146625 - Crashed when I tried to open another tab [@ nsVoidArray::EnumerateForwards]

Status: RESOLVED INCOMPLETE

(Core :: CSS Parsing and Computation, defect)

Description

[TGOS]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.0rc2) Gecko/20020510
BuildID:    2002051006

I just tried to click on a link and open a new tab when the browser crashed out
of the blue. It does more often on my system, always when the browser has been
running for a longer time, multiple tabs have been opend and closed again, more
than one tab is open at the moment and I try to open another tab by clicking on
a link with middle mouse button.

Reproducible: Not easily reproducible.

Talkback exists.
Talkback ID: TB6617474Z

Please post programmer friendly stack trace here. I'd really like to know what
is causing this annoying bug.

Comment 1

[Doron Rosenberg (IBM)]

Incident ID 6617474
Stack Signature nsVoidArray::EnumerateForwards 57c6ddc8
Email Address [e-mail]
Product ID Gecko1.0
Build ID 2002051008
Trigger Time 2002-05-23 23:15:44
Platform Win32
Operating System Windows 98 4.10 build 67766222
Module XPCOM.DLL
URL visited http://www.javagaming.org
User Comments I just tried to click on a link and open a new tab when the
browser crashed out of the blue. It does more often on my system, always when
the browser has been running for a longer time, more than one tab is open at the
moment and I try to open another tab by clicking on a link.
Trigger Reason Access violation
Source File Name d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp
Trigger Line No. 660
Stack Trace
nsVoidArray::EnumerateForwards
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp, line 660]
CSSRuleProcessor::HasStateDependentStyle
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSStyleSheet.cpp, line 4085]
SheetHasStatefulStyle
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1453]
nsSupportsArray::EnumerateForwards
[d:\builds\seamonkey\mozilla\xpcom\ds\nsSupportsArray.cpp, line 687]
StyleSetImpl::WalkRuleProcessors
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1039]
StyleSetImpl::HasStateDependentStyle
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1483]
nsCSSFrameConstructor::ContentStatesChanged
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 10174]
StyleSetImpl::ContentStatesChanged
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1563]
PresShell::ContentStatesChanged
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5133]
nsDocument::ContentStatesChanged
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1923]
nsEventStateManager::SetContentState
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 3631]
nsEventStateManager::GenerateMouseEnterExit
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2294]
nsEventStateManager::PreHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 389]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6100]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6028]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2076]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1887]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4713]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4968]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3630]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00648bfa 

Comment 2

[Matthias Versen [:Matti]]

-> Style system ?

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

So the crash itself, in the talkback report above, is occurring on the line:

    while (running && (++index < mImpl->mCount))

on the instruction

6113bade 3b5904           cmp     ebx,[ecx+0x4]

presumably because |mImpl| is a bad pointer.  That seems somewhat odd because
ecx and edi are reasonably similar pointers (not sure what edi is, though).

For the record, the full registers and disassembly are:

x86 Registers:
EAX: 00000001 EBX: 00000000 ECX: 02bd4450 EDX: 0064f288
ESI: 00000008 EDI: 02bca61c ESP: 0064f24c EBP: 0064f280
EIP: 6113bade cf pf af zf sf of IF df nt RF vm   IOPL: 0
CS: 0177 DS: 017f SS: 017f ES: 017f FS: 274f GS: 0000

Code Around the PC:
6113bade 3b5904           cmp     ebx,[ecx+0x4]       <=== CRASH HERE
6113bae1 7d11             jge     6113baf4
6113bae3 ff742414         push    dword ptr [esp+0x14]
6113bae7 ff340e           push    dword ptr [esi+ecx]
6113baea ff542418         call    dword ptr [esp+0x18]
6113baee 59               pop     ecx
6113baef 85c0             test    eax,eax
6113baf1 59               pop     ecx
6113baf2 75e3             jnz     6113bad7
6113baf4 5f               pop     edi
6113baf5 5e               pop     esi
6113baf6 5b               pop     ebx
6113baf7 c20800           ret     0x8
6113bafa 56               push    esi
6113bafb 8bf1             mov     esi,ecx
6113bafd e8d1cbfeba       call    1c1286d3

Comment 4

[Keyser Sose]

Marking NEW while this is worked on.

Comment 5

[Mathew McBride]

I seem to be getting the same problem. I'll have to compile a Mozilla build for
Win32 unless someone can provide me with a debug build.

Anyway, this is what VC++ 6.0 tells me:
004114F6   jmp         dword ptr ds:[4120F4h]
004114FC   jmp         dword ptr ds:[4120E0h]
00411502   push        ebp <-- Crash here
00411503   mov         ebp,esp
00411505   push        0FFh

Call Stack: 
MOZILLA! 00411502()
KERNEL32! 77e814c7()

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6a) Gecko/20031009

Comment 6

[Wayne Mery (:wsmwk)]

WFM no crash and there are currently no open bugs with nsVoidArray::EnumerateForwards as top of stack

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3pre) Gecko/2008020104 Minefield/3.0b3pre
and
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071128 SeaMonkey/1.1.7

close?

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+2]]

If no crash is listed anymore I think yes.

Comment 8

[Jesse Ruderman on Windows]

dbaron, this bug has a stack trace, but it's from 2002 so I doubt it's interesting.