146891 - Trunk crash in edit->preferences [@ nsXULPrototypeElement::ReleaseSubtree]

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Jay Patel [:jay]]

A lot of users are crashing going to edit->preferences with recent MozillaTrunk
builds.  There are incidents for all flavors of windows and linux.  Here's the
latest Talkback data:

nsXULPrototypeElement::ReleaseSubtree   42 
BBID range: 6318274 - 6612176
Min/Max Seconds since last crash: 1 - 181942
Min/Max Runtime: 25 - 201620
Crash data range: 2002-05-15 to 2002-05-23
Build ID range: 2002051304 to 2002052308
Keyword List : pref(7), 
Stack Trace: 

	 nsXULPrototypeElement::ReleaseSubtree
[nsXULElement.h  line 249]
	 nsXULPrototypeDocument::~nsXULPrototypeDocument
[nsXULPrototypeDocument.cpp  line 252]
	 nsXULPrototypeDocument::`scalar deleting destructor'
	 nsDOMCSSDeclaration::Release
[nsDOMCSSDeclaration.cpp  line 77]
	 nsCOMPtr_base::~nsCOMPtr_base
[nsCOMPtr.cpp  line 65]
	 nsXULPrototypeCache::GetPrototype
[nsXULPrototypeCache.cpp  line 284]
	 nsXULDocument::ResumeWalk
[nsXULDocument.cpp  line 5617]
	 nsXULDocument::OnStreamComplete
[nsXULDocument.cpp  line 5933]
	 nsStreamLoader::OnStopRequest
[nsStreamLoader.cpp  line 163]
	 nsJARChannel::OnStopRequest
[nsJARChannel.cpp  line 609]
	 nsOnStopRequestEvent::HandleEvent
[nsRequestObserverProxy.cpp  line 213]
	 PL_HandleEvent
[plevent.c  line 597]
	 PL_ProcessPendingEvents
[plevent.c  line 530]
	 _md_EventReceiverProc
[plevent.c  line 1078]
	 nsAppShellService::Run
[nsAppShellService.cpp  line 451]
	 main1
[nsAppRunner.cpp  line 1472]
	 main
[nsAppRunner.cpp  line 1808]
	 WinMain
[nsAppRunner.cpp  line 1826]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x7903 (0x77e87903)
 
 	Source File : nsXULElement.h line : 249
     (6605162)	Comments: just installed real player from the plugins download page
     (6580968)	Comments: tried to choose edit/preferenses
     (6580940)	Comments: Tried to choose edit menu
     (6580922)	Comments: Opened email
     (6539544)	URL: http://www.substyle.com
     (6539544)	Comments: Tried to start composer
     (6503908)	Comments: closing mozilla
     (6500690)	Comments: Edit - Preferences
     (6500673)	Comments: Edit - Preferences
     (6500660)	Comments: Edit - Preferences
     (6489511)	Comments: edit preferences
     (6440685)	Comments: Editing preferences
     (6376888)	Comments: I strted compopser after installing CaScaDeS (and after restarting
mozilla). I Have already had calendar and jabberzilla installed.
     (6370707)	Comments: I was using windows 98 when i open mozilla browser and i wentto
check some documents on this web site: www.easypics.com(Adult Material)then i
got this error message: and if i go to EDIT and then prefferences  I get this
message all the time until i
     (6370707)	Comments:  reboot thewindoze for one more time.. MOZILLA caused an invalid
page fault inmodule GKCONTENT.DLL at 017f:605ea1dd.Registers:EAX=020e8010
CS=017f EIP=605ea1dd EFLGS=00010202EBX=0208c310 SS=0187 ESP=0064f990
EBP=0064f9e4ECX=00000000
     (6370707)	Comments:  DS=0187 ESI=00000002 FS=197fEDX=00000003 ES=0187 EDI=02074620
GS=0000Bytes at CS:EIP:8b 01 ff 50 0c 4e 79 f2 8b cf 5f 5e e9 e5 91 ff Stack
dump:007ce010 0208c2f0 605ecf6d 007ce010 0208c2f0 60696998 605eced0 60ea9e68
605d647d 00000001 60ea9e74
     (6370707)	Comments:  0208c2f0 605ede98 80000000 02078950 00000000 
     (6341542)	Comments: Opened a page incomposer
     (6341047)	Comments: Tried to open a frameset in Editor
     (6334554)	URL: http://www.substyle.com
     (6334554)	Comments: I opened the mentioned URL and clicked the button to open Composer
- just in that moment Communicator crashes... Reproducible!

The stack is pointing to line 249 (actually line 248 b/c of a bug in Talkback)
in 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xul/content/src/nsXULElement.h

Here's the code around the crash:
246     virtual void ReleaseSubtree() 
247     {
248       if (mChildren) {
249         for (PRInt32 i = mNumChildren-1; i >= 0; i--)
250           mChildren[i]->ReleaseSubtree();
251       }
252 
253       nsXULPrototypeNode::ReleaseSubtree();
254     }

Comment 1

[Jay Patel [:jay]]

Adding crash keywords and qawanted to see if we can get this reproduced.

Comment 2

[John Morrison]

*** Bug 145949 has been marked as a duplicate of this bug. ***

Comment 3

[Brendan Eich [:brendan]]

Trunk-only, eh?  Activating wonder-twin powers, giving to ben.

/be

Comment 4

[John S. Musarra]

Can reproduce at will. Talkback IDs:

TB7088305K
TB7086988Y

Comment 5

[Ben Goodger (use ben at mozilla dot org for email)]

This is fixed by the patch in bug 143118

Comment 6

[Ben Goodger (use ben at mozilla dot org for email)]

fixed. 

Comment 7

[shrirang khanzode]

verif fixd. confirmed with [e-mail]