700598 - crash [@ mozilla::dom::ContentParent::OnProcessNextEvent]

Status: RESOLVED DUPLICATE of bug 613360

(Core :: IPC, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-8145ced9-39ec-45cb-8fdf-f6a9b2111030 .
============================================================= 
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 		@0x5b653c00 	
1 	libxul.so 	mozilla::dom::ContentParent::OnProcessNextEvent 	dom/ipc/ContentParent.cpp:1141
2 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:595
3 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
4 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
5 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:208
6 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:201
7 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:189
8 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:228
9 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3576
10 	libxul.so 	Java_org_mozilla_gecko_GeckoAppShell_nativeRun 	toolkit/xre/nsAndroidStartup.cpp:132
11 	libmozutils.so 	libmozutils.so@0x9421 	
12 	libdvm.so 	libdvm.so@0x11c76 	
13 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x207cb6 	
14 	dalvik-heap (deleted) 	dalvik-heap @0x763c6e 	
15 	libdvm.so 	libdvm.so@0x41185 	
16 	data@[e-mail]@classes.dex 	data@[e-mail]@classes.dex@0x14400 	
17 	libmozutils.so 	libmozutils.so@0x9417 	
18 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x207cb6 	
19 	libdvm.so 	libdvm.so@0x4113b 	
20 	dalvik-heap (deleted) 	dalvik-heap @0x763c6e 	
21 	libdvm.so 	libdvm.so@0x46787 	
22 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x207cb6 	
23 	data@[e-mail]@classes.dex 	data@[e-mail]@classes.dex@0xceb4 	
24 	dalvik-heap (deleted) 	dalvik-heap @0x763c6e 	
25 	libdvm.so 	libdvm.so@0x11e3e 	
26 	libdvm.so 	libdvm.so@0x16e9e 	
27 	libdvm.so 	libdvm.so@0x1bd5e 	
28 	libdvm.so 	libdvm.so@0x1bcce 	
29 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x20929e 	
30 	libdvm.so 	libdvm.so@0x1ae12 	
31 	libdvm.so 	libdvm.so@0x16b1a 	
32 	core.odex 	core.odex@0x8a3d2 	
33 	dalvik-heap (deleted) 	dalvik-heap @0x6ca8ce 	
34 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x208162 	
35 	dalvik-mark-stack (deleted) 	dalvik-mark-stack @0x4d6916e 	
36 	libdvm.so 	libdvm.so@0x9ef76 	
37 	libdvm.so 	libdvm.so@0x16b7e 	
38 	libdvm.so 	libdvm.so@0x16bf6 	
39 	libdvm.so 	libdvm.so@0x16a9e 	
40 	libdvm.so 	libdvm.so@0x16ac6 	
41 	libdvm.so 	libdvm.so@0x16b1a

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I don't have the slightest idea what could be causing this crash.  ContentParent holds a strong ref to mOldObserver, and doesn't touch it until ~ContentParent.  And nsIThreadInternal holds a strong ref to ContentParent (or whatever's previous in the chain).

HOWEVER, this code has never been used in the wild, and looks like it will never be used.  It can all be removed.