625123 - Crash [@ moz_free] called from JSClassSweeper during exit, double delete

Status: RESOLVED INCOMPLETE

(Core :: XPConnect, defect)

Description

[Honza Bambas (:mayhemer)]

Debug build of yesterday mozilla-central, just closed firefox.  Memory pointed to by 'shared' pointer in JSClassSweeper is filled with 0xDDDDDDDD that indicates it was just deleted from the heap.

No str at the moment, but I will try to have them.

 	msvcr90d.dll!_free_base(void * pBlock=0x0b92c740)  Line 109 + 0x13 bytes	
 	msvcr90d.dll!_free_dbg_nolock(void * pUserData=0x0b92c760, int nBlockUse=1)  Line 1426 + 0x9 bytes	
 	msvcr90d.dll!_free_dbg(void * pUserData=0x0b92c760, int nBlockUse=1)  Line 1258 + 0xd bytes	
 	msvcr90d.dll!free(void * pUserData=0x0b92c760)  Line 49 + 0xb bytes	
 	mozalloc.dll!moz_free(void * ptr=0x0b92c760)  Line 92 + 0xa bytes	
 	xul.dll!operator delete(void * ptr=0x0b92c760)  Line 253 + 0xa bytes	
 	xul.dll!XPCNativeScriptableShared::`scalar deleting destructor'()  + 0x20 bytes	
>	xul.dll!JSClassSweeper(JSDHashTable * table=0x02fc7070, JSDHashEntryHdr * hdr=0x0b5a53e8, unsigned int number=25, void * arg=0x00000000)  Line 198 + 0x1c bytes	
 	mozjs.dll!JS_DHashTableEnumerate(JSDHashTable * table=0x02fc7070, JSDHashOperator (JSDHashTable *, JSDHashEntryHdr *, unsigned int, void *)* etor=0x62490d10, void * arg=0x00000000)  Line 743 + 0x19 bytes	
 	xul.dll!XPCNativeScriptableSharedMap::Enumerate(JSDHashOperator (JSDHashTable *, JSDHashEntryHdr *, unsigned int, void *)* f=0x62490d10, void * arg=0x00000000)  Line 556 + 0x1b bytes	
 	xul.dll!XPCJSRuntime::GCCallback(JSContext * cx=0x0b5a3b68, JSGCStatus status=JSGC_FINALIZE_END)  Line 727	
 	xul.dll!DOMGCCallback(JSContext * cx=0x0b5a3b68, JSGCStatus status=JSGC_FINALIZE_END)  Line 3833 + 0x17 bytes	
 	mozjs.dll!MarkAndSweep(JSContext * cx=0x0b5a3b68, JSGCInvocationKind gckind=GC_NORMAL)  Line 2501 + 0x11 bytes	
 	mozjs.dll!GCUntilDone(JSContext * cx=0x0b5a3b68, JSCompartment * comp=0x00000000, JSGCInvocationKind gckind=GC_NORMAL)  Line 2733 + 0xd bytes	
 	mozjs.dll!js_GC(JSContext * cx=0x0b5a3b68, JSCompartment * comp=0x00000000, JSGCInvocationKind gckind=GC_NORMAL)  Line 2804 + 0x11 bytes	
 	mozjs.dll!JS_GC(JSContext * cx=0x0b5a3b68)  Line 2547 + 0xd bytes	
 	xul.dll!nsXREDirProvider::DoShutdown()  Line 806 + 0xa bytes	
 	xul.dll!ScopedXPCOMStartup::~ScopedXPCOMStartup()  Line 1115	
 	xul.dll!XRE_main(int argc=3, char * * argv=0x0042c4f0, const nsXREAppData * aAppData=0x0042cc10)  Line 3730	
 	firefox.exe!NS_internal_main(int argc=3, char * * argv=0x0042c4f0)  Line 158 + 0x12 bytes	
 	firefox.exe!wmain(int argc=3, wchar_t * * argv=0x00420d00)  Line 128 + 0xd bytes	
 	firefox.exe!__tmainCRTStartup()  Line 583 + 0x19 bytes	
 	firefox.exe!wmainCRTStartup()  Line 403

Comment 1

[Wayne Mery (:wsmwk)]

(In reply to Honza Bambas (:mayhemer) from comment #0)
> Debug build of yesterday mozilla-central, just closed firefox.  Memory
> pointed to by 'shared' pointer in JSClassSweeper is filled with 0xDDDDDDDD
> that indicates it was just deleted from the heap.
> 
> No str at the moment, but I will try to have them.

Honza, did  you ever determine str?

If it does still exist, and moz_free is in the signature, then the crash is exceedingly rare.
https://crash-stats.mozilla.com/query/query?product=Firefox&version=Firefox%3A21.0a1&version=Firefox%3A20.0a2&version=Firefox%3A19.0b1&version=Firefox%3A18.0&version=Firefox%3A20.0a1&version=Firefox%3A19.0a2&version=Firefox%3A18.0b7&version=Firefox%3A18.0b6&version=Firefox%3A18.0b5&version=Firefox%3A18.0b4&version=Firefox%3A18.0b3&version=Firefox%3A18.0b2&range_value=2&range_unit=weeks&date=01%2F15%2F2013+05%3A01%3A04&query_search=signature&query_type=contains&query=moz_free&reason=&build_id=&process_type=any&hang_type=any&do_query=1

Comment 2

[Honza Bambas (:mayhemer)]

Unfortunately not and this never happened again.