807214 - Crashing at startup will eventually make it impossible to start a debug Firefox because of late write poisoning

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[(no longer active)]

STR:

1. Introduce a startup crash, and restart Firefox a couple of times.
2. The toolkit.startup.recent_crashes pref gets set to a number, and the toolkit.startup.last_success gets set as well.
3. Fix the startup crash.

Now when you start Firefox, we get into a loop, each ending like this:

$ obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/firefox-bin -no-remote -P trunk -foreground
WARNING: Last startup was detected as a crash.: file /Users/ehsanakhgari/moz/mozilla-central/toolkit/components/startup/nsAppStartup.cpp, line 1022
###!!! ASSERTION: consider quit stopper out of bounds: 'mConsiderQuitStopper > 0', file /Users/ehsanakhgari/moz/mozilla-central/toolkit/components/startup/nsAppStartup.cpp, line 580
************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIObserverService.removeObserver]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: resource:///modules/webappsUI.jsm :: webappsUI_uninit :: line 26"  data: no]
************************************************************
WARNING: nsExceptionService ignoring thread destruction after shutdown: file /Users/ehsanakhgari/moz/mozilla-central/xpcom/base/nsExceptionService.cpp, line 166
WARNING: NS_ENSURE_TRUE(thread) failed: file /Users/ehsanakhgari/moz/mozilla-central/netwerk/base/src/nsSocketTransportService2.cpp, line 122
WARNING: unable to post SHUTDOWN message: file /Users/ehsanakhgari/moz/mozilla-central/netwerk/protocol/http/nsHttpConnectionMgr.cpp, line 148
WARNING: An event was posted to a thread that will never run it (rejected): file /Users/ehsanakhgari/moz/mozilla-central/xpcom/threads/nsThread.cpp, line 361
WARNING: Failed dispatching block-event: file /Users/ehsanakhgari/moz/mozilla-central/netwerk/cache/nsCacheService.cpp, line 841
Assertion failure: ok, at /Users/ehsanakhgari/moz/mozilla-central/xpcom/build/mozPoisonWriteMac.cpp:89
Segmentation fault: 11

Removing the toolkit.startup.recent_crashes crash from prefs.js in the profile is a workaround, but this makes recovering those profiles hard.

Comment 1

[Boris Zbarsky [:bzbarsky]]

fwiw, my workaround has been to start an opt build twice on the profile, which clears the pref.... Total hackery.  :(

Comment 2

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

This might be a duplicate of bug 804828. Can you try the patch on that bug (and maybe review it? :-) )

Comment 3

[(no longer active)]

(In reply to Rafael Ávila de Espíndola (:espindola) from comment #2)
> This might be a duplicate of bug 804828. Can you try the patch on that bug
> (and maybe review it? :-) )

Ted beat me to the review!  :-)

Comment 4

[Rafael Ávila de Espíndola (:espindola) (not reading bugmail)]

I just did a debug build and got firefox to show the "start in safe mode" option by killing it multiple times.  After that firefox still starts and shuts down normally, so I think this got fixed.

Comment 5

[(no longer active)]

Thanks, Rafael!