13575 - browser crashes after exiting xul document

Status: VERIFIED WORKSFORME

(Core Graveyard :: Profile: BackEnd, defect, P5, critical)

Description

[varada]

When I try to exit a xul document and opening another file or location - I get
this crash. From the stack I am guessing it has something to do with the js
Garbage collection - The file that caused this was res/acct/am2.xul.

_free_dbg_lk(void * 0x03479d90, int 0x00000001) line 1033 + 60 bytes
_free_dbg(void * 0x03479d90, int 0x00000001) line 970 + 13 bytes
free(void * 0x03479d90) line 926 + 11 bytes
JS_free(JSContext * 0x02d75eb0, void * 0x03479d90) line 949 + 10 bytes
js_FinalizeString(JSContext * 0x02d75eb0, JSString * 0x028b0368) line 2140 + 16
bytes
js_GC(JSContext * 0x02d75eb0) line 832 + 11 bytes
js_ForceGC(JSContext * 0x02d75eb0) line 615 + 9 bytes
JS_GC(JSContext * 0x02d75eb0) line 1073 + 9 bytes
nsJSContext::GC(nsJSContext * const 0x02d740e0) line 336 + 13 bytes
nsJSContext::ScriptEvaluated(nsJSContext * const 0x02d740e0) line 350
nsJSContext::EvaluateString(nsJSContext * const 0x02d740e0, const nsString &
{...}, const char * 0x00c95a30, unsigned int 0x00000000, nsString & {...}, int *
0x0012e0c0) line 172
nsBrowserAppCore::ExecuteScript(nsBrowserAppCore * const 0x033e96e0,
nsIScriptContext * 0x02d740e0, const nsString & {...}) line 2373
nsBrowserAppCore::OpenWindow(nsBrowserAppCore * const 0x033e970c) line 2183 + 51
bytes
BrowserAppCoreOpenWindow(JSContext * 0x02d75eb0, JSObject * 0x028af858, unsigned
int 0x00000000, long * 0x02893e8c, long * 0x0012e62c) line 1211 + 12 bytes
js_Invoke(JSContext * 0x02d75eb0, unsigned int 0x00000000, unsigned int
0x00000000) line 654 + 26 bytes
js_Interpret(JSContext * 0x02d75eb0, long * 0x0012ee5c) line 2228 + 15 bytes
js_Invoke(JSContext * 0x02d75eb0, unsigned int 0x00000000, unsigned int
0x00000000) line 670 + 13 bytes
js_Interpret(JSContext * 0x02d75eb0, long * 0x0012f648) line 2228 + 15 bytes
js_Invoke(JSContext * 0x02d75eb0, unsigned int 0x00000001, unsigned int
0x00000002) line 670 + 13 bytes
js_InternalCall(JSContext * 0x02d75eb0, JSObject * 0x028381b0, long 0x028381b8,
unsigned int 0x00000001, long * 0x0012f7a4, long * 0x0012f7b0) line 747 + 15
bytes
JS_CallFunctionValue(JSContext * 0x02d75eb0, JSObject * 0x028381b0, long
0x028381b8, unsigned int 0x00000001, long * 0x0012f7a4, long * 0x0012f7b0) line
2643 + 29 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x034958f0) line 110 + 40 bytes
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012f9a8, nsIDOMEvent * * 0x0012f970, unsigned int 0x00000003, nsEventStatus &
nsEventStatus_eIgnore) line 1159 + 27 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x031f4f10, nsIPresContext
& {...}, nsEvent * 0x0012f9a8, nsIDOMEvent * * 0x0012f970, unsigned int
0x00000001, nsEventStatus & nsEventStatus_eIgnore) line 2847
nsMenuFrame::Execute() line 946
nsMenuFrame::HandleEvent(nsMenuFrame * const 0x028caf98, nsIPresContext & {...},
nsGUIEvent * 0x0012fc18, nsEventStatus & nsEventStatus_eConsumeDoDefault) line
250
PresShell::HandleEvent(PresShell * const 0x02dc9234, nsIView * 0x0347e8d0,
nsGUIEvent * 0x0012fc18, nsEventStatus & nsEventStatus_eConsumeDoDefault) line
2000 + 38 bytes
nsView::HandleEvent(nsView * const 0x0347e8d0, nsGUIEvent * 0x0012fc18, unsigned
int 0x00000008, nsEventStatus & nsEventStatus_eConsumeDoDefault, int &
0x00000000) line 835
nsView::HandleEvent(nsView * const 0x02dc9650, nsGUIEvent * 0x0012fc18, unsigned
int 0x0000001c, nsEventStatus & nsEventStatus_eConsumeDoDefault, int &
0x00000000) line 820
nsViewManager::DispatchEvent(nsViewManager * const 0x02dc9b50, nsGUIEvent *
0x0012fc18, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 1612
HandleEvent(nsGUIEvent * 0x0012fc18) line 67
nsWindow::DispatchEvent(nsWindow * const 0x0347e794, nsGUIEvent * 0x0012fc18,
nsEventStatus & nsEventStatus_eIgnore) line 381 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fc18) line 406
nsWindow::DispatchMouseEvent(unsigned int 0x0000012d, nsPoint * 0x00000000) line
3162 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 0x0000012d, nsPoint * 0x00000000)
line 3357
nsWindow::ProcessMessage(unsigned int 0x00000202, unsigned int 0x00000000, long
0x00410020, long * 0x0012fe38) line 2419 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x006b0894, unsigned int 0x00000202, unsigned int
0x00000000, long 0x00410020) line 454 + 27 bytes
USER32! 77e71820()

Comment 1

[cbegle]

i'm also crashing, but i'm getting a different stack trace.  looks like a
dialup (!) problem.  steve, do you know who owns this stuff now?

