10010 - [PP]crash on startup on linux

Status: VERIFIED FIXED

(Core :: XUL, defect, P1)

Description

[(not reading, please use [e-mail] instead)]

july 16th 9 am build.

rh linux 6.0

I crash on startup.

./mozilla-apprunner.sh -mail

here's the stack trace:


#0  0x4082d609 in chunk_free (ar_ptr=0x408bd580, p=0xc80f545c) at
malloc.c:3003
#1  0x4082d38d in chunk_alloc (ar_ptr=0x408bd580, nb=368) at
malloc.c:2515
#2  0x4082e294 in __libc_calloc (n=360, elem_size=1) at malloc.c:3574
#3  0x4068b268 in g_malloc0 ()
#4  0x4060a40c in gtk_type_class_init ()
#5  0x40609d50 in gtk_type_class ()
#6  0x40609e38 in gtk_type_new ()
#7  0x405bb9d3 in gtk_menu_new ()
#8  0x40237609 in nsMenu::Create (this=0x82fcf20, aParent=0x82fc820,
aLabel=@0xbfffd6e0) at nsMenu.cpp:131
#9  0x4023a1ce in nsMenuBar::MenuConstruct (this=0x82fc7e8,
aMenuEvent=@0xbfffd828, aParentWindow=0x80f38c0, menubarNode=0x8291cc0,
aWebShell=0x80f9250) at nsMenuBar.cpp:309
#10 0x4015bb4b in nsWebShellWindow::DynamicLoadMenus (this=0x80f4dc8,
aDOMDoc=0x813fff4, aParentWindow=0x80f38c0) at nsWebShellWindow.cpp:851
#11 0x401606dc in nsWebShellWindow::OnEndDocumentLoad (this=0x80f4dc8,
loader=0x82d9480, aURL=0x82d9af0, aStatus=0, aDocObserver=0x82d906c) at
nsWebShellWindow.cpp:1811
#12 0x402bdd6b in nsWebShell::OnEndDocumentLoad (this=0x82d9058,
loader=0x82d9480, aURL=0x82d9af0, aStatus=0, aWebShell=0x82d906c) at
nsWebShell.cpp:3014
#13 0x402b5165 in nsDocLoaderImpl::FireOnEndDocumentLoad
(this=0x82d9480, aLoadInitiator=0x82d9480, aStatus=0) at
nsDocLoader.cpp:1094
#14 0x402b5693 in nsDocLoaderImpl::LoadURLComplete (this=0x82d9480,
aURL=0x82d9af0, aBindInfo=0x82d9ac0, aStatus=0) at nsDocLoader.cpp:1359
#15 0x402b68f2 in nsDocumentBindInfo::OnStopRequest (this=0x82d9ac0,
aURL=0x82d9af0, aStatus=0, aMsg=0xbfffdb30) at nsDocLoader.cpp:2112
#16 0x4012cc9c in stub_complete (stream=0x82d9ff0) at
nsStubContext.cpp:772
#17 0x400171f6 in net_output_about_url (cur_entry=0x82d9ed8) at
mkabout.c:692
#18 0x40018519 in net_AboutLoad (ce=0x82d9ed8) at mkabout.c:918
#19 0x400fa9cd in NET_GetURL (URL_s=0x82d9bc0, output_format=102,
window_id=0x82d9d90, exit_routine=0x4012649c
<bam_exit_routine(URL_Struct_ *, int, MWContext_ *)>) at mkgeturl.c:2979
#20 0x40124917 in nsNetlibService::OpenStream (this=0x80dbd00,
aUrl=0x82d9af0, aConsumer=0x82d9ac0) at nsNetService.cpp:513
#21 0x402b60de in nsDocumentBindInfo::Bind (this=0x82d9ac0,
aURL=0x82d9af0, aListener=0x0) at nsDocLoader.cpp:1642
#22 0x402b5fb8 in nsDocumentBindInfo::Bind (this=0x82d9ac0,
aURLSpec=@0xbfffe434, aPostData=0x0, aListener=0x0) at
nsDocLoader.cpp:1595
#23 0x402b4578 in nsDocLoaderImpl::LoadDocument (this=0x82d9480,
aURLSpec=@0xbfffe434, aCommand=0x402c2fe8 "view", aContainer=0x82d9058,
aPostData=0x0, aExtraInfo=0x0, anObserver=0x82d8cc8, aType=nsURLReload,
aLocalIP=0) at nsDocLoader.cpp:666
#24 0x402bb550 in nsWebShell::DoLoadURL (this=0x82d9058,
aUrlSpec=@0xbfffe434, aCommand=0x402c2fe8 "view", aPostData=0x0,
aType=nsURLReload, aLocalIP=0) at nsWebShell.cpp:1939
#25 0x402bbeca in nsWebShell::LoadURL (this=0x82d9058,
aURLSpec=0x82d9a48, aCommand=0x402c2fe8 "view", aPostData=0x0,
aModifyHistory=1, aType=nsURLReload, aLocalIP=0) at nsWebShell.cpp:2098
#26 0x402bac71 in nsWebShell::LoadURL (this=0x82d9058,
aURLSpec=0x82d9a48, aPostData=0x0, aModifyHistory=1, aType=nsURLReload,
aLocalIP=0) at nsWebShell.cpp:1789
#27 0x40e3a7f5 in nsHTMLFrameInnerFrame::Reflow (this=0x82d8e78,
aPresContext=@0x81cdc50, aDesiredSize=@0xbfffe6cc,
aReflowState=@0xbfffe630, aStatus=@0xbfffef40) at nsFrameFrame.cpp:941
#28 0x40d68a56 in nsContainerFrame::ReflowChild (this=0x82d67a8,
aKidFrame=0x82d8e78, aPresContext=@0x81cdc50, aDesiredSize=@0xbfffe6cc,
aReflowState=@0xbfffe630, aStatus=@0xbfffef40) at
nsContainerFrame.cpp:395
#29 0x40e38acf in nsHTMLFrameOuterFrame::Reflow (this=0x82d67a8,
aPresContext=@0x81cdc50, aDesiredSize=@0xbfffec24,
