Closed Bug 41136 Opened 26 years ago Closed 26 years ago

Crash while closing aim after signoff

Categories

(Core :: XUL, defect, P1)

Product:
Core
Component:
XUL
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED WORKSFORME

People

(Reporter: prass, Assigned: garyf)

Details

(Keywords: crash, regression, Whiteboard: [nsbeta2+])

Platform: WinNT Build:May 31, commercial Steps To reproduce: 1. Launch aim with "./netscp6 -aim" 2. Login with your screen name. 3. Choose file->signoff 4. Choose file->close (or quit or close the app by clicking on the x window on top right) The following assertions first come up followed by the crash: ###!!! ASSERTION: SetBounds Size < 0: 'aRect.width >=0 && aRect.height >= 0', file d:\raptor\mozilla\layout\xu l\base\src\nsBox.cpp, line 484 ###!!! ASSERTION: Content Size < 0: 'aContentRect.width >=0 && aContentRect.height >= 0', file d:\raptor\mozil la\layout\xul\base\src\nsBox.cpp, line 468 ###!!! ASSERTION: SetBounds Size < 0: 'aRect.width >=0 && aRect.height >= 0', file d:\raptor\mozilla\layout\xu l\base\src\nsBox.cpp, line 484 ###!!! ASSERTION: Content Size < 0: 'aContentRect.width >=0 && aContentRect.height >= 0', file d:\raptor\mozil la\layout\xul\base\src\nsBox.cpp, line 468 Stack Trace: nsXPCWrappedNative::~nsXPCWrappedNative() line 390 + 24 bytes nsXPCWrappedNative::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsXPCWrappedNative::Release(nsXPCWrappedNative * const 0x03b19970) line 71 + 31 bytes nsXPCWrappedNative::JSObjectFinalized(JSContext * 0x0396be50, JSObject * 0x036d4b78) line 96 WrappedNative_Finalize(JSContext * 0x0396be50, JSObject * 0x036d4b78) line 691 js_FinalizeObject(JSContext * 0x0396be50, JSObject * 0x036d4b78) line 1489 + 114 bytes js_GC(JSContext * 0x0396be50) line 1035 + 11 bytes js_ForceGC(JSContext * 0x0396be50) line 770 + 9 bytes JS_GC(JSContext * 0x0396be50) line 1154 + 9 bytes nsJSContext::GC(nsJSContext * const 0x03968920) line 1067 + 13 bytes GlobalWindowImpl::SetNewDocument(GlobalWindowImpl * const 0x03968980, nsIDOMDocument * 0x00000000) line 280 DocumentViewerImpl::~DocumentViewerImpl() line 406 DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes DocumentViewerImpl::Release(DocumentViewerImpl * const 0x039692a0) line 344 + 154 bytes nsCOMPtr<nsIContentViewer>::assign_assuming_AddRef(nsIContentViewer * 0x00000000) line 449 nsCOMPtr<nsIContentViewer>::assign_with_AddRef(nsISupports * 0x00000000) line 820 nsCOMPtr<nsIContentViewer>::operator=(nsIContentViewer * 0x00000000) line 559 nsDocShell::Destroy(nsDocShell * const 0x0396db34) line 1318 nsWebShell::Destroy(nsWebShell * const 0x0396db34) line 1585 nsDocShell::DestroyChildren(nsDocShell * const 0x02e88900) line 115 nsDocShell::Destroy(nsDocShell * const 0x02e88914) line 1320 nsWebShell::Destroy(nsWebShell * const 0x02e88914) line 1585 nsXULWindow::Destroy(nsXULWindow * const 0x02e88f44) line 424 nsWebShellWindow::Destroy(nsWebShellWindow * const 0x02e88f44) line 1736 nsChromeTreeOwner::Destroy(nsChromeTreeOwner * const 0x02e885e4) line 212 GlobalWindowImpl::Close(GlobalWindowImpl * const 0x02f37a34) line 1653 GlobalWindowImpl::CloseWindow(nsISupports * 0x02f37a30) line 3070 nsJSContext::ScriptEvaluated(nsJSContext * const 0x02f32f70) line 1075 + 18 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x02f32f70, void * 0x036d4408, void * 0x0370e668, unsigned int 1, void * 0x0012ed94, int * 0x0012ed90, int 0) line 796 nsJSEventListener::HandleEvent(nsIDOMEvent * 0x03e20204) line 154 + 64 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x03594620, nsIDOMEvent * 0x03e20204, nsIDOMEventTarget * 0x034cc7d0, unsigned int 8, unsigned int 7) line 754 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x02f37220, nsEvent * 0x0012f424, nsIDOMEvent * * 0x0012f3f0, nsIDOMEventTarget * 0x034cc7d0, unsigned int 7, nsEventStatus * 0x0012f468) line 1564 + 39 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x034cc7c0, nsIPresContext * 0x02f37220, nsEvent * 0x0012f424, nsIDOMEvent * * 0x0012f3f0, unsigned int 1, nsEventStatus * 0x0012f468) line 3418 nsMenuFrame::Execute() line 1421 nsMenuFrame::HandleEvent(nsMenuFrame * const 0x036a6698, nsIPresContext * 0x02f37220, nsGUIEvent * 0x0012f8c0, nsEventStatus * 0x0012f7b0) line 343 PresShell::HandleEventInternal(nsEvent * 0x0012f8c0, nsIView * 0x03e0aa10, nsEventStatus * 0x0012f7b0) line 3622 + 38 bytes PresShell::HandleEvent(PresShell * const 0x03036574, nsIView * 0x03e0aa10, nsGUIEvent * 0x0012f8c0, nsEventStatus * 0x0012f7b0, int & 1) line 3542 + 23 bytes nsView::HandleEvent(nsView * const 