120722 - M099 Trunk Crash AddDataSource to tree. [@ ChildIterator::get]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Mikhail Khlopotov]

Mozilla crashes on AddDataSource to tree.
The crash is conditional, one known condition for now is if there have been a
child window open before doing AddDataSource. 

Reproducible always. Latest build ID - 2002011403
TB1805879H
TB1805878M
TB1805361G

and so on... Lots of crashes.
Testcase to follow.

Comment 1

[Mikhail Khlopotov]

Attachment: Main XUL of testcase

Comment 2

[Mikhail Khlopotov]

Attachment: JS for testcase

Comment 3

[Mikhail Khlopotov]

Attachment: Second window for testcase

Comment 4

[Mikhail Khlopotov]

Attachment: Second window dor tescase - no crash

Comment 5

[Mikhail Khlopotov]

AddDataSources crashes if there were child window open, which included
unexisting script file...  Really strange.

Comment 6

[greer]

We have incidents of this one in M097 and the Trunk (starting with build 
2002010709). Based on the stack this may need to be reassigned, but I know 
dbaron has his hands full. Here is the stack to go with Mikhail's testcase 
crashes:

Incident 1805879:

ChildIterator::get 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsChildIterator.h, line 106] 
FindPreviousSibling 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 7632] 
nsCSSFrameConstructor::ContentInserted 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 8557] 
StyleSetImpl::ContentInserted 
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1445] 
PresShell::ContentInserted 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5157] 
nsXBLResourceLoader::NotifyBoundElements 
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLResourceLoader.cpp, line 277] 
nsXBLResourceLoader::StyleSheetLoaded 
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLResourceLoader.cpp, line 207] 
CSSLoaderImpl::InsertSheetInDoc 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 1189] 
InsertPendingSheet 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 763] 
nsVoidArray::EnumerateForwards 
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp, line 664] 
nsVoidArray::EnumerateForwards 
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp, line 652] 
CSSLoaderImpl::AddPendingSheet 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 1132] 
CSSLoaderImpl::ParseSheet 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 955] 
CSSLoaderImpl::SheetComplete 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 920] 
CSSLoaderImpl::ParseSheet 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 955] 
CSSLoaderImpl::DidLoadStyle 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 991] 
SheetLoadData::OnStreamComplete 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 751] 
nsStreamLoader::OnStopRequest 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 163] 
nsJARChannel::OnStopRequest 
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 
614] 
nsOnStopRequestEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 
213] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 
1072] 
nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303] 
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1280] 
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1597] 
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1615] 
WinMainCRTStartup() 
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

When I was trying to diagnose this bug from the stack trace alone, I had thought
it might be related to waterson's comment:

  // XXX if the insertionPoint was different from the original
  // parentFrame, then aIndexInContainer is most likely completely
  // wrong. What we need to do here is remember the original index,
  // then as we insert, search the child list where we're about to put
  // the new frame to make sure that it appears after any siblings
  // with a lower index, and before any siblings with a higher
  // index. Same with FindNextSibling(), below.

I'm going to try to figure out how to use the attached testcase -- it would be
helpful in the future if you attach testcases so that they can be loaded in
bugzilla -- that is, attach the JS first, and change the URL in the XUL to point
to the attached JS.  I'm also a little puzzled with this one since the testcase
refers to two local JS files and there's only one attached.

Comment 8

[Mikhail Khlopotov]

The trick with local JS files is that lib7457.js should not exist. 
If it exists, mozilla will not crash. Inclusion of unexistant file is the
condition for the crash to occur.

Comment 9

[Jay Patel [:jay]]

Attachment: More ChildIterator::get stack traces.

One lucky guy crashed 32 times adding a datasource with a recent MozillaTrunk
build (I'm guessing Mikhail):
Count	Offset	  Real Signature
[ 32   ChildIterator::get fafee6a0 - ChildIterator::get ]
 
     Crash date range: 2002-01-14 to 2002-01-17
     Min/Max Seconds since last crash: 3 - 7553
     Min/Max Runtime: 170 - 27518
     Keyword List :  
     Count   Platform List 
     32   Windows NT 5.0 build 2195
 
     Count   Build Id List 
     32   2002011409
 
     No of Unique Users 	1
 
 Stack trace(Frame) 

	 ChildIterator::get    
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsChildIterator.h  line 106]

	 FindPreviousSibling   
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp 
line 7632] 
	 nsCSSFrameConstructor::ContentInserted
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp 
line 8557] 
	 StyleSetImpl::ContentInserted 
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp  line 1445] 
	 PresShell::ContentInserted    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5157] 
	 nsXBLResourceLoader::NotifyBoundElements      
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLResourceLoader.cpp  line 277]

	 nsXBLResourceLoader::StyleSheetLoaded 
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLResourceLoader.cpp  line 207]

	 CSSLoaderImpl::InsertSheetInDoc       
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 1189]

	 InsertPendingSheet    
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 763] 

	 nsVoidArray::EnumerateForwards
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp  line 664] 
	 nsVoidArray::EnumerateForwards
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp  line 652] 
	 CSSLoaderImpl::AddPendingSheet
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 1132]

	 CSSLoaderImpl::ParseSheet     
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 955] 

	 CSSLoaderImpl::SheetComplete  
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 920] 

	 CSSLoaderImpl::ParseSheet     
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 955] 

	 CSSLoaderImpl::DidLoadStyle   
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 991] 

	 SheetLoadData::OnStreamComplete       
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 751] 

	 nsStreamLoader::OnStopRequest 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp  line 163] 
	 nsJARChannel::OnStopRequest   
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp	line
614] 
	 nsOnStopRequestEvent::HandleEvent     
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line
213] 
	 PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c 
line 591] 
	 PL_ProcessPendingEvents       
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524] 
	 _md_EventReceiverProc 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072] 
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 303]

	 main1	[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp 
line 1280] 
	 main	[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp 
line 1597] 
	 WinMain       
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1615] 
	 WinMainCRTStartup()  
	 KERNEL32.DLL + 0x17d08 (0x77e97d08)   
 
     (1804684)	Comments: Crash adding datasource


But there seem to be other stack traces for this stack signature...and I'm not
sure if they're related.   I have attached a few other stacks.	If they're
related, great!  If not, let me know so I can log new bugs.