aReflowState=@0xbfffe760, aStatus=@0xbfffef40) at nsFrameFrame.cpp:395
#30 0x40efc707 in nsBoxFrame::FlowChildAt (this=0x82d3a90,
childFrame=0x82d67a8, aPresContext=@0x81cdc50, desiredSize=@0xbfffec24,
aReflowState=@0xbfffeb88, aStatus=@0xbfffef40, spring=1,
incrementalChild=@0xbfffeae4) at nsBoxFrame.cpp:725
#31 0x40efb37e in nsBoxFrame::FlowChildren (this=0x82d3a90,
aPresContext=@0x81cdc50, aDesiredSize=@0xbfffec24,
aReflowState=@0xbfffeb88, aStatus=@0xbfffef40, rect=@0xbfffeae8,
incrementalChild=@0xbfffeae4) at nsBoxFrame.cpp:359
#32 0x40efb10e in nsBoxFrame::Reflow (this=0x82d3a90,
aPresContext=@0x81cdc50, aDesiredSize=@0xbfffec24,
aReflowState=@0xbfffeb88, aStatus=@0xbfffef40) at nsBoxFrame.cpp:285
#33 0x40d68a56 in nsContainerFrame::ReflowChild (this=0x82c3d88,
aKidFrame=0x82d3a90, aPresContext=@0x81cdc50, aDesiredSize=@0xbfffec24,
aReflowState=@0xbfffeb88, aStatus=@0xbfffef40) at
nsContainerFrame.cpp:395
#34 0x40d761f4 in RootFrame::Reflow (this=0x82c3d88,
aPresContext=@0x81cdc50, aDesiredSize=@0xbfffed90,
aReflowState=@0xbfffecec, aStatus=@0xbfffef40) at nsHTMLFrame.cpp:237
#35 0x40d68a56 in nsContainerFrame::ReflowChild (this=0x81cc860,
aKidFrame=0x82c3d88, aPresContext=@0x81cdc50, aDesiredSize=@0xbfffed90,
aReflowState=@0xbfffecec, aStatus=@0xbfffef40) at
nsContainerFrame.cpp:395
#36 0x40da2118 in ViewportFrame::Reflow (this=0x81cc860,
aPresContext=@0x81cdc50, aDesiredSize=@0xbfffef44,
aReflowState=@0xbfffee9c, aStatus=@0xbfffef40) at
nsViewportFrame.cpp:438
#37 0x40d8f498 in PresShell::InitialReflow (this=0x81fb6c8, aWidth=9540,
aHeight=6075) at nsPresShell.cpp:934
#38 0x40acb76c in XULDocumentImpl::StartLayout (this=0x819c650) at
nsXULDocument.cpp:4023
#39 0x40ac4947 in XULDocumentImpl::EndLoad (this=0x819c650) at
nsXULDocument.cpp:1891
#40 0x40ae7e52 in XULContentSinkImpl::DidBuildModel (this=0x81a30b8,
aQualityLevel=1) at nsXULContentSink.cpp:538
#41 0x402fdf33 in CWellFormedDTD::DidBuildModel (this=0x82be070,
anErrorCode=0, aNotifySink=1, aParser=0x813ff20, aSink=0x81a30b8) at
nsWellFormedDTD.cpp:286
#42 0x402f5a8e in nsParser::DidBuildModel (this=0x813ff20,
anErrorCode=0) at nsParser.cpp:525
#43 0x402f65de in nsParser::ResumeParse (this=0x813ff20,
aDefaultDTD=0x0, aIsFinalChunk=0) at nsParser.cpp:883
#44 0x402f5bd3 in nsParser::EnableParser (this=0x813ff20, aState=1) at
nsParser.cpp:615
#45 0x40aebe58 in XULContentSinkImpl::DoneLoadingScript
(aLoader=0x82c0e28, aData=@0x82c0e48, aRef=0x81a30b8, aStatus=0) at
nsXULContentSink.cpp:1634
#46 0x40129883 in nsUnicharStreamLoader::OnStopRequest (this=0x82c0e28,
aURL=0x82c0d10, aStatus=0, aMsg=0xbffff370) at nsNetStreamLoader.cpp:156
#47 0x402b68b3 in nsDocumentBindInfo::OnStopRequest (this=0x82c0d88,
aURL=0x82c0d10, aStatus=0, aMsg=0xbffff370) at nsDocLoader.cpp:2092
#48 0x4012cc9c in stub_complete (stream=0x82b4168) at
nsStubContext.cpp:772
#49 0x4003ea12 in net_ProcessFile (cur_entry=0x82c1858) at mkfile.c:1360
#50 0x400fb56e in NET_ProcessNet (ready_fd=0x0, fd_type=1) at
mkgeturl.c:3357
#51 0x401035d5 in NET_PollSockets () at mkselect.c:298
#52 0x40126352 in nsNetlibService::NetPollSocketsCallback
(aTimer=0x81a3238, aClosure=0x80dbd00) at nsNetService.cpp:1271
#53 0x402941f5 in TimerImpl::FireTimeout (this=0x81a3238) at
nsTimer.cpp:73
#54 0x4029467a in nsTimerExpired (aCallData=0x81a3238) at
nsTimer.cpp:196
#55 0x4068afa3 in g_timeout_dispatch ()
#56 0x4068a2c6 in g_main_dispatch ()
#57 0x4068a801 in g_main_iterate ()
#58 0x4068a979 in g_main_run ()
#59 0x405b9f3a in gtk_main ()
#60 0x40231049 in nsAppShell::Run (this=0x80a6350) at nsAppShell.cpp:241
#61 0x401589fd in nsAppShellService::Run (this=0x80a5c38) at
nsAppShellService.cpp:428
#62 0x804adb0 in main (argc=2, argv=0xbffff9e4) at nsAppRunner.cpp:701
#63 0x407eccb3 in __libc_start_main (main=0x8049d3c <main>, argc=2,
argv=0xbffff9e4, init=0x80497f0 <_init>, fini=0x804bf28 <_fini>,
rtld_fini=0x4000a350, stack_end=0xbffff9dc) at
../sysdeps/generic/libc-start.c:78

