113950 - Trunk M099 crash exiting browser [@ Compare2To1]

Status: RESOLVED WORKSFORME

(Core :: XPCOM, defect)

Description

[Jay Patel [:jay]]

This is a topcrasher with recent MozillaTrunk builds on Linux:

Compare2To1   9 
BBID range: 18168 - 105228
Min/Max Seconds since last crash: 2847 - 387493
Min/Max Runtime: 2847 - 402675
Crash data range: 2001-12-03 to 2001-12-05
Build ID range: 2001112721 to 2001120512
Keyword List : 
Stack Trace: 

	 Compare2To1()
	 nsStr::StrCompare()
	 CompareWithConversion()
	 EqualsWithConversion()
	 EqualsIgnoreCase()
	 AttributeToString()
	 GetAttr()
	 nsGenericHTMLLeafFormElement::SetForm()
	 nsHTMLInputElement::~nsHTMLInputElement()
	 nsGenericElement::Release()
	 nsHTMLInputElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLFontElement::~nsHTMLFontElement()
	 nsGenericElement::Release()
	 nsHTMLFontElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLTableCellElement::~nsHTMLTableCellElement()
	 nsGenericElement::Release()
	 nsHTMLTableCellElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLTableRowElement::~nsHTMLTableRowElement()
	 nsGenericElement::Release()
	 nsHTMLTableRowElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLTableSectionElement::~nsHTMLTableSectionElement()
	 nsGenericElement::Release()
	 nsHTMLTableSectionElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLTableElement::~nsHTMLTableElement()
	 nsGenericElement::Release()
	 nsHTMLTableElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsBodySuper::~nsBodySuper()
	 nsHTMLBodyElement::~nsHTMLBodyElement()
	 nsGenericElement::Release()
	 nsHTMLBodyElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLHtmlElement::~nsHTMLHtmlElement()
	 nsGenericElement::Release()
	 nsHTMLHtmlElement::Release()
	 nsSupportsArray::Clear()
	 nsDocument::~nsDocument()
	 nsMarkupDocument::~nsMarkupDocument()
	 nsHTMLDocument::~nsHTMLDocument()
	 nsDocument::Release()
	 nsHTMLDocument::Release()
	 nsCOMPtr_base::~nsCOMPtr_base()
	 nsBaseDragService::~nsBaseDragService()
	 nsDragService::~nsDragService()
	 nsBaseDragService::Release()
	 nsDragService::Release()
	 nsCOMPtr_base::assign_with_AddRef()
	 FreeServiceFactoryEntryEnumerate()
	 PL_DHashTableEnumerate()
	 nsComponentManagerImpl::FreeServices()
	 NS_ShutdownXPCOM()
	 main()
	 libc.so.6 + 0x1d65f (0x404a765f)     
     
     (50221)	Comments: i closed the p rogram
     (40937)	Comments: Crash quitting Mozilla.
     (38568)	URL: mail.yahoo.com
     (38568)	Comments: Hit CTRL-W to close tab when there was only one tab.Browser
immediately brought up this QF agent.
     (33245)	URL: at amazon.com crash
     (18168)	Comments: exiting mozilla

Comment 1

[Jay Patel [:jay]]

Attachment: Compare2To1 crashes for Mozilla 0.9.7

This continues to be topcrasher...there are a lot of these crashes with Mozilla

0.9.7.	Any progress on this?  Has anyone taken a look at it?  I have attached
all the unique stack traces for this crash that were reported with M097.

Comment 2

[Alec Flett]

hmm.. I can bullet proof this function, but I'm not sure why we're crashing.. do
we have a reproducable test case? if SetForm() is always in the stack, we can
start looking there...

Comment 3

[Jay Patel [:jay]]

I've tried to reproduce this by doing file->exit from various websites, but I
haven't got a crash with recent MozillaTrunk builds.  Adding qawanted to see if
we can get a reproducible testcase.

Comment 4

[Jay Patel [:jay]]

Here's the latest Talkback info from MozillaTrunk crashes:

Compare2To1   55
		 113950 	 NEW 	  	 [e-mail] 	 --- 	 2002-01-16 
BBID range: 1933494 - 2323607
Min/Max Seconds since last crash: 92 - 263826
Min/Max Runtime: 582 - 263826
Crash data range: 2002-01-21 to 2002-01-30
Build ID range: 2002012011 to 2002012921
Keyword List : 
Stack Trace: 

