148547 - Crash occurs when closing page in a tab or window

Status: VERIFIED FIXED

(Camino Graveyard :: Page Layout, defect)

Description

[Chris Petersen]

Build: 0.3.0 (2002-06-01-05-trunk)
Platform: OS X 10.1.4
Expected Results: Page closes in a tab or window.
What I got: Application crashs

Steps to reproduce:

Opening in tab:

1) Launch Chimera
2) Create a new tab
3) Paste this url:
http://www.sdinsider.com/broadband.html and press return
4) After page loads, press command -y to close tab
5) App crashes

Opening in window

1) Launch Chimera
2) Create a new window
3) Paste this url:
http://www.sdinsider.com/broadband.html and press return
4) After page loads, press command -w to close window.
5) App crashes

Comment 1

[Chris Petersen]

Stack trace after closing window:


Date/Time:  2002-06-01 12:27:38 -0700
OS Version: 10.1.4 (Build 5Q125)

Command:    Navigator
PID:        495

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x07ec05e3

Thread 0:
 #0   0x735038f8 in SetPortRGBForeColor
 #1   0x7350de78 in SetPortForeColor
 #2   0x73517830 in ForeColor
 #3   0x02a66b7c in nsImageMac::DrawToImage(nsIImage *, int, int, int, int)
 #4   0x0405dd18 in gfxImageFrame::DrawTo(gfxIImageFrame *, int, int, int, int)
 #5   0x034eeadc in imgContainer::DoComposite(gfxIImageFrame **, nsRect *, int, int)
 #6   0x034ee820 in imgContainer::Notify(nsITimer *)
 #7   0x00235adc in nsTimerImpl::Fire(void)
 #8   0x00235c38 in handleTimerEvent(TimerEventType *)
 #9   0x00230d90 in PL_HandleEvent
 #10  0x00230c78 in PL_ProcessPendingEvents
 #11  0x00231c40 in nsEventQueueImpl::ProcessPendingEvents(void)
 #12  0x02971d98 in -[EventQueueHandler eventTimer:]
 #13  0x708d06e8 in __NSFireTimer
 #14  0x70196cd0 in __CFRunLoopDoTimer
 #15  0x7017c258 in __CFRunLoopRun
 #16  0x701b7100 in CFRunLoopRunSpecific
 #17  0x7017b8e0 in CFRunLoopRunInMode
 #18  0x7312d8f4 in RunEventLoopInModeUntilEventArrives
 #19  0x73140808 in ReceiveNextEventCommon
 #20  0x731715ec in BlockUntilNextEventMatchingListInMode
 #21  0x70bd70b8 in _DPSNextEvent
 #22  0x70bfe5d8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
 #23  0x70c23468 in -[NSApplication run]
 #24  0x70c91ed0 in NSApplicationMain
 #25  0x00002940 in _start
 #26  0x00002770 in start

Thread 1:
 #0   0x700252fc in select
 #1   0x00160758 in poll
 #2   0x0015ce70 in _pr_poll_with_poll
 #3   0x0229d684 in nsSocketTransportService::Run(void)
 #4   0x00233800 in nsThread::Main(void *)
 #5   0x0015e32c in _pt_root
 #6   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00159418 in PR_WaitCondVar
 #3   0x022a7914 in nsDNSService::DequeuePendingQ(void)
 #4   0x022a731c in nsDNSService::Run(void)
 #5   0x00233800 in nsThread::Main(void *)
 #6   0x0015e32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x001591b4 in pt_TimedWait
 #4   0x0015942c in PR_WaitCondVar
 #5   0x00237260 in TimerThread::Run(void)
 #6   0x00233800 in nsThread::Main(void *)
 #7   0x0015e32c in _pt_root
 #8   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00159418 in PR_WaitCondVar
 #3   0x00234920 in nsThreadPool::GetRequest(nsIThread *)
 #4   0x00235274 in nsThreadPoolRunnable::Run(void)
 #5   0x00233800 in nsThread::Main(void *)
 #6   0x0015e32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 5:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body


