899453 - crash in nsHttpHandler::~nsHttpHandler @ nsXPCWrappedJS::Release with Cocoon add-on

Status: RESOLVED DUPLICATE of bug 897503

(Core :: Networking: HTTP, defect)

Description

[Scoobidiver (away)]

It first showed up in 25.0a1/20130724. The regression range might be (low volume):
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5ceea82a79c7&tochange=2983ca6d4d1a
It's likely a regression from bug 884061.

It happens with the Cocoon add-on (https://getcocoon.com/support/download).

Signature 	nsXPCWrappedJS::Release() More Reports Search
UUID 	5b2a76ad-8c76-44c5-8734-f22292130729
Date Processed	2013-07-29 18:29:00.539208
Uptime	24
Last Crash	1516 seconds before submission
Install Age 	1542 since version was first installed.
Install Time 	2013-07-29 18:02:31
Product 	Firefox
Version 	25.0a1
Build ID 	20130729030214
Release Channel 	nightly
OS 	Windows NT
OS Version 	6.2.9200
Build Architecture 	x86
Build Architecture Info 	GenuineIntel family 6 model 42 stepping 7 | 4
Crash Reason 	EXCEPTION_BREAKPOINT
Crash Address 	0x64655a88
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0126, AdapterSubsysID: 04ca1028, AdapterDriverVersion: 9.17.10.2932
Has dual GPUs. GPU #2: AdapterVendorID2: 0x10de, AdapterDeviceID2: 0x0df5, AdapterSubsysID2: 04ca1028, AdapterDriverVersion2: 9.18.13.2049D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsXPCWrappedJS::Release() 	js/xpconnect/src/XPCWrappedJS.cpp
1 	xul.dll 	nsXPTCStubBase::Release() 	xpcom/reflect/xptcall/src/xptcall.cpp
2 	xul.dll 	nsRefPtr<mozilla::dom::Element>::~nsRefPtr<mozilla::dom::Element>() 	obj-firefox/dist/include/nsAutoPtr.h
3 	xul.dll 	nsHttpHandler::~nsHttpHandler() 	netwerk/protocol/http/nsHttpHandler.cpp
4 	xul.dll 	nsHttpHandler::`scalar deleting destructor'(unsigned int) 	
5 	xul.dll 	nsHttpHandler::Release() 	netwerk/protocol/http/nsHttpHandler.cpp
6 	xul.dll 	nsHttpConnection::~nsHttpConnection() 	netwerk/protocol/http/nsHttpConnection.cpp
7 	xul.dll 	nsHttpConnection::`scalar deleting destructor'(unsigned int) 	
8 	xul.dll 	nsHttpConnection::Release() 	netwerk/protocol/http/nsHttpConnection.cpp
9 	xul.dll 	nsHttpConnectionMgr::ShutdownPassCB(nsACString_internal const &,nsAutoPtr<nsHttpConnectionMgr::nsConnectionEntry> &,void *) 	netwerk/protocol/http/nsHttpConnectionMgr.cpp
10 	xul.dll 	nsBaseHashtable<nsCStringHashKey,mozJSComponentLoader::ModuleEntry *,mozJSComponentLoader::ModuleEntry *>::s_EnumStub(PLDHashTable *,PLDHashEntryHdr *,unsigned int,void *) 	obj-firefox/dist/include/nsBaseHashtable.h
11 	xul.dll 	PL_DHashTableEnumerate 	obj-firefox/xpcom/build/pldhash.cpp
12 	xul.dll 	nsBaseHashtable<nsStringHashKey,nsRefPtr<gfxFontFamily>,gfxFontFamily *>::Enumerate(PLDHashOperator (*)(nsAString_internal const &,nsRefPtr<gfxFontFamily> &,void *),void *) 	obj-firefox/dist/include/nsBaseHashtable.h
13 	xul.dll 	nsHttpConnectionMgr::OnMsgShutdown(int,void *) 	netwerk/protocol/http/nsHttpConnectionMgr.cpp
14 	xul.dll 	nsHttpConnectionMgr::nsConnEvent::Run() 	netwerk/protocol/http/nsHttpConnectionMgr.h
15 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
16 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	obj-firefox/xpcom/build/nsThreadUtils.cpp
17 	xul.dll 	nsSocketTransportService::Run() 	netwerk/base/src/nsSocketTransportService2.cpp
18 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
19 	xul.dll 	nsThread::ThreadFunc(void *) 	xpcom/threads/nsThread.cpp
20 	nss3.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
21 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
22 	msvcr100.dll 	_callthreadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c
23 	msvcr100.dll 	_threadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c
24 	kernel32.dll 	BaseThreadInitThunk 	
25 	ntdll.dll 	__RtlUserThreadStart 	
26 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=nsXPCWrappedJS%3A%3ARelease%28%29

Comment 1

[Josh Matthews [:jdm]]

Wow. Cocoon defines it's own cookie service in JS, and nsHttpHandler stores an nsCOMPtr to that which gets release on the socket thread :(

Comment 2

[Patrick McManus [:mcmanus]]

:(

can the handler release just be proxied to the main thread? Thanks for looking at this - I'm mired in IETF land this week and have only short fits of attention span..

Comment 3

[Patrick McManus [:mcmanus]]

steve - probly same as 897503 ?

Comment 4

[Patrick McManus [:mcmanus]]

In addition to the nsCOMPtrs to custom cookie services, this addon creates a HTTP Protocol layer shim too - just like 897503. So I'm going to dup them together to keep the patching atomic.