Comment 10

[Mikhail Khlopotov]

http://bugzilla.mozilla.org/show_bug.cgi?id=105179

looks like related to this

Comment 11

[Jim Berwick]

I filed bug# 122321 for Moz crashing at libpr0n.com after changing style sheets.  The stack trace looks very similar, it may be a dupe

Comment 12

[greer]

*** Bug 122321 has been marked as a duplicate of this bug. ***

Comment 13

[greer]

Migrating some info from bug 122321
Comments that might point to a testcase: 
To reproduce:
Go to http://libpr0n.com
View, Use Stylesheet, Blue
View, Use Stylesheet, Green

Green is the only that does this.  You can go between None and blue all day long 
and nothing will happen.  Can make a crash on an optimized CVS build from last 
night and a debug build from like 8 o clock tonight. 

Comment 14

[David Gerard]

Talkback from 2002012806-0.9.8/WinNT4: TB2318928Q.

Comment 15

[greer]

Still in M098. Updating summary.

M098 (ChildIterator::Get):       18
(2923451) - search for "man screen" using the search bar and google search URL:
http://www.google.com Windows NT  5.0 build 2195
(2940148) - closing e-mail window URL: www.rsr.ch  Windows 98  4.10 build 67766446
(3034839) - initiating a search on google URL: google Windows 98  4.10 build
67766222
(3207170) - saving an attachment in e-mail  Windows 98  4.10 build 67766222
(3215013) - Quitting mail  Windows 98  4.10 build 67766446
(3249110) - Closing Mozilla Mail  Windows NT  5.1 build 2600
(3274717) - choose a search result URL: bugzilla.mozilla.org Windows NT  5.0
build 2195
(3283984) - chatzilla ...entering channel Windows 98  4.10 build 67766222
 
Trunk (ChildIterator::Get):        4
(3199519) - Performed a new install of today's build (n6setupb.exe). Opened
mail. Tried to un-check the "Priority"  column in the mail headers (via
right-click  which didn't work  so tried to do via keyboard only. Context menus
appeared  but when I pressed Enter key  EMAIL: [e-mail] Windows NT  5.0
build 2195
(3299210) - I made a link in my Personal Toolbar Folder with location
irc://irc.xs4all.nl/CistroN and mozilla crashed after clicking it. URL:
irc://irc.xs4all.nl/CistroN  Windows NT  5.1 build 2600

Comment 16

[Jaime Rodriguez, Jr.]

Is this still showing up on 099 in talkback data?

Comment 17

[greer]

Yes, the signature is still showing up in M099 data. Updating the summary. Here 
are the current user comments fro crashes on M099 and the Trunk.

M099 (ChildIterator::get):       10
2002031106 (3967326) - While playing with the IRC client and looking around on 
the menus for a disconnect option. Changed the look to "dark-motif" just before 
program crashed  and I tried to reconnect with "/server efnet.demon.co.uk:6667"   
Windows 98  4.10 build 67766222
2002031106 (3967914) - IRC someone query'ed me. BTW  no way to change name  no 
prefs for irc??  Windows NT  5.1 build 2600
2002031106 (3990383) -  I joined the channel URL: irc://undernet/#rhino9  
Windows NT  5.0 build 2195
2002031106 (4005950) - Chatting  opening a new webpage URL: www.mapblast.com 
Windows 98 4.10 build 67766222
2002031106 (4006326) - Chatting URL: politics.be Windows 98  4.10 build 67766222
2002031106 (4049692) - 2002-03-14  URL: www.dartmouth.edu/~econ22/links Windows 
NT  5.0 build 2195
2002031106 (4051284) - 2002-03-14 I searched for "lost russians" in the side bar 
using goggle. Windows 98  4.10 build 67766446
 
Trunk (ChildIterator::get):        2
2002030511 (3725370) - downloading URL: Palm Blvd open Windows 98  4.10 build 
67766446
2002030911 (3887551) - file -> exit when having a window that's impossible to 
close  Windows NT  5.0 build 2195

Comment 18

[greer]

Attachment: Stack from crash using steps from comment #13

Using the steps from comment #13 still crashes in M099 at ChildIterator::get.
However, this stack passes through different frames than that of the original
crash in comment #6.

Comment 19

[greer]

Marking topcrash+ and testcase for now. Those can be reverted if the crash in 
the attachment above needs a separate bug.

Comment 20

[Joe Hewitt (gone)]

Is this entirely dependent on tree? If so, it is fixed, as I just removed the
tree layout code.  Can anyone confirm?

Comment 21

[greer]

Joe, Talkback is showing this signature with the following frequency:
Trunk: 52
M1.0: 157
M1.1alpha: 30

I think this one was marked fixed on an assumption. REOPENING.

I have been able to crash M1.0 with the steps in comment #13, 100%.

Comment 22

[greer]

Attachment: Breakdown of unique stacks in M1.0 talkback data

Here is a breakdown of all the unique stacks (with user comments) reported by
Talkback for the M1.0 release.

Comment 23

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

We have another bug with this signature and a bit of analysis of it: bug 133219.

Comment 24

[greer]

Ok, my bad. Bug 133219 has been opened to take up this specific issue. 
I will mark it RELSOVED FIXED again because the tree layout code has been removed.