PPC Thread State:
  srr0: 0x735038f8 srr1: 0x0000f030                vrsave: 0x00000000
   xer: 0x00000018   lr: 0x7350de78  ctr: 0x70000a30   mq: 0x00000000
    r0: 0x00000000   r1: 0xbfffe790   r2: 0x04190f20   r3: 0x735910de
    r4: 0x735910de   r5: 0x00000000   r6: 0x000001fe   r7: 0x0000001c
    r8: 0x000000b6   r9: 0x07ec05cb  r10: 0x00340da0  r11: 0xbfffe7c8
   r12: 0x7350c6e0  r13: 0x00000000  r14: 0x00000033  r15: 0x0442eda0
   r16: 0x0442edd0  r17: 0xbfffee90  r18: 0x03893940  r19: 0x00006607
   r20: 0x00000000  r21: 0x0000001c  r22: 0x70004234  r23: 0x700042c8
   r24: 0x00000004  r25: 0x000003a4  r26: 0x70002d84  r27: 0x70002e10
   r28: 0x00000000  r29: 0xbfffef00  r30: 0x00000000  r31: 0x00000001

**********

Comment 2

[Chris Petersen]

Stack trace after closing tab:

Date/Time:  2002-06-01 12:48:41 -0700
OS Version: 10.1.4 (Build 5Q125)

Command:    Navigator
PID:        510

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x8e6b042e

Thread 0:
 #0   0x734e2d64 in InternalColor2Index
 #1   0x734ff81c in Color2IndexWithPort
 #2   0x7355aa80 in MapToColor
 #3   0x73550400 in GetFgBkOldPort
 #4   0x73510714 in GetFgBkColors
 #5   0x73509f2c in ColorMap
 #6   0x73502c20 in Stretch
 #7   0x7351d960 in OneSrcOneDst
 #8   0x73515644 in BitsDevLoop
 #9   0x735091a8 in CommonBits
 #10  0x7351080c in CopyDeepMask
 #11  0x02a673c4 in nsImageMac::CopyBitsWithMask(BitMap *, BitMap *, short,
BitMap *, Rect const &, Rect const &, Rect const &, int)
 #12  0x02a66c40 in nsImageMac::DrawToImage(nsIImage *, int, int, int, int)
 #13  0x0405ad18 in gfxImageFrame::DrawTo(gfxIImageFrame *, int, int, int, int)
 #14  0x034eea70 in imgContainer::DoComposite(gfxIImageFrame **, nsRect *, int, int)
 #15  0x034ee820 in imgContainer::Notify(nsITimer *)
 #16  0x00235adc in nsTimerImpl::Fire(void)
 #17  0x00235c38 in handleTimerEvent(TimerEventType *)
 #18  0x00230d90 in PL_HandleEvent
 #19  0x00230c78 in PL_ProcessPendingEvents
 #20  0x00231c40 in nsEventQueueImpl::ProcessPendingEvents(void)
 #21  0x02971d98 in -[EventQueueHandler eventTimer:]
 #22  0x708d06e8 in __NSFireTimer
 #23  0x70196cd0 in __CFRunLoopDoTimer
 #24  0x7017c258 in __CFRunLoopRun
 #25  0x701b7100 in CFRunLoopRunSpecific
 #26  0x7017b8e0 in CFRunLoopRunInMode
 #27  0x7312d8f4 in RunEventLoopInModeUntilEventArrives
 #28  0x73140808 in ReceiveNextEventCommon
 #29  0x731715ec in BlockUntilNextEventMatchingListInMode
 #30  0x70bd70b8 in _DPSNextEvent
 #31  0x70bfe5d8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
 #32  0x70c23468 in -[NSApplication run]
 #33  0x70c91ed0 in NSApplicationMain
 #34  0x00002940 in _start
 #35  0x00002770 in start

Thread 1:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body
 #5   0x90010008 in 0x90010008

Thread 2:
 #0   0x700252fc in select
 #1   0x00160758 in poll
 #2   0x0015ce70 in _pr_poll_with_poll
 #3   0x0229d684 in nsSocketTransportService::Run(void)
 #4   0x00233800 in nsThread::Main(void *)
 #5   0x0015e32c in _pt_root
 #6   0x7002054c in _pthread_body

