17584 - [DOGFOOD] crash closing view source page

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Warren Harris]

I tried to submit a bugzilla bug report and got the following message from the
server:

Software error:

Couldn't get the form data at CGI.pl line 603.
Please send mail to this site's administrator for help. Content-type: text/html

That's bug 17576.

Then I tried to copy the error message out off the page, but Ctrl-C didn't work,
and the Copy menu item was grayed out.

That's bug 17577.

Then I tried to view source to see if I could copy from there, but the view
source page turned up completely blank -- no chrome or anything.

That's bug 17579.

Then I tried to close the page that contained the blank view source. I crashed
here:

nsEventListenerManager::ReleaseListeners(nsVoidArray * * 0x027ee4cc) line 149 +
21 bytes
nsEventListenerManager::~nsEventListenerManager() line 73
nsEventListenerManager::`scalar deleting destructor'(unsigned int 0x00000001) +
15 bytes
nsEventListenerManager::Release(nsEventListenerManager * const 0x027ee4c0) line
86 + 131 bytes
nsGenericElement::~nsGenericElement() line 185 + 27 bytes
nsGenericContainerElement::~nsGenericContainerElement() line 1410 + 20 bytes
nsGenericXMLElement::~nsGenericXMLElement() line 66 + 8 bytes
nsXMLElement::~nsXMLElement() line 75 + 11 bytes
AnonymousElement::~AnonymousElement() + 15 bytes
AnonymousElement::`scalar deleting destructor'(unsigned int 0x00000001) + 15
bytes
nsXMLElement::Release(nsXMLElement * const 0x027ed190) line 93 + 131 bytes
AnonymousElement::Release(AnonymousElement * const 0x027ed190) line 212 + 12
bytes
nsEventStateManager::~nsEventStateManager() line 91 + 27 bytes
nsEventStateManager::`scalar deleting destructor'(unsigned int 0x00000001) + 15
bytes
nsEventStateManager::Release(nsEventStateManager * const 0x0279a8c0) line 108 +
131 bytes
nsCOMPtr<nsIEventStateManager>::~nsCOMPtr<nsIEventStateManager>() line 458
nsPresContext::~nsPresContext() line 116 + 28 bytes
GalleyContext::~GalleyContext() line 41 + 8 bytes
GalleyContext::`scalar deleting destructor'(unsigned int 0x00000001) + 15 bytes
nsPresContext::Release(nsPresContext * const 0x0268ada0) line 118 + 134 bytes
nsCOMPtr<nsIPresContext>::~nsCOMPtr<nsIPresContext>() line 458
DocumentViewerImpl::~DocumentViewerImpl() line 275 + 33 bytes
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 0x00000001) + 15
bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x0268a9d0) line 217 +
134 bytes
nsWebShell::Destroy(nsWebShell * const 0x026a83b0) line 1168 + 27 bytes
nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame() line 434
nsHTMLFrameInnerFrame::`scalar deleting destructor'(unsigned int 0x00000001) +
15 bytes
nsFrame::Destroy(nsFrame * const 0x026a85a0, nsIPresContext & {...}) line 367 +
34 bytes
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x026a8a10, nsIPresContext &
{...}) line 92
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x01f91398, nsIPresContext &
{...}) line 92
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x01f8dd58, nsIPresContext &
{...}) line 92
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x01f8c240, nsIPresContext &
{...}) line 92
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x01f25028, nsIPresContext &
{...}) line 92
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x02283b10, nsIPresContext &
{...}) line 92
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x02282030, nsIPresContext &
{...}) line 92
ViewportFrame::Destroy(ViewportFrame * const 0x02282030, nsIPresContext & {...})
line 134
FrameManager::~FrameManager() line 337
FrameManager::`scalar deleting destructor'(unsigned int 0x00000001) + 15 bytes
FrameManager::Release(FrameManager * const 0x01c747a0) line 322 + 134 bytes
PresShell::~PresShell() line 552 + 27 bytes
PresShell::`scalar deleting destructor'() + 15 bytes
PresShell::Release(PresShell * const 0x01c74ce0) line 483 + 138 bytes
nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 458
DocumentViewerImpl::~DocumentViewerImpl() line 275 + 22 bytes
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 0x00000001) + 15
bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x01c4a0b0) line 217 +
134 bytes
nsWebShell::Destroy(nsWebShell * const 0x01088e30) line 1168 + 27 bytes
nsWebShellWindow::Close(nsWebShellWindow * const 0x00fc8c10) line 467
nsWebShellWindow::HandleEvent(nsGUIEvent * 0x0012f82c) line 528
nsWindow::DispatchEvent(nsWindow * const 0x00fc8ad4, nsGUIEvent * 0x0012f82c,
nsEventStatus & nsEventStatus_eIgnore) line 401 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f82c) line 422
nsWindow::DispatchStandardEvent(unsigned int 0x00000065) line 437 + 15 bytes
nsWindow::OnDestroy() line 3158
nsWindow::ProcessMessage(unsigned int 0x00000002, unsigned int 0x00000000, long
0x00000000, long * 0x0012fa0c) line 2459
nsWindow::WindowProc(HWND__ * 0x009a0aee, unsigned int 0x00000002, unsigned int
0x00000000, long 0x00000000) line 579 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
USER32! 77e718d2()
USER32! 77e727fe()
USER32! 77e72889()
nsWindow::WindowProc(HWND__ * 0x009a0aee, unsigned int 0x00000010, unsigned int
0x00000000, long 0x00000000) line 586 + 31 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
USER32! 77e718d2()
USER32! 77e727fe()
USER32! 77e72889()
nsWindow::WindowProc(HWND__ * 0x009a0aee, unsigned int 0x00000112, unsigned int
0x0000f060, long 0x000003ac) line 586 + 31 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
USER32! 77e718d2()
USER32! 77e727fe()
USER32! 77e72889()
nsWindow::WindowProc(HWND__ * 0x009a0aee, unsigned int 0x000000a1, unsigned int
0x00000014, long 0x000003ac) line 586 + 31 bytes
USER32! 77e71820()

    for (i = 0; i < count; i++) {
      ls = (nsListenerStruct*)(*aListeners)->ElementAt(i);
      if (ls != nsnull) {
==>        NS_IF_RELEASE(ls->mListener);
        PR_DELETE(ls);
      }
    }

ls->mListener is 0xdddddddd -- already deleted.

Comment 1

[rickg]

Nisheeth -- this is a placeholder bug. I suspect much worse things are going on
for this crash, but since XML seems to be involved, I thought I let you take a
look.

Comment 2

[leger]

Putting on PDT+ radar.

Comment 3

[Nisheeth Ranjan]

Accepting bug and setting milestone to M11 for now.

Comment 4

[Nisheeth Ranjan]

I'm running into a crash loading bugzilla pages (see bug 17817).  Marking this
bug dependendent on 17817.

Comment 5

[Nisheeth Ranjan]

This bug is no longer ocurring.  Marking worksforme.

Comment 6

[Chris Petersen]

With the 199911106 build, I not reproducing the problem that is described.
Marking as verified Works for me.

Comment 7

[Chris Petersen]

With the 199911106 build, I not reproducing the problem that is described.
Marking as verified Works for me.