Martijn Wargers (dead) Reporter
	Description • 18 years ago

See upcoming testcase.
This crashes current Firefox builds (1.8.1 branch and trunk) when the Firebug extension is installed and running.

This regressed on trunk between 2006-05-25 and 2006-05-26.
On branch, the regression happened between 2006-06-06 and 2006-06-26.
I think this regressed with bug 206520.

Talkback ID: TB21297965H
ClassifyWrapper   nsDOMClassInfo::BeginGCMark   nsDOMClassInfo::MarkReachablePreservedWrappers   nsDOMGCParticipantSH::Mark   XPC_WN_Helper_Mark   js_Mark   MarkGCThingChildren   MarkGCThingChildren   MarkGCThingChildren   js_MarkGCThing   js_GC   js_ForceGC   NS_ProcessNextEvent_P   nsBaseAppShell::Run   0x00392aac
0xccccc3c0

Of course, maybe this is not Mozilla's fault, and is Firebug doing something wrong.

	Martijn Wargers (dead) Reporter
	Comment 1 • 18 years ago

This testcase crashes for me when I have Firebug installed.

	timeless
	Comment 2 • 18 years ago

firebug generally can't do things wrong, sure it's possible for chrome code to maliciously trigger a crash, but in almost all cases it's either jsd_xpc, xpconnect or jsd's fault. sometimes it's just dom or spidermonkey's fault.

	Martijn Wargers (dead) Reporter
	Comment 3 • 18 years ago

This is basically the code from firebug that causes the crash. I tried to make a testcase out of it, but failed.
I know this causes it, because, when I uncomment 
     if (this.showXMLHttpRequests)
            this.attachXMLHttpSpy(context, win);
in firebug.js, then the crash doesn't happen.

	Adam Guthrie
	Comment 4 • 18 years ago

*** Bug 342509 has been marked as a duplicate of this bug. ***

	David Baron :dbaron: Assignee
	Comment 5 • 18 years ago

This works for me using a 1.8 branch Linux debug+opt build.  Or is there something I'm supposed to do other than install firebug, restart, and load the testcase?

	Martijn Wargers (dead) Reporter
	Comment 6 • 18 years ago

No, that's all you should do to get this bug. I can still reproduce this on current trunk windows builds. I haven't been able yet to get a good stacktrace in a debug build.

	Sylvain Pasche
	Comment 7 • 18 years ago

(In reply to comment #5)
> This works for me using a 1.8 branch Linux debug+opt build.  Or is there
> something I'm supposed to do other than install firebug, restart, and load the
> testcase?
> 

Be sure to have "Show XmlHttpRequests" checkbox activated in the firebug's Options menu. It is not checked by default, and without it checked, there's no crash.

	David Baron :dbaron: Assignee
	Comment 8 • 18 years ago

(In reply to comment #7)
> Be sure to have "Show XmlHttpRequests" checkbox activated in the firebug's
> Options menu. It is not checked by default, and without it checked, there's no
> crash.

I don't see any such option inside Tools -> Firebug.  Is there some other "Options menu"?

	Martijn Wargers (dead) Reporter
	Comment 9 • 18 years ago

(In reply to comment #8)
> I don't see any such option inside Tools -> Firebug.  Is there some other
> "Options menu"?

You can enable xmlhttprequests logging here (but I thought it was enabled by default), I've made an image of it:
http://wargers.org/firebug.gif

	David Baron :dbaron: Assignee
	Comment 10 • 18 years ago

I got it to crash in a debug build, but not while running under valgrind.

	David Baron :dbaron: Assignee
	Comment 11 • 18 years ago

This turns out to be a pretty trivial problem.  In nsXMLHttpRequest::RemoveEventListener, I leak the ListenerHolder (a typedef to nsMarkedJSFunctionHolder<nsIDOMEventListener>).  (I can't use nsTArray<ListenerHolder> because I need pointer identity on the ListenerHolder objects.)  Leaking the ListenerHolder means its destructor doesn't run, and its destructor cleans up a pointer to the nsXMLHttpRequest object.

	Jonas Sicking (:sicking) No longer reading bugmail consistently
	Comment 12 • 18 years ago

Comment on attachment 231648 [details] [diff] [review]
patch

looks good, r/sr=sicking

	David Baron :dbaron: Assignee
	Comment 13 • 18 years ago

Fix checked in to trunk.

	David Baron :dbaron: Assignee
	Comment 14 • 18 years ago

Fix checked in to MOZILLA_1_8_BRANCH.

	Martijn Wargers (dead) Reporter
	Comment 15 • 18 years ago

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060802 BonEcho/2.0b1
using the testcase and with Firebug installed.