Comment 1

[(not reading, please use [e-mail] instead)]

./mozilla-apprunner.sh crashes too.

but the stack trace looks bogus:


#0  0x401bbe2a in nsStr::Destroy (aDest=@0xbfffedfc, anAgent=0x302f414c) at
nsStr.cpp:207
#1  0x401c12ad in nsString::~nsString (this=0xbfffedfc, __in_chrg=2) at
nsString2.cpp:200
#2  0x401c4539 in nsAutoString::~nsAutoString (this=0xbfffedfc, __in_chrg=2) at
nsString2.cpp:2030
#3  0x40aea8ac in XULContentSinkImpl::GetXULIDAttribute (this=0x0,
aNode=@0x40207800, aResource=0x401c0000) at nsXULContentSink.cpp:1304
#4  0x8278b78 in ?? ()

Comment 2

[Peter Trudelle]

This looks like a job for Pavlov! reassigning as p1 for m9, cc saari

Comment 3

[Akkana Peck]

Adding myself to cc list.  I can't get any work done until this is fixed; my
build is DOA and Seth and I spent most of the day trying to track it down and
getting lost in rdf code.  (Why is this assigned to Pavlov?  The crash is in
rdf, in nsXULContentSink.cpp.)

Comment 4

[Akkana Peck]

Turns out that reverting nsRDFService.cpp to version 1.39 fixes the problem.
Reassigning to waterson.

Comment 5

[Chris Waterson]

Fixed. Off-by-one error in a buffer. Doh!

Comment 6

[phillip]

verified on

     1999-07-19-11 RedHat Linux 5.2 (GNOME/enlightenment)

     (and these for the hell of it)
     1999-07-19-08 WinNT 4.0 sp4
     1999-07-19-08 MacOS 8.51