Thread 3:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00159418 in PR_WaitCondVar
 #3   0x022a7914 in nsDNSService::DequeuePendingQ(void)
 #4   0x022a731c in nsDNSService::Run(void)
 #5   0x00233800 in nsThread::Main(void *)
 #6   0x0015e32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 4:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x001591b4 in pt_TimedWait
 #4   0x0015942c in PR_WaitCondVar
 #5   0x00237260 in TimerThread::Run(void)
 #6   0x00233800 in nsThread::Main(void *)
 #7   0x0015e32c in _pt_root
 #8   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x00159418 in PR_WaitCondVar
 #3   0x00234920 in nsThreadPool::GetRequest(nsIThread *)
 #4   0x00235274 in nsThreadPoolRunnable::Run(void)
 #5   0x00233800 in nsThread::Main(void *)
 #6   0x0015e32c in _pt_root
 #7   0x7002054c in _pthread_body


PPC Thread State:
  srr0: 0x734e2d64 srr1: 0x0000f030                vrsave: 0x00000000
   xer: 0x20000018   lr: 0x734e2d08  ctr: 0x702418b0   mq: 0x00000000
    r0: 0x00000000   r1: 0xbfffdd40   r2: 0xbfffe760   r3: 0x00000000
    r4: 0x000e92a4   r5: 0x8e6b042e   r6: 0xbfffdf9c   r7: 0x00000000
    r8: 0x000001a5   r9: 0x026feb90  r10: 0x00000000  r11: 0x834e142c
   r12: 0x73501634  r13: 0x00000000  r14: 0x00000033  r15: 0x04ceead0
   r16: 0x04ceeb00  r17: 0xbfffee90  r18: 0x038d7280  r19: 0x00007207
   r20: 0x00000000  r21: 0x0000001c  r22: 0x70004234  r23: 0x700042c8
   r24: 0x00000004  r25: 0x000003a4  r26: 0x70002d84  r27: 0x70002e10
   r28: 0x00000000  r29: 0xbfffef00  r30: 0x00000000  r31: 0x00000001

**********

Comment 3

[Chris Petersen]

Generally, the crash occurs when closing the window or tab. However if this
doesn't occur, simply position cursor over the existing window's title bar. This
should cause the crash.

Comment 4

[Mike Pinkerton (not reading bugmail)]

hrm, the timer isn't getting shut down correctly so we crash trying to paint the
animated gif.

Comment 5

[Warren TenBrook]

Another crash log when closing one of two tabs.  Build 20020602x.  Don't recall
the URL, but I think macsurfer.com was in background...

Date/Time:  2002-06-03 21:16:33 -0700
OS Version: 10.1.4 (Build 5Q125)

Command:    Navigator
PID:        377

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0x074f2ebd

Thread 0:
 #0   0x734fa848 in QDIsPortBuffered
 #1   0x735107ac in CopyDeepMask
 #2   0x028723c4 in CopyBitsWithMask__10nsImageMacP6BitMapn1sPB1RC4Rectn2i
 #3   0x02871c40 in DrawToImage__10nsImageMacP8nsIImagein3
 #4   0x041bdd18 in DrawTo__13gfxImageFrameP14gfxIImageFramein3
 #5   0x0330cadc in DoComposite__12imgContainerPP14gfxIImageFrameP6nsRectii
 #6   0x0330c820 in Notify__12imgContainerP8nsITimer
 #7   0x00236adc in Fire__11nsTimerImpl
 #8   0x00236c38 in handleTimerEvent__FP14TimerEventType
 #9   0x00231d90 in PL_HandleEvent
 #10  0x00231c78 in PL_ProcessPendingEvents
 #11  0x00232c40 in ProcessPendingEvents__16nsEventQueueImpl
 #12  0x0277cd98 in -[EventQueueHandler eventTimer:]
 #13  0x708d06e8 in __NSFireTimer
 #14  0x70196cd0 in __CFRunLoopDoTimer
 #15  0x7017c258 in __CFRunLoopRun
 #16  0x701b7100 in CFRunLoopRunSpecific
 #17  0x7017b8e0 in CFRunLoopRunInMode
 #18  0x7312d8f4 in RunEventLoopInModeUntilEventArrives
 #19  0x73140794 in ReceiveNextEventCommon
 #20  0x731715ec in BlockUntilNextEventMatchingListInMode
 #21  0x70bd70b8 in _DPSNextEvent
 #22  0x70bfe5d8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
 #23  0x70c23468 in -[NSApplication run]
 #24  0x70c91ed0 in NSApplicationMain
 #25  0x00002c6c in _start
 #26  0x00002a9c in start

