782979 - Crash in PL_DHashTableOperate when closing Gmail tab

Status: RESOLVED DUPLICATE of bug 782981

(Firefox :: Untriaged, defect)

Description

[Octoploid]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/17.0 Firefox/17.0
Build ID: 20120815172258

Steps to reproduce:

Start Firefox and open a blank tab.
Open a new tab and log into Gmail.
Now close the gmail tab (by clicking on it with the middle mouse button).


Actual results:

Firefox crashes:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff605db9c in PL_DHashTableOperate () from /usr/lib64/firefox/libxul.so
(gdb) bt
#0  0x00007ffff605db9c in PL_DHashTableOperate () from /usr/lib64/firefox/libxul.so
#1  0x00007ffff58a282b in nsObjectFrame::BeginSwapDocShells(nsIContent*, void*) () from /usr/lib64/firefox/libxul.so
#2  0x00007ffff599990b in EnumerateFreezables(nsPtrHashKey<nsIContent>*, void*) () from /usr/lib64/firefox/libxul.so
#3  0x00007ffff605dd5c in PL_DHashTableEnumerate () from /usr/lib64/firefox/libxul.so
#4  0x00007ffff599eeb1 in nsIDocument::EnumerateFreezableElements(void (*)(nsIContent*, void*), void*) () from /usr/lib64/firefox/libxul.so
#5  0x00007ffff58b0d1b in BeginSwapDocShellsForDocument(nsIDocument*, void*) () from /usr/lib64/firefox/libxul.so
#6  0x00007ffff58b0d56 in BeginSwapDocShellsForViews(nsIView*) () from /usr/lib64/firefox/libxul.so
#7  0x00007ffff58b0ea6 in nsSubDocumentFrame::DestroyFrom(nsIFrame*) () from /usr/lib64/firefox/libxul.so
#8  0x00007ffff588872e in nsFrameList::DestroyFramesFrom(nsIFrame*) () from /usr/lib64/firefox/libxul.so
#9  0x00007ffff589422e in nsCanvasFrame::DestroyFrom(nsIFrame*) () from /usr/lib64/firefox/libxul.so
#10 0x00007ffff588872e in nsFrameList::DestroyFramesFrom(nsIFrame*) () from /usr/lib64/firefox/libxul.so
#11 0x00007ffff5878a27 in nsContainerFrame::DestroyFrom(nsIFrame*) () from /usr/lib64/firefox/libxul.so
#12 0x00007ffff588872e in nsFrameList::DestroyFramesFrom(nsIFrame*) () from /usr/lib64/firefox/libxul.so
#13 0x00007ffff5878a27 in nsContainerFrame::DestroyFrom(nsIFrame*) () from /usr/lib64/firefox/libxul.so
#14 0x00007ffff58366aa in nsFrameManager::Destroy() () from /usr/lib64/firefox/libxul.so
#15 0x00007ffff5853d71 in PresShell::Destroy() () from /usr/lib64/firefox/libxul.so
#16 0x00007ffff5830c63 in DocumentViewerImpl::DestroyPresShell() () from /usr/lib64/firefox/libxul.so
#17 0x00007ffff583499e in DocumentViewerImpl::Hide() () from /usr/lib64/firefox/libxul.so
#18 0x00007ffff5df3ea3 in nsDocShell::SetVisibility(bool) () from /usr/lib64/firefox/libxul.so
#19 0x00007ffff59b2458 in nsFrameLoader::Hide() () from /usr/lib64/firefox/libxul.so
#20 0x00007ffff58af41b in nsHideViewer::Run() () from /usr/lib64/firefox/libxul.so
#21 0x00007ffff5988a5c in nsContentUtils::RemoveScriptBlocker() () from /usr/lib64/firefox/libxul.so
#22 0x00007ffff59ad09f in nsDocument::EndUpdate(unsigned int) () from /usr/lib64/firefox/libxul.so
#23 0x00007ffff5b01edb in nsXULDocument::EndUpdate(unsigned int) () from /usr/lib64/firefox/libxul.so
#24 0x00007ffff58e7eca in mozAutoDocUpdate::~mozAutoDocUpdate() () from /usr/lib64/firefox/libxul.so
#25 0x00007ffff59c2de6 in nsINode::doRemoveChildAt(unsigned int, bool, nsIContent*, nsAttrAndChildArray&) () from /usr/lib64/firefox/libxul.so
#26 0x00007ffff59ee976 in mozilla::dom::FragmentOrElement::RemoveChildAt(unsigned int, bool) () from /usr/lib64/firefox/libxul.so
#27 0x00007ffff5cabad6 in nsXULElement::RemoveChildAt(unsigned int, bool) () from /usr/lib64/firefox/libxul.so
#28 0x00007ffff59c2094 in nsINode::RemoveChild(nsINode*) () from /usr/lib64/firefox/libxul.so