	 Compare2To1()
	 nsStr::StrCompare2To1()
	 CompareWithConversion()
	 EqualsWithConversion()
	 EqualsIgnoreCase()
	 AttributeToString()
	 GetAttr()
	 nsGenericHTMLLeafFormElement::SetForm()
	 nsHTMLInputElement::~nsHTMLInputElement()
	 nsGenericElement::Release()
	 nsHTMLInputElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLFontElement::~nsHTMLFontElement()
	 nsGenericElement::Release()
	 nsHTMLFontElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLBodyElement::~nsHTMLBodyElement()
	 nsGenericElement::Release()
	 nsHTMLBodyElement::Release()
	 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement()
	 nsHTMLHtmlElement::~nsHTMLHtmlElement()
	 nsGenericElement::Release()
	 nsHTMLHtmlElement::Release()
	 nsSupportsArray::Clear()
	 nsDocument::~nsDocument()
	 nsMarkupDocument::~nsMarkupDocument()
	 nsHTMLDocument::~nsHTMLDocument()
	 nsDocument::Release()
	 nsHTMLDocument::Release()
	 nsCOMPtr_base::~nsCOMPtr_base()
	 nsBaseDragService::~nsBaseDragService()
	 nsDragService::~nsDragService()
	 nsBaseDragService::Release()
	 nsDragService::Release()
	 nsCOMPtr_base::assign_with_AddRef()
	 FreeServiceFactoryEntryEnumerate()
	 PL_DHashTableEnumerate()
	 nsComponentManagerImpl::FreeServices()
	 NS_ShutdownXPCOM()
	 main()
	 libc.so.6 + 0x1d6cf (0x404bb6cf)     (2304211)	URL: http://www.osnews.com
     (2304211)	Comments: closing the browser after a shift-reload
     (2253396)	Comments: Closed the browser's windows
     (2249314)	Comments: closing mozilla
     (2232332)	Comments: Failed after installing java
     (2219255)	Comments: Exiting communicator by pressing control-Q from inside the mail
client.
     (2196668)	URL: iht.com
     (2180893)	Comments: Crash quitting Mozilla.
     (2059213)	Comments: strange behaviour with tabs not opening/not closingdisplaying
incorrect "loading" messages
     (2048256)	URL: www.root.cz
     (2048256)	Comments: I guess that the crash has nothing to do with the site (I wrote
the urljust to be sure) --- I just quited mozilla and switched immediatelymy
windowmaker (0.7.0) desktop before mozilla could finish. Then itcrashed.
     (2035219)	Comments: idle for 10 minutes... crash...
     (2017284)	Comments: Quitting...
     (1935018)	URL:
http://www.zingermans.com/Category.pasp?txtCatalog=Zing_Test&txtCategory=cheeses
     (1935018)	Comments: Closing the browser

The only difference in the stack trace is the second line from the top of the
stack...it's now nsStr::StrCompare2To1() instead of nsStr::StrCompare().  User
comments still mention quitting the app to crash.

Comment 5

[Adam Lock]

*** Bug 122858 has been marked as a duplicate of this bug. ***

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Why doesn't the stack trace show what class GetAttr and AttributeToString are
members of?

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

nsHTMLInputElement::AttributeToString doesn't call EqualsIgnoreCase. 
Something's bogus here.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Why is the drag service holding on to a document, anyway?  Maybe it's too late
during shutdown for something to happen safely.

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

My guess is that somehow the gtk widget code isn't calling EndDragSession when
it should be.  Although that still doesn't explain why doing a GetAttr during
shutdown should crash (although disassembly and registers might help explain that).

Comment 10

[Shiva Thirumazhusai]

Here is the registry Information.

86 Registers:
EAX: 00000069 EBX: 401b0594 ECX: 08091501 EDX: 00000000
ESI: 00000004 EDI: 4116862d ESP: bffff5b8 EBP: bffff5d0
EIP: 4019031a cf pf af zf sf of IF df nt RF vm   IOPL: 0
CS: 0023 DS: 002b SS: 002b ES: 002b FS: 0000 GS: 0007

Code Around the PC: 
4019031a 8b0a             mov     ecx,[edx]
4019031c 8d45fe           lea     eax,[ebp-0x2]
4019031f 50               push    eax
40190320 0fb745fe         movzx   eax,word ptr [ebp-0x2]
40190324 50               push    eax
40190325 52               push    edx
40190326 8b4118           mov     eax,[ecx+0x18]
40190329 ffd0             call    eax
4019032b 8b9344d8ffff     mov     edx,[ebx+0xffffd844]
40190331 8b0a             mov     ecx,[edx]
40190333 8d45fc           lea     eax,[ebp-0x4]
40190336 50               push    eax
40190337 0fb745b9         movzx   eax,word ptr [ebp-0x47]

Comment 11

[Shiva Thirumazhusai]

nominating topcrash bugs for nsbeta1. 

Comment 12

[Alec Flett]

are we still seeing this in the 0.9.8 talkback?

Comment 13

[greer]

Attachment: Comments from M098 and Trunk crashes at Compare2to1

A quick look at M098 and Trunk data turns up 312 incidents under this signature
for M098 and 21 on the Trunk.

Comment 14

[Jay Patel [:jay]]

Updating summary with M098 for future reference, since this has been a
topcrasher for Mozilla 0.9.8.  

There are quite a few incidents on recent MozillaTrunk builds also.  Mostly on
Windows and Linux and almost all the comments mention quitting the browser. 
Some mention closing the window with ctrl-q, but I have not been able to
reproduce or find a solid testcase.

Comment 15

[Matthias Versen [:Matti]]

*** Bug 130215 has been marked as a duplicate of this bug. ***

Comment 16

[Erin Dalzell]

I still see this with the latest nightlies and 0.9.9. I see it when I quit and
oftern when I just switch to Mozilla from another app.

Comment 17

[Jay Patel [:jay]]

Erin:  Are you able to still reproduce this with recent nightly builds?  

Talkback data shows this last occurred on 3/20...so unless someone is able to
reproduce this, we should probably mark this one worksforme.

Comment 18

[Erin Dalzell]

Well, I stopped using tabs and I haven't crashed yet.

I can go back to using them and see.

Comment 19

[Alec Flett]

3/20 was probably one of the last builds where Compare2To1 depended on uconv for
case-insensitive compares... might help explain that.

Comment 20

[Jay Patel [:jay]]

Marking this worksforme per Comment #19.  If anyone is able to reproduce or if
this shows up in Talkback topcrash reports we can reopen it.