Thread 1:
 #0   0x700252fc in select
 #1   0x00161758 in poll
 #2   0x0015de70 in _pr_poll_with_poll
 #3   0x020cb684 in Run__24nsSocketTransportService
 #4   0x00234800 in Main__8nsThreadPv
 #5   0x0015f32c in _pt_root
 #6   0x7002054c in _pthread_body

Thread 2:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x0015a418 in PR_WaitCondVar
 #3   0x020d5914 in DequeuePendingQ__12nsDNSService
 #4   0x020d531c in Run__12nsDNSService
 #5   0x00234800 in Main__8nsThreadPv
 #6   0x0015f32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 3:
 #0   0x70044cf8 in semaphore_timedwait_signal_trap
 #1   0x70044cd8 in semaphore_timedwait_signal
 #2   0x7003f2b8 in _pthread_cond_wait
 #3   0x0015a1b4 in pt_TimedWait
 #4   0x0015a42c in PR_WaitCondVar
 #5   0x00238260 in Run__11TimerThread
 #6   0x00234800 in Main__8nsThreadPv
 #7   0x0015f32c in _pt_root
 #8   0x7002054c in _pthread_body

Thread 4:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x0015a418 in PR_WaitCondVar
 #3   0x00235920 in GetRequest__12nsThreadPoolP9nsIThread
 #4   0x00236274 in Run__20nsThreadPoolRunnable
 #5   0x00234800 in Main__8nsThreadPv
 #6   0x0015f32c in _pt_root
 #7   0x7002054c in _pthread_body

Thread 5:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x7086c34c in -[NSConditionLock lockWhenCondition:]
 #3   0x70ba1358 in -[NSUIHeartBeat _heartBeatThread:]
 #4   0x70842358 in forkThreadForFunction
 #5   0x7002054c in _pthread_body

Thread 6:
 #0   0x70000978 in mach_msg_overwrite_trap
 #1   0x70005a04 in mach_msg
 #2   0x70026a2c in _pthread_become_available
 #3   0x70026724 in pthread_exit
 #4   0x70020550 in _pthread_body

Thread 7:
 #0   0x7000497c in syscall
 #1   0x70557600 in BSD_waitevent
 #2   0x70554b80 in CarbonSelectThreadFunc
 #3   0x7002054c in _pthread_body

Thread 8:
 #0   0x7003f4c8 in semaphore_wait_signal_trap
 #1   0x7003f2c8 in _pthread_cond_wait
 #2   0x705593ec in CarbonOperationThreadFunc
 #3   0x7002054c in _pthread_body


PPC Thread State:
  srr0: 0x734fa848 srr1: 0x0200f030                vrsave: 0x00000004
   xer: 0x00000004   lr: 0x735107ac  ctr: 0x702418b0   mq: 0x00000000
    r0: 0x00000000   r1: 0xbfffe6f0   r2: 0x043b09a0   r3: 0x0434b140
    r4: 0x047e1b44   r5: 0x047ced7c   r6: 0xbfffe8e8   r7: 0xbfffe8f8
    r8: 0xbfffe8f0   r9: 0x074f2e8b  r10: 0x00000000  r11: 0x834e142c
   r12: 0x702418b0  r13: 0x00000000  r14: 0x00000033  r15: 0x00059070
   r16: 0x00000001  r17: 0x80160fa8  r18: 0x0005f968  r19: 0x00001507
   r20: 0x00000000  r21: 0x0000001c  r22: 0x70004234  r23: 0x700042c8
   r24: 0x7016b0dc  r25: 0x006bac3c  r26: 0x8081ab5c  r27: 0xc0d89c00
   r28: 0x00000000  r29: 0xbfffef00  r30: 0x00000000  r31: 0x00000001

**********

Comment 6

[Mike Pinkerton (not reading bugmail)]

yup, animated gifs not shutting down.

Comment 7

[Mike Pinkerton (not reading bugmail)]

*** Bug 148926 has been marked as a duplicate of this bug. ***

Comment 8

[Patrick C. Beard]

I just checked in the fix for bug #129893 from the trunk. This fixes the 
crash.

Comment 9

[Winnie Lam]

Verified using 06-05 build.

Comment 10

[Chris Petersen]

Excellent...