612551 - crash [@ nsXPConnect::GetRuntimeInstance ]

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[Scoobidiver (away)]

It is #86 top crasher in Fennec 4.0b3pre for the last week.

Signature	nsXPConnect::GetRuntimeInstance
UUID	3efb7a66-1dc2-4323-81fe-b623d2101115
Time 	2010-11-15 19:07:23.159241
Uptime	155
Install Age	268314 seconds (3.1 days) since version was first installed.
Product	Fennec
Version	4.0b3pre
Build ID	20101112082335
Branch	2.0
OS	Linux
OS Version	0.0.0 Linux 2.6.32.15-g0f673ed #10 PREEMPT Thu Oct 14 20:09:04 CST 2010 armv7l
CPU	arm
CPU Info	
Crash Reason	SIGSEGV
Crash Address	0x24
User Comments	
App Notes 	HTC PC36100
sprint/htc_supersonic/supersonic/supersonic:2.2/FRF91/271968:user/release-keys
Processor Notes 	
EMCheckCompatibility	False
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	nsXPConnect::GetRuntimeInstance 	js/src/xpconnect/src/nsXPConnect.cpp:268
1 	libxul.so 	nsXPCWrappedJS::Release 	js/src/xpconnect/src/xpcwrappedjs.cpp:232
2 	libxul.so 	nsXPTCStubBase::Release 	xpcom/reflect/xptcall/src/xptcall.cpp:66
3 	libxul.so 	nsCOMPtr_base::~nsCOMPtr_base 	nsCOMPtr.cpp:82
4 	libxul.so 	nsTHashtable<nsBaseHashtableET<nsStringHashKey, nsCOMPtr<nsIObserver> > >::s_ClearEntry 	nsTSubstring.h:113
5 	libxul.so 	PL_DHashTableFinish 	pldhash.c:401
6 	libxul.so 	nsAppShell::~nsAppShell 	widget/src/android/nsAppShell.cpp:90
7 	libxul.so 	nsAppShell::~nsAppShell 	mozalloc.h:252
8 	libxul.so 	nsBaseAppShell::Release 	widget/src/xpwidgets/nsBaseAppShell.cpp:54
9 	libxul.so 	nsCOMPtr_base::~nsCOMPtr_base 	nsCOMPtr.cpp:82
10 	libxul.so 	nsAppStartup::Release 	nsWeakReference.h:91
11 	libxul.so 	nsCOMPtr_base::~nsCOMPtr_base 	nsCOMPtr.cpp:82
12 	libxul.so 	ScopedXPCOMStartup::~ScopedXPCOMStartup 	toolkit/xre/nsAppRunner.cpp:1120
13 	libxul.so 	XRE_main 	nsCOMPtr.h:800
14 	libxul.so 	GeckoStart 	toolkit/xre/nsAndroidStartup.cpp:131
15 	libc.so 	libc.so@0x10f47 	
16 	libc.so 	libc.so@0x10a33 	

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsXPConnect%3A%3AGetRuntimeInstance&version=Fennec%3A4.0b3pre

Comment 1

[Marcia Knous [:marcia]]

I get this crash when I enabled the error console on the HTC Eco using the 20101117 nightly.

Comment 2

[Scoobidiver (away)]

It is #15 top crasher in Fennec 4.0b3pre for the last 3 days.

Comment 3

[Josh Matthews [:jdm]]

It looks to me like this could occur when shutting down the browser with an alert showing with a JS observer attached to it.  ScopedXPCOMStartup's destructor shuts down XPCOM (including XPConnect) before the nsCOMPtr for appStartup goes out of scope, so when the android appshell's observer hashtable is destroyed, the JS observer object stubs can't get a valid XPConnect instance.

Comment 4

[Josh Matthews [:jdm]]

Attachment: Clear appshell observers on xpcom-shutdown.

I suspect this is a reasonable way to fix the situation described in comment 3.

Comment 5

[Matt Brubeck (:mbrubeck)]

I can confirm the theory in comment 3.  I got this crash when shutting down the browser (with the "Quit Fennec" add-on) while an update notification was visible.

Re-nominating for blocking, because we now have STR.

Comment 6

[Josh Matthews [:jdm]]

Attachment: Clear appshell observers on xpcom-shutdown.

Comment 7

[Josh Matthews [:jdm]]

If someone could test this patch for me, I would be much obliged.

Comment 8

[Josh Matthews [:jdm]]

Comment on attachment 501599 [details] [diff] [review]
Clear appshell observers on xpcom-shutdown.

Patch doesn't build.  Fixing now.

Comment 9

[Josh Matthews [:jdm]]

Attachment: Clear appshell observers on xpcom-shutdown.

This patch compiles and *should* work, but I'm finding it really difficult to test.  I've only been able to reproduce the crash with the update available alert, and that doesn't trigger with custom builds AFAIK.

Comment 10

[Josh Matthews [:jdm]]

http://hg.mozilla.org/mozilla-central/rev/e28ce34157f1

Comment 11

[Aaron Train [:aaronmt]]

Verified fixed testing on Mozilla/5.0 (Android; Linux armv7l; rv:2.0b10pre) Gecko/20110112 Firefox/4.0b10pre Fennec/4.0b4pre