102813 - open new window, and then quit before page is loaded results in crash

Status: RESOLVED WORKSFORME

(SeaMonkey :: General, defect)

Description

[chris hofmann]

about 50% or more of the time when I do this I hit the following crash.

Incident ID 36188616
Stack Signature MSVCRT.DLL + 0xd16a (0x7800d16a) f7ada4a7
Bug ID
Trigger Time 2001-10-02 18:53:56
Email Address [e-mail]
User Comments installed todays build, brought up browser window, then mail, then
another browser window and then quit that window before my homepage at
my.netscape.com was completely downloaded and displayed.
Build ID 2001100205
Product ID Netscape6.20
Platform ID Win32
Trigger Reason Access violation
Stack Trace
MSVCRT.DLL + 0xd16a (0x7800d16a)
MSVCRT.DLL + 0x11b77 (0x78011b77)
PR_Realloc [../../../../pr/src/malloc/prmem.c, line 75]
nsVoidArray::SizeTo [d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp, line 172]
nsVoidArray::GrowArrayBy [d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp,
line 259]
nsVoidArray::InsertElementAt
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp, line 391]
nsCheapVoidArray::AppendElement
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 287]
nsGenericHTMLContainerElement::AppendChildTo
[d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp,
line 3796]
0xf84dd470
0x2cc38358 


-----

MSVCRT.DLL + 0xd16a (0x7800d16a)
MSVCRT.DLL + 0x11b77 (0x78011b77)
PR_Realloc [../../../../pr/src/malloc/prmem.c, line 75]
nsVoidArray::SizeTo [d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp, line 172]
nsVoidArray::GrowArrayBy [d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp,
line 259]
nsVoidArray::InsertElementAt
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp, line 391]
nsCheapVoidArray::AppendElement
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 287]
nsGenericHTMLContainerElement::AppendChildTo
[d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp,
line 3796]

Comment 1

[chris hofmann]

vidur, any ideas on if we could short circuit the crash 
around here, 

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/base/src/nsGenericElement.cpp


266                nsCheapVoidArray::ReplaceElementAt(void* aElement, PRInt32
aIndex)

267 vidur    3.80 {
268                  if (HasSingleChild()) {
269                    if (aIndex == 0) {
270                      SetSingleChild(aElement);
271                      return PR_TRUE;
272                    }
273                    else {
274                      return PR_FALSE;
275                    }
276                  }
277                  else {
278                    nsVoidArray* vector = GetChildVector();
279                    if (vector) {
280                      return vector->ReplaceElementAt(aElement, aIndex);
281                    }
282                    else {
283                      return PR_FALSE;
284                    }
285                  }
286                }
287                


or thoughts on who might be a better owner for this one?


shiva, jay, tom,
does this stack correlate to anything on the top crash list?

Comment 2

[chris hofmann]

I think I copied the wrong section of code above...
should be the section just below.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Does this seem more like heap corruption?  Or is there a reason we might pass a
bad pointer to realloc?

Comment 4

[Kevin Berkheiser]

I don't see this.  Maybe we need better steps to reproduce?

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316

Comment 5

[Asa Dotzler [:asa]]

Chris, are you still seeing this? I can't reproduce with windows 1.7 beta after
about 20 tries. 

Comment 6

[chris hofmann]

haven't seen it for ages....  bang! it's dead ;-)