129945 - Trunk M099 crash [@ 0x00000000 - nsTypedSelection::selectFrames]

Status: VERIFIED WORKSFORME

(Core :: DOM: Selection, defect)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Talkback is reporting crashes with stacks like the following (this exact stack
was reported in both a 2-28 build and a 3-08 build):

0x00000000
nsTypedSelection::selectFrames
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp line 4934]
nsTypedSelection::Repaint
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp line 5129]
nsSelection::RepaintSelection
[d:\builds\seamonkey\mozilla\content\base\src\nsSelection.cpp line 2822]
PresShell::RepaintSelection
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 2427]
nsDocViewerFocusListener::Blur
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp line 7124]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp line
1709]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp line 3227]
nsEventStateManager::PreHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp line 431]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 6000]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 5928]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp line 2043]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp line 1863]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 869]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 886]
nsWindow::DispatchFocus
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 4905]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 3736]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 1131]
USER32.DLL + 0x1b60 (0x77e11b60)
USER32.DLL + 0x2f29 (0x77e12f29)
USER32.DLL + 0x2f4f (0x77e12f4f)
ntdll.dll + 0x2032f (0x77fa032f)
nsView::~nsView [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 163]
nsView::`scalar deleting destructor'
nsView::Destroy [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 261]
nsFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrame.cpp
line 466]
nsContainerFrame::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp line 142]
ViewportFrame::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp line 157]
FrameManager::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp line 517]
PresShell::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 1710]
DocumentViewerImpl::Destroy
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp line 1454] 

User comments include:

URL: http://www.php-center.de/faq/faq-code.html
Comment: after printing 

URL: http://www.paypal.com/cgi-bin/webscr?cmd=_logout
Comment: I was viewing my account history on PayPal and then clicked on the Log
Out link. 

URL: http://www.country105.com/index.html
Comment: Clicked on a link following Print Preview. 

URL: www.coalitionofwomen4peace.org + www.ariga.com
Comment: I browsed & printed (incl. doing some print-previews before printing to
see if I should print 2 or 1 pages per sheet) a few pages at
http://www.coalitionofwomen4peace.org/ (the Bat-Shalom site) clicked "back" to
return to www.ariga.com and Moz crapped 

URL:
Comment: Selected "get new themes" from the view menu. 

URL: www.4mothers.org.il/mehumot/riots.htm
Comment: I clicked on "back" and Moz crapped out. Of course I printed a few
number of pages before that. I also had another window openned (sp?) on
www.haaretzdaily.com (iirc). 

URL:
Comment: Nothing oddly enough... 

URL: Bugzilla - a query for keyword=css2
Comment:

All of the reports seem to be on NT 4.0, NT 5.0, or NT 5.1.

Comment 1

[Jan Carpenter]

M099 0x00000000 stack signature is a topcrash.  At this offset ( 4860ce7b )
there are 7 crashes today.  Here are the URLs/COMMENTS:


 (3987242)	URL: http://www.indianrailfan.com/cgi-bin/awstats.pl
     (3987242)	Comments: It crashed after I hit the reload button.
     (3959706)	URL: http://www.lanset.com/rajendraks
     (3959706)	Comments: Pressed "back" button in a tabbed browsing window.



 Crash date range: 2002-03-12 to 2002-03-17
     Min/Max Seconds since last crash: 258 - 402960
     Min/Max Runtime: 258 - 402960
     Count   Platform List 
     7   Windows NT 5.0 build 2195
 
     Count   Build Id List 
     7   2002031106
 
     No of Unique Users    7
 

Comment 2

[Jay Patel [:jay]]

The stack for M099 crashes hasn't changed from the one originally reported on
the MozillaTrunk...here are a few more comments to help us reproduce this. 
Adding qawanted keyword.

(4183050)
URL: http://www.gentoo.org
     (4183050)	Comments: I had just closed on of the "tabbed" windows and was going back a
page ( using the back button) when the app crashed.
     (4044219)	URL: http://developer.java.sun.com/servlet/sf2002Login
     (4044219)	Comments: I was clicking on a link in the JavaONE webpage (I don't know the
exact one since all the mozilla instances died  but it's around the one linked
above)
     (4008126)	URL: http://www.clarku.edu
     (4008126)	Comments: opening the above URL
     (4008069)	URL: http://www.macintouch.com/

Comment 3

[lchiang]

terri, can you reproduce this?

Comment 4

[Jay Patel [:jay]]

I haven't seen any crashes like this in recent MozillaTrunk builds.  If Terri
can't reproduce this, we should mark it worksforme.

Comment 5

[Fred Carpio]

Seems to be working fine, non reproducible on build 4-12-2002 on Win 98

Comment 6

[Jay Patel [:jay]]

Marking worksforme, haven't seen this in Talkback data for a while now.

Comment 7

[Terri Preston]

I have not been able to reproduce, marking verified