116463 - Browser crash on click-on-Back twice (TB773538M)

Status: RESOLVED WORKSFORME

(Core :: XBL, defect, P2)

Description

[Ashley Bischoff (blog at handcoding.com)]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.7+)
Gecko/20011221
BuildID:    200112103

I clicked on the "Back" button twice in rapid succession, almost like a
double-click. And, Mozilla died.

Reproducible: Didn't try
Steps to Reproduce:
1. I clicked on the Back button twice in a row, quickly.

Actual Results:  Browser crash

Expected Results:  No crash :).

Talkback ID: TB773538M. 

-> History: Session, as an initial triage

Comment 1

[Ashley Bischoff (blog at handcoding.com)]

CC: [e-mail], for talkback retrieval, please (TB773538M).

Comment 2

[Ashley Bischoff (blog at handcoding.com)]

Talkback IDs TB776361Y and TB782333Z may also be related to this -- they occured
while hitting "Back".

Comment 3

[Ashley Bischoff (blog at handcoding.com)]

Talkback ID TB782757Z also corresponds to this bug.

Comment 4

[[e-mail] (gone - use [e-mail] instead)]

Stack Signature  ntdll.dll + 0x4b1cf (0x77fcb1cf) a37bd6f9
Trigger Time 2001-12-21 13:36:10
Email Address [e-mail]
URL visited
User Comments
Build ID 2001122106
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
Stack Trace
ntdll.dll + 0x4b1cf (0x77fcb1cf)
MSVCRT.DLL + 0x1426 (0x78001426)
MSVCRT.DLL + 0x13c3 (0x780013c3)
nsXULElement::SetAttr
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2754]
SetAttrs [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeBinding.cpp,
line 1104]
_hashEnumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 199]
PL_HashTableEnumerateEntries [../../../lib/ds/plhash.c, line 430]
nsHashtable::Enumerate [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp,
line 362]
nsXBLPrototypeBinding::SetInitialAttributes
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeBinding.cpp, line 1134]
nsXBLBinding::GenerateAnonymousContent
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLBinding.cpp, line 797]
nsXBLService::LoadBindings
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp, line 712]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7079]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7044]
nsCSSFrameConstructor::CreateAnonymousFrames
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 5065]
nsCSSFrameConstructor::BuildGfxScrollFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6005]
nsCSSFrameConstructor::BeginBuildingScrollFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 5802]
nsCSSFrameConstructor::ConstructRootFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 3700]
StyleSetImpl::ConstructRootFrame
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1443]
PresShell::InitialReflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2662]
HTMLContentSink::StartLayout
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3913]
HTMLContentSink::OpenBody
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3188]
CNavDTD::OpenBody [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line
3142]
CNavDTD::OpenContainer [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 3397]
CNavDTD::HandleDefaultStartToken
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1309]
CNavDTD::HandleStartToken
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1718]
CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 900]
CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 531]
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1984]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1848]
nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2473]
nsDocumentOpenInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 243]
nsHttpChannel::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2429]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 203]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1280]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1597]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1615]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 5

[Radha on family leave (not reading bugmail)]

The crash may have happened due to clicking back button. But I do not see any
session history code in the stack. Sending to the layout team for evaluation. 

Comment 6

[Kevin McCluskey (gone)]

I can not reproduce using a trunk build on WINXP. I tried double-clicking on the
backbutton numerous times and I can not get it to crash. 

Comment 7

[Ashley Bischoff (blog at handcoding.com)]

Kevin: I could never get the bug to consistently reproduce (and I'm the
reporter). To be honest, I'm not even certain that there's a strict
cause-and-effect relationship between the double-back-click and the crash -- I
was just trying to describe what I think I was doing at the time of the crash.

Hopefully, the Talkback IDs will assist in unraveling this bug :).

Comment 8

[Kevin McCluskey (gone)]

Bulk moving Mozilla1.1 bugs to future-P2. I will pull from this list when
scheduling post Mozilla1.0 work.

Comment 9

[vectro]

I can't reproduce this. But I think I have the same bug. Try the following:

1) Fill your history with at least three pages.
2) Click, in rapid succession (<1/10 sec?), back, back, forward, back, back,
forward, forward.
3) Mozilla becomes unresponsive for about a second, then crashes.

(This is using Debian Mozilla 0.9.9-5pre6v1)

Comment 10

[vectro]

Can't reproduce the comment I just made on 2002041711. :(

Comment 11

[Kevin McCluskey (gone)]

Reassigning since stack in Comment#4 indicates the crash is in XBL.
However, I wasn't able to reproduce the crash 

Comment 12

[Asa Dotzler [:asa]]

unable to reproduce with windows 1.7 beta build. is there any value in keeping
this report open? I'd expect that if hitting the back button twice was really
crashing us today that we'd have scores of duplicates. It's even a smoketest and
I haven't repruduced it in any of my dozens of smoketest runs in the last few
months. 

Comment 13

[Ashley Bischoff (blog at handcoding.com)]

-> WORKSFORME 

(original reporter)