInfo=0x7fffded2c4c0, aTempFileExtension=..., 
    aWindowContext=0x7fffe63794b0, aSuggestedFilename=..., aReason=0, aForceSave=1)
    at ../../../mozilla/uriloader/exthandler/nsExternalHelperAppService.cpp:1139
1139      gExtProtSvc->AddRef();

(gdb) p gExtProtSvc 
$1 = (nsExternalHelperAppService *) 0x0
(gdb) bt
#0  0x00007ffff6acb6e9 in nsExternalAppHandler::nsExternalAppHandler (this=
    0x7fffded28000, aMIMEInfo=0x7fffded2c4c0, aTempFileExtension=..., 
    aWindowContext=0x7fffe63794b0, aSuggestedFilename=..., aReason=0, aForceSave=1)
    at ../../../mozilla/uriloader/exthandler/nsExternalHelperAppService.cpp:1139
#1  0x00007ffff6ac9b45 in nsExternalHelperAppService::DoContent (this=
    0x7fffe84bb4c0, aMimeContentType=..., aRequest=0x7fffded9d800, aWindowContext=
    0x7fffe63794b0, aForceSave=1, aStreamListener=0x7fffffffb950)
    at ../../../mozilla/uriloader/exthandler/nsExternalHelperAppService.cpp:725
#2  0x00007ffff70507b4 in NS_InvokeByIndex_P (that=0x7fffe84bb4c0, methodIndex=3, 
    paramCount=5, params=0x7fffffffb8f0)

Comment 2

[Boris Zbarsky [:bzbarsky]]

Ah.  You're using createInstance on the MIME _service_.  Don't do that.  Use getService.  The delayed effect is almost certainly due to needing a GC to happen, after which the instance destructor nulls out a variable that shouldn't become null until shutdown if the service contract is followed.