795067 - shutdown crash with OMTC on Linux: Segmentation fault in mozilla::ValueObserver::Release inside mozilla::ShutdownXPCOM

Status: RESOLVED DUPLICATE of bug 793738

(Core :: XPCOM, defect)

Description

[Nicolas Silva [:nical]]

I get a segmentation fault while shutting down xpcom, pretty much every time with omtc and layers acceleration enabled on linux.

To reproduce:
 - start firefox with OMTC on Linux (export MOZ_USE_OMTC=1, and pref layers.acceleration.force-enabled = true)
 - exit firefox.

gdb backtrace:

#0  0x00007ffff3e20d18 in mozilla::ValueObserver::Release (this=0x7fffde92ae40) at /home/nico/dev/mozilla/mozilla-central/modules/libpref/src/Preferences.cpp:131
#1  0x00007ffff3bcb905 in nsCOMPtr<nsIRDFDelegateFactory>::~nsCOMPtr (this=0x7fffdec3f728, __in_chrg=<optimized out>) at ../../dist/include/nsCOMPtr.h:492
#2  0x00007ffff3e17388 in PrefCallback::~PrefCallback (this=0x7fffdec3f700, __in_chrg=<optimized out>) at /home/nico/dev/mozilla/mozilla-central/modules/libpref/src/nsPrefBranch.h:85
#3  0x00007ffff3e1b71f in nsAutoPtr<PrefCallback>::~nsAutoPtr (this=0x7fffdeabf5f8, __in_chrg=<optimized out>) at ../../../dist/include/nsAutoPtr.h:71
#4  0x00007ffff3e1c488 in nsBaseHashtableET<PrefCallback, nsAutoPtr<PrefCallback> >::~nsBaseHashtableET (this=0x7fffdeabf5c0, __in_chrg=<optimized out>) at ../../../dist/include/nsBaseHashtable.h:385
#5  0x00007ffff3e1c382 in nsTHashtable<nsBaseHashtableET<PrefCallback, nsAutoPtr<PrefCallback> > >::s_ClearEntry (table=0x7fffec368250, entry=0x7fffdeabf5c0) at ../../../dist/include/nsTHashtable.h:464
#6  0x00007ffff5548594 in PL_DHashTableRawRemove (table=0x7fffec368250, entry=0x7fffdeabf5c0) at /home/nico/dev/mozilla/objdir-linux/xpcom/build/pldhash.cpp:684
#7  0x00007ffff5548707 in PL_DHashTableEnumerate (table=0x7fffec368250, etor=0x7ffff3e1be52 <nsBaseHashtable<PrefCallback, nsAutoPtr<PrefCallback>, PrefCallback*>::s_EnumStub(PLDHashT
able*, PLDHashEntryHdr*, unsigned int, void*)>, arg=0x7fffffffb5a0) at /home/nico/dev/mozilla/objdir-linux/xpcom/build/pldhash.cpp:718
#8  0x00007ffff3e1b8f1 in nsBaseHashtable<PrefCallback, nsAutoPtr<PrefCallback>, PrefCallback*>::Enumerate (this=0x7fffec368250, enumFunc=0x7ffff3e1a3a1 <FreeObserverFunc(PrefCallback*, nsAutoPtr<PrefCallback>&, void*)>, userArg=0x0) at ../../../dist/include/nsBaseHashtable.h:223
#9  0x00007ffff3e1a458 in nsPrefBranch::freeObserverList (this=0x7fffec368200) at /home/nico/dev/mozilla/mozilla-central/modules/libpref/src/nsPrefBranch.cpp:660
#10 0x00007ffff3e1a21a in nsPrefBranch::Observe (this=0x7fffec368200, aSubject=0x7ffff7d80338, aTopic=0x7ffff6a8aea4 "xpcom-shutdown", someData=0x0) at /home/nico/dev/mozilla/mozilla-central/modules/libpref/src/nsPrefBranch.cpp:607
#11 0x00007ffff5568743 in nsObserverList::NotifyObservers (this=0x7fffdad0d540, aSubject=0x7ffff7d80338, aTopic=0x7ffff6a8aea4 "xpcom-shutdown", someData=0x0) at /home/nico/dev/mozilla/mozilla-central/xpcom/ds/nsObserverList.cpp:99
#12 0x00007ffff556a1fd in nsObserverService::NotifyObservers (this=0x7fffec3c1240, aSubject=0x7ffff7d80338, aTopic=0x7ffff6a8aea4 "xpcom-shutdown", someData=0x0) at /home/nico/dev/mozilla/mozilla-central/xpcom/ds/nsObserverService.cpp:149
#13 0x00007ffff55514ba in mozilla::ShutdownXPCOM (servMgr=0x7ffff7d80338) at /home/nico/dev/mozilla/mozilla-central/xpcom/build/nsXPComInit.cpp:546
#14 0x00007ffff55512c2 in NS_ShutdownXPCOM_P (servMgr=0x7ffff7d80338) at /home/nico/dev/mozilla/mozilla-central/xpcom/build/nsXPComInit.cpp:506
#15 0x00007ffff3bd089e in ScopedXPCOMStartup::~ScopedXPCOMStartup (this=0x7ffff7d70d18, __in_chrg=<optimized out>) at /home/nico/dev/mozilla/mozilla-central/toolkit/xre/nsAppRunner.cpp:1111
#16 0x00007ffff3bd9eea in XREMain::XRE_main (this=0x7fffffffb880, argc=4, argv=0x7fffffffdce8, aAppData=0x434520) at /home/nico/dev/mozilla/mozilla-central/toolkit/xre/nsAppRunner.cpp:3869
#17 0x00007ffff3bda0af in XRE_main (argc=4, argv=0x7fffffffdce8, aAppData=0x434520, aFlags=0) at /home/nico/dev/mozilla/mozilla-central/toolkit/xre/nsAppRunner.cpp:3923
#18 0x00000000004029c1 in do_main (argc=4, argv=0x7fffffffdce8) at /home/nico/dev/mozilla/mozilla-central/browser/app/nsBrowserApp.cpp:174
#19 0x0000000000402c1e in main (argc=4, argv=0x7fffffffdce8) at /home/nico/dev/mozilla/mozilla-central/browser/app/nsBrowserApp.cpp:279

Comment 1

[Karl Tomlinson (:karlt)]

I wonder whether nsPrefBranch has been accessed from the wrong thread.

Comment 2

[Benoit Girard (:BenWa)]

it certainly has. we have a bug on file but its hard to check on my phone.

Comment 3

[Josh Matthews [:jdm]]

Sounds like a dup of bug 793738.