0x03e0aa10, nsGUIEvent * 0x0012f8c0, unsigned int 8, nsEventStatus * 0x0012f7b0, int & 1) line 774 nsView::HandleEvent(nsView * const 0x03e09230, nsGUIEvent * 0x0012f8c0, unsigned int 8, nsEventStatus * 0x0012f7b0, int & 1) line 747 nsView::HandleEvent(nsView * const 0x03df5d60, nsGUIEvent * 0x0012f8c0, unsigned int 8, nsEventStatus * 0x0012f7b0, int & 1) line 747 nsView::HandleEvent(nsView * const 0x03036bd0, nsGUIEvent * 0x0012f8c0, unsigned int 28, nsEventStatus * 0x0012f7b0, int & 1) line 747 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x03036db0, nsGUIEvent * 0x0012f8c0, nsEventStatus * 0x0012f7b0) line 1369 HandleEvent(nsGUIEvent * 0x0012f8c0) line 69 nsWindow::DispatchEvent(nsWindow * const 0x03e09104, nsGUIEvent * 0x0012f8c0, nsEventStatus & nsEventStatus_eIgnore) line 560 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f8c0) line 581 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3673 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3880 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 1703950, long * 0x0012fc24) line 2785 + 24 bytes nsWindow::WindowProc(HWND__ * 0x005816e0, unsigned int 514, unsigned int 0, long 1703950) line 829 + 27 bytes USER32! 77e71268()
Keywords: crash, nsbeta2
Keywords: regression
reassigning to evaughan for triage, changing severity to critical
Assignee: trudelle → evaughan
Severity: normal → critical
These are the same assertions for bug #41027, for which eric checked in a fix at 13:14 this afternoon. Prass, how recent is your tree? (This may, of course, not be the same issue, and I don't know what to say about the crash on exit).
John, I have an older build , from this morning actually. I will update and then give status. Thanks!
I still see the crash after updating :-(
[nsbeta2+]
Whiteboard: [nsbeta2+]
The signoff option is missing with the current commercial Windows build. This bug will be not be reproducible without signoff. Will update once I investigate the whereabouts of missing signoff!
The first 20 or so entries on the stack (up to the first nsWebShell::Destroy) are identical to the one in bug 41335 "Crash while closing a browser window", which has a simpler testcase that does not involve AIM. cc owner of that bug (jband@netscape.com).
Crash still present. Crash due to unhandled exception in XPC3250.DLL: 0xC0000005 - Access violation. Thanks Andreas, yes it looks very similiar to 41335. Is this a dupe?
Also, not sure if this has any connection to http://bugzilla.mozilla.org/show_bug.cgi?id=39858. The crash seems to be related to quit as well.
P1,m18. Eric, is this one that garyf could take?
Priority: P3 → P1
Target Milestone: --- → M18
I'm taking this one.
Assignee: evaughan → garyf
http://bugzilla.mozilla.org/show_bug.cgi?id=31695 seems to be related, based on Andreas notes in 39858. ccing dveditz.
Could someone retest and verify that the stack trace in the original description has not changed? I ask because bug 41335 has been fixed.
Thanks Andreas. With the 2000061208 comm. M17 trunk build on win95, I cannot reproduce this crash. Is this fixed by alecf's fix? prass?
39858 may also be related; see good comment from Andreas Franke there. Various backtraces, having ~nsXPCWrappedNativeClass in common, e.g. #2 0x40267674 in PR_Assert (s=0x4029720a "0 == rv", file=0x40297200 "ptsynch.c", ln=168) at prlog.c:477 #3 0x40283aec in PR_Lock (lock=0x81b1ea8) at ptsynch.c:168 #4 0x40146c3e in nsAutoLock::nsAutoLock (this=0xbffff54c, aLock=0x81b1ea8) at ../../../../dist/include/nsAutoLock.h:135 #5 0x4069a1f2 in nsXPCWrappedNativeClass::~nsXPCWrappedNativeClass ( this=0x8dbfa60, __in_chrg=3) at xpcwrappednativeclass.cpp:168 A comment in nsAutoLock.h - // This will assert deep in the bowels of NSPR if you attempt // to re-enter the lock. implies we may be re-entering a lock.
Andreas, John, I am not seeing this crash anymore. With the fix of 41335, this has also been fixed. I am seeing another crash while doing close but that is a different one, unrelated to this bug. Marking worksforme.
Status: NEW → RESOLVED
Closed: 26 years ago
Resolution: --- → WORKSFORME
John, do you want me to verify this?
I don't get this crash on today's linux/win32/mac opt. comm. builds. I do get the crash on linux, but it's a different stack entirely -- http://bugscape.mcom.com/show_bug.cgi?id=1153 Marking verified worksforme. Thanks, prass.
Status: RESOLVED → VERIFIED
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: jrgmorrison → xptoolkit.widgets
You need to log in before you can comment on or make changes to this bug.