Closed Bug 113950 Opened 23 years ago Closed 23 years ago

Trunk M099 crash exiting browser [@ Compare2To1]

Categories

(Core :: XPCOM, defect)

defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jay, Assigned: scc)

References

Details

(Keywords: crash, topcrash)

Crash Data

Attachments

(2 files)

This is a topcrasher with recent MozillaTrunk builds on Linux: Compare2To1 9 BBID range: 18168 - 105228 Min/Max Seconds since last crash: 2847 - 387493 Min/Max Runtime: 2847 - 402675 Crash data range: 2001-12-03 to 2001-12-05 Build ID range: 2001112721 to 2001120512 Keyword List : Stack Trace: Compare2To1() nsStr::StrCompare() CompareWithConversion() EqualsWithConversion() EqualsIgnoreCase() AttributeToString() GetAttr() nsGenericHTMLLeafFormElement::SetForm() nsHTMLInputElement::~nsHTMLInputElement() nsGenericElement::Release() nsHTMLInputElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLFontElement::~nsHTMLFontElement() nsGenericElement::Release() nsHTMLFontElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLTableCellElement::~nsHTMLTableCellElement() nsGenericElement::Release() nsHTMLTableCellElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLTableRowElement::~nsHTMLTableRowElement() nsGenericElement::Release() nsHTMLTableRowElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLTableSectionElement::~nsHTMLTableSectionElement() nsGenericElement::Release() nsHTMLTableSectionElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLTableElement::~nsHTMLTableElement() nsGenericElement::Release() nsHTMLTableElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsBodySuper::~nsBodySuper() nsHTMLBodyElement::~nsHTMLBodyElement() nsGenericElement::Release() nsHTMLBodyElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLHtmlElement::~nsHTMLHtmlElement() nsGenericElement::Release() nsHTMLHtmlElement::Release() nsSupportsArray::Clear() nsDocument::~nsDocument() nsMarkupDocument::~nsMarkupDocument() nsHTMLDocument::~nsHTMLDocument() nsDocument::Release() nsHTMLDocument::Release() nsCOMPtr_base::~nsCOMPtr_base() nsBaseDragService::~nsBaseDragService() nsDragService::~nsDragService() nsBaseDragService::Release() nsDragService::Release() nsCOMPtr_base::assign_with_AddRef() FreeServiceFactoryEntryEnumerate() PL_DHashTableEnumerate() nsComponentManagerImpl::FreeServices() NS_ShutdownXPCOM() main() libc.so.6 + 0x1d65f (0x404a765f) (50221) Comments: i closed the p rogram (40937) Comments: Crash quitting Mozilla. (38568) URL: mail.yahoo.com (38568) Comments: Hit CTRL-W to close tab when there was only one tab.Browser immediately brought up this QF agent. (33245) URL: at amazon.com crash (18168) Comments: exiting mozilla
Keywords: crash, topcrash
This continues to be topcrasher...there are a lot of these crashes with Mozilla 0.9.7. Any progress on this? Has anyone taken a look at it? I have attached all the unique stack traces for this crash that were reported with M097.
hmm.. I can bullet proof this function, but I'm not sure why we're crashing.. do we have a reproducable test case? if SetForm() is always in the stack, we can start looking there...
I've tried to reproduce this by doing file->exit from various websites, but I haven't got a crash with recent MozillaTrunk builds. Adding qawanted to see if we can get a reproducible testcase.
Keywords: qawanted
Summary: Trunk crash [@ Compare2To1] → Trunk, M097 crash exiting browser [@ Compare2To1]
Here's the latest Talkback info from MozillaTrunk crashes: Compare2To1 55 113950 NEW scc@mozilla.org --- 2002-01-16 BBID range: 1933494 - 2323607 Min/Max Seconds since last crash: 92 - 263826 Min/Max Runtime: 582 - 263826 Crash data range: 2002-01-21 to 2002-01-30 Build ID range: 2002012011 to 2002012921 Keyword List : Stack Trace: Compare2To1() nsStr::StrCompare2To1() CompareWithConversion() EqualsWithConversion() EqualsIgnoreCase() AttributeToString() GetAttr() nsGenericHTMLLeafFormElement::SetForm() nsHTMLInputElement::~nsHTMLInputElement() nsGenericElement::Release() nsHTMLInputElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLFontElement::~nsHTMLFontElement() nsGenericElement::Release() nsHTMLFontElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLBodyElement::~nsHTMLBodyElement() nsGenericElement::Release() nsHTMLBodyElement::Release() nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement() nsHTMLHtmlElement::~nsHTMLHtmlElement() nsGenericElement::Release() nsHTMLHtmlElement::Release() nsSupportsArray::Clear() nsDocument::~nsDocument() nsMarkupDocument::~nsMarkupDocument() nsHTMLDocument::~nsHTMLDocument() nsDocument::Release() nsHTMLDocument::Release() nsCOMPtr_base::~nsCOMPtr_base() nsBaseDragService::~nsBaseDragService() nsDragService::~nsDragService() nsBaseDragService::Release() nsDragService::Release() nsCOMPtr_base::assign_with_AddRef() FreeServiceFactoryEntryEnumerate() PL_DHashTableEnumerate() nsComponentManagerImpl::FreeServices() NS_ShutdownXPCOM() main() libc.so.6 + 0x1d6cf (0x404bb6cf) (2304211) URL: http://www.osnews.com (2304211) Comments: closing the browser after a shift-reload (2253396) Comments: Closed the browser's windows (2249314) Comments: closing mozilla (2232332) Comments: Failed after installing java (2219255) Comments: Exiting communicator by pressing control-Q from inside the mail client. (2196668) URL: iht.com (2180893) Comments: Crash quitting Mozilla. (2059213) Comments: strange behaviour with tabs not opening/not closingdisplaying incorrect "loading" messages (2048256) URL: www.root.cz (2048256) Comments: I guess that the crash has nothing to do with the site (I wrote the urljust to be sure) --- I just quited mozilla and switched immediatelymy windowmaker (0.7.0) desktop before mozilla could finish. Then itcrashed. (2035219) Comments: idle for 10 minutes... crash... (2017284) Comments: Quitting... (1935018) URL: http://www.zingermans.com/Category.pasp?txtCatalog=Zing_Test&txtCategory=cheeses (1935018) Comments: Closing the browser The only difference in the stack trace is the second line from the top of the stack...it's now nsStr::StrCompare2To1() instead of nsStr::StrCompare(). User comments still mention quitting the app to crash.
*** Bug 122858 has been marked as a duplicate of this bug. ***
Why doesn't the stack trace show what class GetAttr and AttributeToString are members of?
nsHTMLInputElement::AttributeToString doesn't call EqualsIgnoreCase. Something's bogus here.
Why is the drag service holding on to a document, anyway? Maybe it's too late during shutdown for something to happen safely.
My guess is that somehow the gtk widget code isn't calling EndDragSession when it should be. Although that still doesn't explain why doing a GetAttr during shutdown should crash (although disassembly and registers might help explain that).
Here is the registry Information. 86 Registers: EAX: 00000069 EBX: 401b0594 ECX: 08091501 EDX: 00000000 ESI: 00000004 EDI: 4116862d ESP: bffff5b8 EBP: bffff5d0 EIP: 4019031a cf pf af zf sf of IF df nt RF vm IOPL: 0 CS: 0023 DS: 002b SS: 002b ES: 002b FS: 0000 GS: 0007 Code Around the PC: 4019031a 8b0a mov ecx,[edx] 4019031c 8d45fe lea eax,[ebp-0x2] 4019031f 50 push eax 40190320 0fb745fe movzx eax,word ptr [ebp-0x2] 40190324 50 push eax 40190325 52 push edx 40190326 8b4118 mov eax,[ecx+0x18] 40190329 ffd0 call eax 4019032b 8b9344d8ffff mov edx,[ebx+0xffffd844] 40190331 8b0a mov ecx,[edx] 40190333 8d45fc lea eax,[ebp-0x4] 40190336 50 push eax 40190337 0fb745b9 movzx eax,word ptr [ebp-0x47]
nominating topcrash bugs for nsbeta1.
Keywords: nsbeta1
are we still seeing this in the 0.9.8 talkback?
A quick look at M098 and Trunk data turns up 312 incidents under this signature for M098 and 21 on the Trunk.
OS: Linux → All
Hardware: PC → All
Updating summary with M098 for future reference, since this has been a topcrasher for Mozilla 0.9.8. There are quite a few incidents on recent MozillaTrunk builds also. Mostly on Windows and Linux and almost all the comments mention quitting the browser. Some mention closing the window with ctrl-q, but I have not been able to reproduce or find a solid testcase.
Summary: Trunk, M097 crash exiting browser [@ Compare2To1] → Trunk, M098 crash exiting browser [@ Compare2To1]
*** Bug 130215 has been marked as a duplicate of this bug. ***
I still see this with the latest nightlies and 0.9.9. I see it when I quit and oftern when I just switch to Mozilla from another app.
Erin: Are you able to still reproduce this with recent nightly builds? Talkback data shows this last occurred on 3/20...so unless someone is able to reproduce this, we should probably mark this one worksforme.
Summary: Trunk, M098 crash exiting browser [@ Compare2To1] → Trunk M099 crash exiting browser [@ Compare2To1]
Well, I stopped using tabs and I haven't crashed yet. I can go back to using them and see.
3/20 was probably one of the last builds where Compare2To1 depended on uconv for case-insensitive compares... might help explain that.
Marking this worksforme per Comment #19. If anyone is able to reproduce or if this shows up in Talkback topcrash reports we can reopen it.
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ Compare2To1]
Keywords: qawanted
Component: String → XPCOM
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: