58784 - Crash when switching between preference categories

Status: RESOLVED WORKSFORME

(Core Graveyard :: RDF, defect, P3)

Description

[Jeffrey S. Kobal]

1. In Preferences->Helper Applications, select a type from the list
   1a. If you have no types there, or just the empty text/html type, create     
   a new one and select it in the list.  I usually use "Build Files", ".BLD", 
   "text/build", "notepad.exe" (or whatever your editor is)

2. Click on Smart Update (or any other category), then QUICKLY click back to    
   Helper Applications

The ensuing crash is due to a bad pointer (trying to free mSource in the 
destructor for InMemoryAssertionEnumeratorImpl in nsInMemoryDataSource.cpp).

Comment 1

[sairuh (rarely reading bugmail)]

what build and platform are you using?

also, i'm assuming you meant to say Smart Browsing, as there is no Smart Update
pref category. :)

in any case, fwiw, i wasn't able to repro this using 2000.10.30.09-n6 commercial
branch bits on linux, winnt or mac.

Comment 2

[Jeffrey S. Kobal]

Sorry, I should have specified.  I found this on the WinNT M18, and it also 
fails on the OS/2 M18 and a build of the WinNT current trunk.  I said OS-All 
because it fails on both Windows and OS/2.

And yes, I meant "Smart Browsing".

To reproduce this, it's important that you click quickly between the categories, 
and that you have an item selected in the Helper Applications type list first.

Comment 3

[sairuh (rarely reading bugmail)]

cc'ing asa/doron, to see if they can repro this using trunk bits...

Comment 4

[Blake Ross]

I can't on a new win98 trunk build.

Comment 5

[Jeffrey S. Kobal]

My call stack at the time of the crash:

InMemoryAssertionEnumeratorImpl::~InMemoryAssertionEnumeratorImpl() line 415 + 
21 bytes
InMemoryAssertionEnumeratorImpl::`scalar deleting destructor'(unsigned int 1) + 
15 bytes
InMemoryAssertionEnumeratorImpl::Release(InMemoryAssertionEnumeratorImpl * const 
0x00f47638) line 421 + 154 bytes
nsXPCWrappedNative::~nsXPCWrappedNative() line 398 + 27 bytes
nsXPCWrappedNative::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXPCWrappedNative::Release(nsXPCWrappedNative * const 0x050c26f0) line 71 + 31 
bytes
nsXPCWrappedNative::JSObjectFinalized(JSContext * 0x04fb4830, JSObject * 
0x00f456e8) line 96
WrappedNative_Finalize(JSContext * 0x04fb4830, JSObject * 0x00f456e8) line 783
js_FinalizeObject(JSContext * 0x04fb4830, JSObject * 0x00f456e8) line 1600 + 114 
bytes
gc_finalize_phase(JSContext * 0x04fb4830, unsigned int 243) line 907 + 11 bytes
js_GC(JSContext * 0x04fb4830, unsigned int 0) line 1173 + 13 bytes
js_ForceGC(JSContext * 0x04fb4830) line 871 + 11 bytes
JS_GC(JSContext * 0x04fb4830) line 1542 + 9 bytes
nsJSContext::GC(nsJSContext * const 0x05027130) line 1287 + 13 bytes
GlobalWindowImpl::SetNewDocument(GlobalWindowImpl * const 0x050271a0, 
nsIDOMDocument * 0x050c0b7c) line 359
DocumentViewerImpl::Init(DocumentViewerImpl * const 0x050c3a70, nsIWidget * 
0x05023524, nsIDeviceContext * 0x05027650, const nsRect & {...}) line 537
nsDocShell::SetupNewViewer(nsDocShell * const 0x05023b80, nsIContentViewer * 
0x050c3a70) line 2775 + 66 bytes
nsWebShell::SetupNewViewer(nsWebShell * const 0x05023b80, nsIContentViewer * 
0x050c3a70) line 350 + 13 bytes
nsDocShell::Embed(nsDocShell * const 0x05023ba0, nsIContentViewer * 0x050c3a70, 
const char * 0x021311c4, nsISupports * 0x00000000) line 2409 + 23 bytes
nsWebShell::Embed(nsWebShell * const 0x05023ba0, nsIContentViewer * 0x050c3a70, 
const char * 0x021311c4, nsISupports * 0x00000000) line 383
nsDocShell::CreateContentViewer(nsDocShell * const 0x05023b80, const char * 
0x0012d6e8, nsIChannel * 0x050c4d30, nsIStreamListener * * 0x0012d73c) line 2588 
+ 32 bytes
nsDSURIContentListener::DoContent(nsDSURIContentListener * const 0x05023800, 
const char * 0x0012d6e8, int 0, const char * 0x100a66c8 gCommonEmptyBuffer, 
nsIChannel * 0x050c4d30, nsIStreamListener * * 0x0012d73c, int * 0x0012d6cc) 
line 106 + 33 bytes
nsDocumentOpenInfo::DispatchContent(nsIChannel * 0x050c4d30, nsISupports * 
0x00000000) line 359 + 109 bytes
nsDocumentOpenInfo::OnStartRequest(nsDocumentOpenInfo * const 0x050c4aa0, 
nsIChannel * 0x050c4d30, nsISupports * 0x00000000) line 233 + 16 bytes
nsCachedChromeChannel::HandleStartLoadEvent(PLEvent * 0x050c4a40) line 514
PL_HandleEvent(PLEvent * 0x050c4a40) line 576 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x04b694d0) line 509 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x001c0258, unsigned int 49306, unsigned int 0, 
long 79074512) line 1054 + 9 bytes
USER32! 77e71820()

And the crash itself (in nsInMemoryDataSource.cpp):

InMemoryAssertionEnumeratorImpl::~InMemoryAssertionEnumeratorImpl()
{
#ifdef DEBUG_REFS
    --gInstanceCount;
    fprintf(stdout, "%d - RDF: InMemoryAssertionEnumeratorImpl\n", 
gInstanceCount);
#endif

    if (mNextAssertion)
        mNextAssertion->Release();

    NS_IF_RELEASE(mDataSource);
->  NS_IF_RELEASE(mSource);
    NS_IF_RELEASE(mProperty);
    NS_IF_RELEASE(mTarget);
    NS_IF_RELEASE(mValue);
}

mSource is usually set to either 0xdddddddd or 0xfeeefeee at the time of the 
abend.  It looks like this comes from the mObj in the destructor for 
nsXPCWrappedNative.

Comment 6

[Doron Rosenberg (IBM)]

i can't seem tp repro on 2000110204 win98 trunk - reporter, could you get a new
build?

Comment 7

[Asa Dotzler [:asa]]

over to RDF for investigation based on stack trace.

Comment 8

[Jeffrey S. Kobal]

Reproduced today (11/7) on a current Win32 trunk build.

It is key to click very quickly between Smart Browsing and Helper Applications 
after selecting a helper type from the list.

Comment 9

[Håkan Waara]

Reporter, is this crash still reproducable with the latest nightly?

Comment 10

[Jeffrey S. Kobal]

I can still reproduce the assertion, but haven't been able to get it to crash.

Comment 11

[Chris Waterson]

Can't reproduce either :-(. Marking WORKSFORME.

Comment 12

[benc]

tever is not RDF QA anymore