366127 - crash when pictures are opened in a new tab [@ nsDOMImplementation::CreateDocument]

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070105 Minefield/3.0a2pre ID:2007010514 [cairo]

repro:
open URL
middleclick on 10-20 pictures to open them in a new tab

result:
Incident ID: 28082571
Stack Signature	nsDOMImplementation::CreateDocument 7c646539
Product ID	FirefoxTrunk
Build ID	2007010507
Trigger Time	2007-01-06 01:49:46.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0017582b)
URL visited	http://babeswithbooks.blogspot.com/
User Comments	crash when opening >10 pictures in a new tab
Since Last Crash	22169 sec
Total Uptime	22169 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\base\src\nsdocument.cpp, line 609
Stack Trace 	
nsDOMImplementation::CreateDocument  [mozilla\content\base\src\nsdocument.cpp, line 609]
nsCycleCollectionXPCOMRuntime::Traverse  [mozilla\xpcom\base\nscyclecollector.cpp, line 954]
GraphWalker::NoteXPCOMChild  [mozilla\xpcom\base\nscyclecollector.cpp, line 624]
nsEventListenerManager::FindJSEventListener  [mozilla\content\events\src\nseventlistenermanager.cpp, line 807]
nsCycleCollectionXPCOMRuntime::Traverse  [mozilla\xpcom\base\nscyclecollector.cpp, line 954]

Comment 1

[Peter van der Woude [:Peter6]]

This doesn't seem to depend on bug  333078, it even crashes before it landed.

the last build before Cycle collector landed:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104 Minefield/3.0a2pre ID:2007010418 [cairo]

Incident ID: 28083799
Stack Signature	nsDocument::AddStyleSheet 1ca52137
Product ID	FirefoxTrunk
Build ID	2007010404
Trigger Time	2007-01-06 03:08:10.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00175bd0)
URL visited	http://babeswithbooks.blogspot.com/
User Comments	Bug 366127 - last build before cycle collector landed
Since Last Crash	84 sec
Total Uptime	33830 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\base\src\nsdocument.cpp, line 1964
Stack Trace 	
nsDocument::AddStyleSheet  [mozilla\content\base\src\nsdocument.cpp, line 1964]
PrepareAndDispatch  [mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, line 102]
nsXPTCStubBase::Stub83  [mozilla\dist\include\xpcom\xptcstubsdef.inc, line 85]
nsEventListenerManager::CompileEventHandlerInternal  [mozilla\content\events\src\nseventlistenermanager.cpp, line 1168]
PrepareAndDispatch  [mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, line 102]



the first build with cycle collector included
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104 Minefield/3.0a2pre ID:2007010414 [cairo]

Incident ID: 28083703
Stack Signature	nsDocument::SetHeaderData aedf4f54
Product ID	FirefoxTrunk
Build ID	2007010404
Trigger Time	2007-01-06 03:04:02.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001758a9)
URL visited	http://babeswithbooks.blogspot.com/
User Comments	Bug 366127 - first build with cycle collector
Since Last Crash	33746 sec
Total Uptime	33746 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\base\src\nsdocument.cpp, line 1506
Stack Trace 	
nsDocument::SetHeaderData  [mozilla\content\base\src\nsdocument.cpp, line 1506]
nsXPTCStubBase::Stub25  [mozilla\dist\include\xpcom\xptcstubsdef.inc, line 27]
nsXPTCStubBase::Stub124  [mozilla\dist\include\xpcom\xptcstubsdef.inc, line 126]
nsEventListenerManager::CompileEventHandlerInternal  [mozilla\content\events\src\nseventlistenermanager.cpp, line 1147]
nsXPTCStubBase::Stub25  [mozilla\dist\include\xpcom\xptcstubsdef.inc, line 27]

Comment 2

[Dão Gottwald [:dao]]

(In reply to comment #1)
> This doesn't seem to depend on bug  333078, it even crashes before it landed.
> 
> the last build before Cycle collector landed:
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104
> Minefield/3.0a2pre ID:2007010418 [cairo]
> Build ID        2007010404
> 
> the first build with cycle collector included
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104
> Minefield/3.0a2pre ID:2007010414 [cairo]
> Build ID        2007010404

I'm confused, what's up with the build ids?

Comment 3

[Dão Gottwald [:dao]]

Btw, no crash here with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104 Minefield/3.0a2pre ID:2007010404 [cairo].

Comment 4

[Bill Gianopoulos [:WG9s]]

I believe this has the same underlying cause as bug 366063.

Comment 5

[Peter van der Woude [:Peter6]]

(In reply to comment #3)
> Btw, no crash here with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
> rv:1.9a2pre) Gecko/20070104 Minefield/3.0a2pre ID:2007010404 [cairo].
> 
Yeah, my bad, I picked the wrong next build in my list.
It's definitly bug 333078

Comment 6

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070106 Minefield/3.0a2pre ID:2007010614 [cairo]

The crash went away after Graydon checked in 

Bug 333078, Temporary band-aid for nsImageDocument cycle collection crashers.
at 2007-01-06 14:09

Comment 7

[Graydon Hoare :graydon]

Fixed again -- more correctly -- with subsequent patch in 366063. Please reopen if you are still seeing it.