297488 - Irregular crashes when closing tab/windows or quiting Camino with bfcache enabled [@ nsChildView::GetParent() + 0x24]

Status: RESOLVED FIXED

(Camino Graveyard :: Page Layout, defect, P1)

Description

[Torben]

Camino 2005061108 (v0.9a)

With bfcache enabled (browser.sessionhistory.max_viewers, 5) Camino will
sometimes crash when I close a tab/window or quit Camino. No crash with bfcache
turned off. Just before the crash Camino will hang for some seconds (with the
nice spinning bathball).

Comment 1

[Torben]

Attachment: Crash Log

Comment 2

[Torben]

Attachment: needs work

This seems to have been fixed  with the checkin from bug 293173.

However, I had just found another solution, attaching it here in case this
problem should resurface.

Comment 3

[Torben]

Looks like I spoke too soon, I just had a crash with the latest nightly (TB7122092Q), reopening.

Comment 4

[Bastiaan Jacques]

Related to bug 227489, perhaps?

Comment 5

[Torben]

Comment on attachment 187349 [details] [diff] [review]
needs work

Camino just crashed with this patch, back to the drawing table :-(
However, it seems like Camino now only crashes when closing windows or quiting,
not when closing tabs.

Comment 6

[Simon Fraser [no longer active]]

*** Bug 299872 has been marked as a duplicate of this bug. ***

Comment 7

[Samuel Sidler (old account; do not CC)]

(In reply to comment #5)
> However, it seems like Camino now only crashes when closing windows or quiting,
> not when closing tabs.
> 

Is that bug 299872?

Comment 8

[Samuel Sidler (old account; do not CC)]

Heh. Ignore comment 7.

Comment 9

[Mike Pinkerton (not reading bugmail)]

bryner was trying to look at this last night, but the talkback reports don't
have stacks with them and he said he can't repro this himself. i wonder what's
going on with the server.

Comment 10

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #9)
> bryner was trying to look at this last night, but the talkback reports don't
> have stacks with them and he said he can't repro this himself. i wonder what's
> going on with the server.

Some of my TB IDs (not related to this bug) are 7271777, 7042521, 6774484,
6791182, and 6796134; I'm sure when I searched for the older ones of them on
talkback-public shortly after they were submitted they had useful stacks.  Even
the newest/most complete one in the list, 7271777, doesn't list functions and
line numbers and that sort of thing.  I don't see any recent bugs in Talkback
Client or Talkback Server....

Comment 11

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to comment #10)
> I don't see any recent bugs in Talkback Client or Talkback Server....

Maybe it's this mis-named bug, bug 297719?  Sorry for the off-topic noise.

Comment 12

[Jasper]

K I just had this crash, and have seen it happen a couple of times last couple
of weeks. I just submitted a talckback report TB7306347G and my crash log looks
the same as the one alreaddy attached.

Comment 13

[Brian Ryner (not reading)]

Attachment: patch

I was able to reproduce something like this just going back and forward through
some pages on pcworld.com.  It appears that what happens is the child widget
outlives its parent, and has a dangling pointer.  My suggestion is that we do
what the carbon code does for this, and null out the parent pointer on all of
the children when the parent goes away.

Comment 14

[Josh Aas]

Comment on attachment 188633 [details] [diff] [review]
patch

applies, builds, runs, no more crashes, looks good

Comment 15

[Mike Pinkerton (not reading bugmail)]

Comment on attachment 188633 [details] [diff] [review]
patch

looks good to me except for the tabs, can you clean those up before checking
in? sr=pink.

simon, you concur?

Comment 16

[Simon Fraser [no longer active]]

Yup, looks good (other than the tabs/spaces).

Comment 17

[Brian Ryner (not reading)]

checked in