221494 - [FIX][@ nsXULContentBuilder::RemoveGeneratedContent][@ 0x00000100 | nsXULContentBuilder::RemoveGeneratedContent][@ 0x00680064]

Status: RESOLVED FIXED

(Core :: XUL, defect, P1)

Description

[timeless]

nsXULContentBuilder::RemoveGeneratedContent   5
BBID range: 24008310 - 24174051
Min/Max Seconds since last crash: 1 - 4833
Min/Max Runtime: 15 - 4904
Crash data range: 2003-09-30 to 2003-10-06
Build ID range: 2003093004 to 2003100605

Stack Trace:
 nsXULContentBuilder::RemoveGeneratedContent()
 nsXULContentBuilder::RebuildAll()
 nsXULTemplateBuilder::Rebuild()
 XPTC_InvokeByIndex()
 XPCWrappedNative::CallMethod(XPCCallContext& 
XPCWrappedNative::CallMode)()
 XPC_WN_CallMethod()
 js_Invoke()
 js_Interpret()
 js_Invoke()
 js_InternalInvoke()
 JS_CallFunctionValue()
 nsJSContext::CallEventHandler()
 nsJSEventListener::HandleEvent()
 nsEventListenerManager::HandleEventSubType()
 nsEventListenerManager::HandleEvent()
 nsXULElement::HandleDOMEvent()
 PresShell::HandleDOMEventWithTarget()
 nsButtonBoxFrame::MouseClicked()
 nsButtonBoxFrame::HandleEvent()
 PresShell::HandleEventInternal()
 PresShell::HandleEventWithTarget()
 nsEventStateManager::CheckForAndDispatchClick()
 nsEventStateManager::PostHandleEvent()
 PresShell::HandleEventInternal()
 PresShell::HandleEvent()
 nsViewManager::HandleEvent()
 nsView::HandleEvent()
 nsViewManager::DispatchEvent()
 HandleEvent()
 nsWidget::DispatchEvent()
 nsWidget::DispatchWindowEvent()
 nsWidget::DispatchMouseEvent()
 nsWidget::OnButtonReleaseSignal()
 nsWindow::OnButtonReleaseSignal()
 nsWindow::HandleGDKEvent()
 dispatch_superwin_event()
 handle_gdk_event()
 libgdk-1.2.so.0 + 0x17047 (0x40272047)
 libglib-1.2.so.0 + 0xfe75 (0x4029fe75)
 libglib-1.2.so.0 + 0x1032c (0x402a032c)
 libglib-1.2.so.0 + 0x1055c (0x402a055c)
 libgtk-1.2.so.0 + 0x8d707 (0x401c2707)
 nsAppShell::Run()
 nsAppShellService::Run()
 main1()
 main()
 libc.so.6 + 0x15bb4 (0x403c7bb4)
(24174051)        Comments: I closded the print preview with the 
'Close' button 
--this bug is filed based on talkback data, don't come to me asking 
for steps to reproduce or contacts--

Comment 1

[Michiel van Leeuwen (email: mvl+moz@)]

Mozilla crashes for me when removing item from the helper applications panel in
preferences. Recent cvs, and 2003101005, on linux.

Top of stack:

#0  0x00000000 in ?? ()
#1  0x4140662b in nsXULContentBuilder::RemoveGeneratedContent(nsIContent*) (
    this=0x88ae378, aElement=0x869e860)
    at
/home/michiel/mozhack/tree2/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp:1441
#2  0x4140832a in nsXULContentBuilder::RebuildAll() (this=0x88ae378)
    at
/home/michiel/mozhack/tree2/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp:1973
#3  0x4141bd1c in nsXULTemplateBuilder::Rebuild() (this=0x88ae378)
    at
/home/michiel/mozhack/tree2/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp:238
#4  0x407a30d9 in XPTC_InvokeByIndex ()
   from /home/michiel/mozhack/tree2/obj/dist/bin/libxpcom.so
#5  0x408a8524 in XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode) (ccx=@0xbfffd730, mode=CALL_METHOD)
    at
/home/michiel/mozhack/tree2/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2016
#6  0x408b25b8 in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*,
long*) (cx=0x87f85c0, obj=0x869e860, argc=141158496, argv=0x891a49c, vp=0x869e860)
    at
/home/michiel/mozhack/tree2/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1269

(I can get more if needed, but i needed to quit gdb to start mozilla to go to
bugzilla. profile locking...)

Comment 2

[timeless]

for frame #1, could you find out which variable is null?
and which line is actually crashing?
ideally if you could figure out why it's null :)

Comment 3

[Michiel van Leeuwen (email: mvl+moz@)]

(gdb) frame 1
#1  0x4116527f in nsXULContentBuilder::RemoveGeneratedContent(nsIContent*) (
    this=0x888eb10, aElement=0x87cf928)
    at
/home/michiel/mozhack/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp:1446
1446                child->SetDocument(nsnull, PR_TRUE, PR_TRUE);
(gdb) p child
No symbol "child" in current context.


Adding a check for child being nonnull it still crashes. A printf also shows
child is nonnull.
So I have no idea why it is crashing.

Comment 4

[timeless]

*** Bug 224767 has been marked as a duplicate of this bug. ***

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Probable fix

The issue here seems to be that there is no ref held to |child| other than by
|element|, so the RemoveChildAt call calls |child|'s destructor and further
access to |child| crashes.

I've removed the SetDocument call too, since RemoveChildAt handles that.

Michiel, does this fix the crash for you?  I can't reproduce the crash even
without this patch...

Comment 6

[Michiel van Leeuwen (email: mvl+moz@)]

Yes, this seems to fix it. I can't reproduce the crash with the patch (and still
can without)

Comment 7

[Boris Zbarsky [:bzbarsky]]

Taking.

Comment 8

[Johnny Stenback (:jst)]

Comment on attachment 134846 [details] [diff] [review]
Probable fix

r+sr=jst

Comment 9

[Boris Zbarsky [:bzbarsky]]

Checked in.