116287 - crash if I close window when going to http://www.fsplanet.com

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Jason Ding]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.6) Gecko/20011120
BuildID:    20011112012

When I browse to www.fsplanet.com in a tab and then close that tab, the browser
crashes. The site has some Javascript junk which will bring up pop-ups when the
site is closed, which I believe is what's going on.

Reproducible: Always
Steps to Reproduce:
1. Open up Mozilla, open a new tab, go to www.fsplanet.com
2. Wait for the page to load. Then close the tab by clicking on the 'x'

Actual Results:  Browser goes *poof*, Netscape Quality Agent pops up.

Expected Results:  Tab should have closed properly, a few pop-ups should have
been displayed.

Submitted TB729966H as a result of this.

Other details about my platform:
- redhat 6.2
- ximian gnome 1.4
- amd thunderbird 1ghz
- 256 megs/ram
- running win98 through vmware at the time of crash

Comment 1

[Aleksander Adamowski]

Confirming.
I see this on Linux trunk build 2001121921.

Comment 2

[Aleksander Adamowski]

Also submitted a talkback report (TB730839Y).

Comment 3

[Scott Kester]

WFM Linux trunk build 2001122006 RH 7.2

Comment 4

[Asa Dotzler [:asa]]

Stack Signature  libX11.so.6 + 0x1e82a (0x403f182a) f3cb47dd
Trigger Time 2001-12-20 13:04:40
Email Address [e-mail]
URL visited http://www.fsplanet.com
User Comments Bugzilla bug 116287.
Build ID 2001121921
Product ID MozillaTrunk
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
libX11.so.6 + 0x1e82a (0x403f182a)
libgdk-1.2.so.0 + 0x2e855 (0x40387855) 

Comment 5

[Asa Dotzler [:asa]]

hmm, first talkback looks like it's got more to say. 

Stack Signature  libX11.so.6 + 0x1d797 (0x403a5797) f8e58b0b
Trigger Time 2001-12-20 12:41:35
Email Address [e-mail]
URL visited www.fsplanet.com
User Comments
Build ID 2001112012
Product ID MozillaBranch
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
libX11.so.6 + 0x1d797 (0x403a5797)
libgdk-1.2.so.0 + 0x27fa1 (0x40343fa1)
nsDeviceContextGTK::GetRect()
nsDeviceContextGTK::GetClientRect()
ScreenImpl::GetAvailWidth()
nsWindowWatcher::SizeOpenedDocShellItem()
nsWindowWatcher::OpenWindowJS()
nsWindowWatcher::OpenWindow()
GlobalWindowImpl::OpenInternal()
GlobalWindowImpl::Open()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
nsJSContext::CallEventHandler()
nsJSEventListener::HandleEvent()
nsEventListenerManager::HandleEventSubType()
nsEventListenerManager::HandleEvent()
GlobalWindowImpl::HandleDOMEvent()
DocumentViewerImpl::Unload()
nsDocShell::FireUnloadNotification()
nsDocShell::Destroy()
nsWebShell::Destroy()
nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame()
nsFrame::Destroy()
nsFrameList::DestroyFrames()
nsContainerFrame::Destroy()
nsFrameList::DestroyFrame()
nsBoxFrame::RemoveFrame()
FrameManager::RemoveFrame()
nsCSSFrameConstructor::ContentRemoved()
StyleSetImpl::ContentRemoved()
PresShell::ContentRemoved()
nsXULDocument::ContentRemoved()
nsXULElement::RemoveChildAt()
nsXULElement::RemoveChild()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
nsJSContext::CallEventHandler()
nsJSEventListener::HandleEvent()
nsEventListenerManager::HandleEventSubType()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
PresShell::HandleEventInternal()
PresShell::HandleEventWithTarget()
nsEventStateManager::CheckForAndDispatchClick()
nsEventStateManager::PostHandleEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWidget::OnButtonReleaseSignal()
nsWindow::HandleGDKEvent()
dispatch_superwin_event()
handle_gdk_event()
libgdk-1.2.so.0 + 0x17392 (0x40333392)
libglib-1.2.so.0 + 0xf9f6 (0x403629f6)
libglib-1.2.so.0 + 0xffb1 (0x40362fb1)
libglib-1.2.so.0 + 0x10129 (0x40363129)
libgtk-1.2.so.0 + 0x8d48a (0x4027e48a)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x189cb (0x404629cb) 

Comment 6

[John Morrison]

Somewhat similar, but not identical, to bug 115969, which is a crash when 
onunload attempts a window.open() while the parent browser window is shutting 
down. 

But, that crashes on linux and win32, and the stack is different. This bug's 
steps to reproduce do not crash current mozilla trunk on win2k.

-> danm

Comment 7

[Blake Ross]

*** Bug 125425 has been marked as a duplicate of this bug. ***

Comment 8

[Judson Valeski]

can't repro w/ today's win2k build.

Comment 9

[Jaime Rodriguez, Jr.]

WFM. Marking as such.

Comment 10

[Kenneth Herron]

I'm able to reproduce the problem using nightly 2002030621 on red hat Linux 7.2.
The sample URL for this bug and the one for bug 125425 still work and cause
mozilla to crash.  I filed a new talkback but I don't know how to tell what the
number was.

Comment 11

[Juan José Mata]

Update target milestone to 'Future' since this missed the 'mozilla1.1beta' train.

Comment 12

[Dan M]

I can't reproduce using fsplanet.com or the (no longer valid) url in bug 125425
or its partially reduced testcase or using a homespun page that opens a window
in an unload handler. And let me just say how annoying it is to browse with
unload popup windows not disabled. I'm using a build from today's (1.4b) source
on RedHat 8.

Windows opening in the unload handler was armoured up in Aug 2002 (see bug
130719). I'm guessing that fixed this one, too. Closing WFM.