101177 - regression: crash closing window while loading image - Trunk [@ nsDocument::SetTitle]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Olivier Cahagne]

Build ID: 2001092208 on Win2k.
URL: http://www.mpa-garching.mpg.de/~ediscs/clusters/cl1238_L.jpg

Steps to reproduce:
 1. Load URL http://www.mpa-garching.mpg.de/~ediscs/clusters/cl1238_L.jpg
 2. While loading image, close it via Ctrl-W or by clicking on the appropriate
button in the title bar.
 3. Watch Mozilla crashing.

Talkback ID: T25759183K.

Expected behaviour: not crashing, I think it's a regression because it didn't
crash some weeks ago. I don't think it comes from this particular image because
I crash with other sites when I close the window too early. See bug 100279 for a
similar bug (not a dupe though as I first thought, the stacktraces don't seem to
be the same).

Comment 1

[Markus Gerstel]

Confirmed 2001092214 linux. Preparing my debug build...

Comment 2

[Markus Gerstel]

Attachment: GDB Backtrace 2001092302-debug linux

Comment 3

[Stuart Parmenter]

'event' is NULL.

nsDebug::Assertion(const char * 0x02472d58 `string', const char * 0x02472d9c
`string', const char * 0x02479f0c `string', int 649) line 290 + 13 bytes
nsDebug::PreCondition(const char * 0x02472d58 `string', const char * 0x02472d9c
`string', const char * 0x02479f0c `string', int 649) line 434 + 21 bytes
nsCOMPtr<nsIDOMEvent>::operator->() line 649 + 34 bytes
nsDocument::SetTitle(nsDocument * const 0x051603e0, const nsAString & {...})
line 2375 + 29 bytes
nsHTMLDocument::SetTitle(nsHTMLDocument * const 0x051603e0, const nsAString &
{...}) line 900
nsImageDocument::UpdateTitle() line 509 + 45 bytes
nsImageDocument::EndLayout(nsISupports * 0x00000000, unsigned int 2152398850)
line 437
ImageListener::OnStopRequest(ImageListener * const 0x051a2d68, nsIRequest *
0x054256e0, nsISupports * 0x00000000, unsigned int 2152398850) line 188
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x063f0200,
nsIRequest * 0x054256e0, nsISupports * 0x00000000, unsigned int 2152398850) line 257
nsStreamListenerTee::OnStopRequest(nsStreamListenerTee * const 0x054823f8,
nsIRequest * 0x054256e0, nsISupports * 0x00000000, unsigned int 2152398850) line 25
nsHttpChannel::OnStopRequest(nsHttpChannel * const 0x054256e4, nsIRequest *
0x0538e528, nsISupports * 0x00000000, unsigned int 2152398850) line 2220
nsOnStopRequestEvent::HandleEvent() line 162
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x050fef94) line 65
PL_HandleEvent(PLEvent * 0x050fef94) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0102ea70) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00140390, unsigned int 49560, unsigned int 0,
long 16968304) line 1071 + 9 bytes
USER32! 77e12e98()
USER32! 77e130e0()
USER32! 77e15824()
nsAppShellService::Run(nsAppShellService * const 0x01117f38) line 442
main1(int 1, char * * 0x00358378, nsISupports * 0x00000000) line 1278 + 32 bytes
main(int 1, char * * 0x00358378) line 1606 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e97d08()

Comment 4

[Stuart Parmenter]

this is from hyatt's change

Comment 5

[David Hyatt]

Add a null-check to prevent crash.

Comment 6

[David Hyatt]

Attachment: Null checks.

Comment 7

[Stuart Parmenter]

Comment on attachment 50449 [details] [diff] [review]
Null checks.

r=pavlov

Comment 8

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 50449 [details] [diff] [review]
Null checks.

sr=[e-mail]

Comment 9

[David Hyatt]

Fixed.

Comment 10

[Markus Gerstel]

verified 2001092315 linux. thx =)

Comment 11

[Terri Preston]

Verified fixed w2k build 2001-09-21-05-0.9.4

Comment 12

[Jay Patel [:jay]]

Adding topcrash keyword and Trunk [@ nsDocument::SetTitle] for future reference,
as this *was* a topcrasher on the MozillaTrunk.

Comment 13

[Asa Dotzler [:asa]]

*** Bug 101540 has been marked as a duplicate of this bug. ***