293698 - With BFCache ON, MAS can crash when I ask to go back a few pages [@ DocumentViewerImpl::InitInternal]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050510] (nightly) (W98SE)

1. From Back Dropdown list, select a page which is multiple entries back.
R. Can crash.

TB5732115E / 5732115, TB5733937W / 5733937.

This could be related to (MacOS X) bug 293534 !?

Comment 1

[Serge Gautherie (:sgautherie)]

Some more details, as reminder:
*happens on "private" site <www.battle-arenas.net>
*no crash so far when "bfcache = 5" is removed.

Comment 2

[timeless]

Incident ID: 5732115
Stack Signature	nsQueryInterface::operator() 0d1a2cfc
Product ID	MozillaTrunk
Build ID	2005051006
Trigger Time	2005-05-10 15:54:28.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	XPCOM_CORE.DLL + (0000102e)
URL visited	
User Comments	After enabling "bfcache", playing with Back a little ... in an
usual way... but not expected to crash, of course.
Since Last Crash	353 sec
Total Uptime	353 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/build/nsCOMPtr.cpp,
line 47
Stack Trace 	
nsQueryInterface::operator() 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/build/nsCOMPtr.cpp,
line 47]
DocumentViewerImpl::InitInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsDocumentViewer.cpp,
line 819]
DocumentViewerImpl::Open 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsDocumentViewer.cpp,
line 1188]
nsDocShell::RestorePresentation 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 5029]
nsDocShell::InternalLoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 6158]
nsDocShell::LoadHistoryEntry 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 7195]
nsDocShell::LoadURI 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 729]
nsFrameLoader::LoadFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsFrameLoader.cpp,
line 172]
nsGenericHTMLFrameElement::LoadSrc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 3465]
nsGenericElement::AppendChildTo 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2761]
SinkContext::AddLeaf 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 1536]
HTMLContentSink::AddLeaf 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 3059]
CNavDTD::AddLeaf 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 3647]
CNavDTD::HandleStartToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 1711]
CNavDTD::HandleToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 954]
CNavDTD::BuildModel 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 461]
nsParser::BuildModel 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp,
line 2080]

Comment 3

[Serge Gautherie (:sgautherie)]

TB5734649W / 5734649: +/- "same" after trying the steps++ of bug 293534.
{{
User Comments	[...] But, pressed (simple) Back: crashed !
}}

Maybe it's easier/worse than I thought:
I'm disabling bfcache for now.

Comment 4

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050513] (nightly) (W98SE)

Same: TB5824735M / 5824735

Comment 5

[Serge Gautherie (:sgautherie)]

Comment 4 was after bug 293135 checkin.

*****

This one is after bug 293588 checkin, and probably other(s).

This bug seems to have been fixed between
[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050514] (nightly) (W98SE)
and
[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050515] (nightly) (W98SE)

Comment 6

[Serge Gautherie (:sgautherie)]

For the record: (2 talkback records, while narrowing the fix timeframe)

5972087 	nsDocShell::RestorePresentation e0392d1d 	2005-05-19 14:00:13.0 
MozillaOrgMozillaTrunkWin322005051306 	
Testing bug 293698...

5972190  	 nsDocShell::RestorePresentation e0392d1d  	2005-05-19 14:10:14.0  
MozillaOrgMozillaTrunkWin322005051405  	
Testing bug 293698... (This and previous -0513 crash is with a Browser Only
install.)

Comment 7

[Serge Gautherie (:sgautherie)]

(at last) This seems more or less a duplicate of bug 293534...