GetModemList(char * * * 0x0012e734, int * 0x0012e730) line 229
nsAccount::GetModemConfig(nsAccount * const 0x02acfa00, nsString & {...}) line
668 + 13 bytes
AccountServicesImpl::GetModemConfig(AccountServicesImpl * const 0x02acfbe0,
char * * 0x0012e910) line 122
XPTC_InvokeByIndex(nsISupports * 0x02acfbe0, unsigned int 5, unsigned int 1,
nsXPTCVariant * 0x0012e910) line 135
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x023c50c0,
nsXPCWrappedNative * 0x02ad5190, const XPCNativeMemberDescriptor * 0x02ad522c,
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 0, long *
0x01efd078, long * 0x0012eab0) line 751 + 44 bytes
WrappedNative_CallMethod(JSContext * 0x023c50c0, JSObject * 0x01dea588,
unsigned int 0, long * 0x01efd078, long * 0x0012eab0) line 170 + 34 bytes
js_Invoke(JSContext * 0x023c50c0, unsigned int 0, unsigned int 0) line 655 + 26
bytes
js_Interpret(JSContext * 0x023c50c0, long * 0x0012f328) line 2232 + 15 bytes
js_Invoke(JSContext * 0x023c50c0, unsigned int 0, unsigned int 0) line 671 + 13
bytes
js_Interpret(JSContext * 0x023c50c0, long * 0x0012fbac) line 2232 + 15 bytes
js_Execute(JSContext * 0x023c50c0, JSObject * 0x01de99c8, JSScript *
0x035250a0, JSFunction * 0x00000000, JSStackFrame * 0x00000000, int 0, long *
0x0012fbac) line 828 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x023c50c0, JSObject * 0x01de99c8,
JSPrincipals * 0x02aeb9ac, const unsigned short * 0x0012fc40, unsigned int 14,
const char * 0x00000000, unsigned int 0, long * 0x0012fbac) line 2619 + 27
bytes
nsJSContext::EvaluateString(nsJSContext * const 0x023c40e0, const nsString &
{...}, void * 0x01de99c8, nsIPrincipal * 0x02aeb9a0, const char * 0x00000000,
unsigned int 0, nsString & {...}, int * 0x0012fc20) line 186 + 53 bytes
GlobalWindowImpl::RunTimeout(nsTimeoutImpl * 0x02ae2a80) line 1699 + 76 bytes
nsGlobalWindow_RunTimeout(nsITimer * 0x02ae2080, void * 0x02ae2a80) line 1617 +
15 bytes
TimerImpl::Fire(unsigned long 682867968) line 308 + 17 bytes
TimerImpl::ProcessTimeouts(unsigned long 682867968) line 187
FireTimeout(HWND__ * 0x00000000, unsigned int 275, unsigned int 19311, unsigned
long 682867968) line 101 + 9 bytes
USER32! 77e71373()
nsAppShellService::Run(nsAppShellService * const 0x00ee5980) line 462
main1(int 2, char * * 0x00bb4260) line 591 + 12 bytes
main(int 2, char * * 0x00bb4260) line 702 + 13 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77f1b304()

Comment 2

[selmer (gone)]

We shouldn't have any paths leading there right now.  Varada will fix that.

Comment 3

[cbegle]

i'm changing the component (not sure if it's the right one) to get it out of
the JS queue for now.   thanks for looking at it, steve!

Comment 4

[varada]

Will create a proper testcase to reproduce the JS bug

Comment 5

[varada]

marking tfv m16

Comment 6

[leger]

Setting QA Contact.

Comment 7

[leger]

Moving all Profile Manager bugs to new Profile Manager Backend component.
Profile Manager component to be deleted.

Comment 8

[leger]

Adding "crash" keyword to all known open crasher bugs.

Comment 9

[selmer (gone)]

Varada, what's up with this bug?  Why is it still open?

Comment 10

[varada]

Dialup is currently not in the plan for either Beta or RTM. Marking as LATER

Comment 11

[Grace Bush]

verifying later

Comment 12

[Christopher Hoess (gone)]

LATER is deprecated per bug 35839.  Is this still an issue?

Comment 13

[(not reading, please use [e-mail] instead)]

taking all of varada's bugs.

Comment 14

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 15

[Matthias Versen [:Matti]]

varada (still around ?): Is this still a problem ?

Comment 16

[Andreas Kunz]

This bug was last seen 1999-09-24 and in 2000 was first asked why it is still
open. Never answered since then.
-> WFM

Comment 17

[Grace Bush]

v