#29 0x00007ffff5d97892 in nsIDOMNode_RemoveChild(JSContext*, unsigned int, JS::Value*) () from /usr/lib64/firefox/libxul.so
#30 0x00007ffff636bb48 in js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) () from /usr/lib64/firefox/libxul.so
#31 0x00007ffff6331821 in js_fun_apply(JSContext*, unsigned int, JS::Value*) () from /usr/lib64/firefox/libxul.so
#32 0x00007ffff636bb48 in js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) () from /usr/lib64/firefox/libxul.so
#33 0x00007ffff635c889 in js::Interpret(JSContext*, js::StackFrame*, js::InterpMode) () from /usr/lib64/firefox/libxul.so
#34 0x00007ffff636b35e in js::RunScript(JSContext*, JSScript*, js::StackFrame*) () from /usr/lib64/firefox/libxul.so
#35 0x00007ffff636bcad in js::InvokeKernel(JSContext*, JS::CallArgs, js::MaybeConstruct) () from /usr/lib64/firefox/libxul.so
#36 0x00007ffff636c297 in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::Value*) ()
   from /usr/lib64/firefox/libxul.so
#37 0x00007ffff62db074 in JS_CallFunctionValue () from /usr/lib64/firefox/libxul.so
#38 0x00007ffff5b14c5c in nsJSContext::CallEventHandler(nsISupports*, JSObject*, JSObject*, nsIArray*, nsIVariant**) [clone .part.53] ()
   from /usr/lib64/firefox/libxul.so
#39 0x00007ffff5b7fd5f in nsJSEventListener::HandleEvent(nsIDOMEvent*) () from /usr/lib64/firefox/libxul.so
#40 0x00007ffff5af1de5 in nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventTarget*, nsIDOMEvent*) () from /usr/lib64/firefox/libxul.so
#41 0x00007ffff5aeedb2 in nsXBLEventHandler::HandleEvent(nsIDOMEvent*) () from /usr/lib64/firefox/libxul.so
#42 0x00007ffff5a2ef16 in nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsIDOMEventTarget*, unsig
ned int, nsCxPusher*) () from /usr/lib64/firefox/libxul.so
#43 0x00007ffff5a2f0f2 in nsEventListenerManager::HandleEventInternal(nsPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEv
entStatus*, nsCxPusher*) () from /usr/lib64/firefox/libxul.so
#44 0x00007ffff5a4306d in nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int, bool, nsCxPusher*) ()
   from /usr/lib64/firefox/libxul.so
#45 0x00007ffff5a43580 in nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*, bool, nsCxPu
sher*) () from /usr/lib64/firefox/libxul.so
#46 0x00007ffff5a43b3c in nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, n
sCOMArray<nsIDOMEventTarget>*) () from /usr/lib64/firefox/libxul.so
#47 0x00007ffff591cf91 in nsTransitionManager::WillRefresh(mozilla::TimeStamp) () from /usr/lib64/firefox/libxul.so
#48 0x00007ffff5854f12 in nsRefreshDriver::Notify(nsITimer*) () from /usr/lib64/firefox/libxul.so
#49 0x00007ffff608870d in nsTimerImpl::Fire() () from /usr/lib64/firefox/libxul.so
#50 0x00007ffff60887e3 in nsTimerEvent::Run() () from /usr/lib64/firefox/libxul.so
#51 0x00007ffff608596d in nsThread::ProcessNextEvent(bool, bool*) () from /usr/lib64/firefox/libxul.so
#52 0x00007ffff605d0d5 in NS_ProcessNextEvent_P(nsIThread*, bool) () from /usr/lib64/firefox/libxul.so
#53 0x00007ffff5fc0656 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) () from /usr/lib64/firefox/libxul.so
#54 0x00007ffff60a0f67 in MessageLoop::Run() () from /usr/lib64/firefox/libxul.so
#55 0x00007ffff5f62f2d in nsBaseAppShell::Run() () from /usr/lib64/firefox/libxul.so
#56 0x00007ffff5e59477 in nsAppStartup::Run() () from /usr/lib64/firefox/libxul.so
#57 0x00007ffff56ecd4f in XREMain::XRE_mainRun() () from /usr/lib64/firefox/libxul.so
#58 0x00007ffff56ecf29 in XREMain::XRE_main(int, char**, nsXREAppData const*) () from /usr/lib64/firefox/libxul.so
#59 0x00007ffff56ed136 in XRE_main () from /usr/lib64/firefox/libxul.so
#60 0x000000000040296d in main ()