155681 - Trunk M1BR topcrash [@ GlobalWindowImpl::GetScrollInfo]

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Jan Carpenter]

GlobalWindowImpl::GetScrollInfo is a topcrasher for the trunk 

Rank    StackSignature                Count  
16   GlobalWindowImpl::GetScrollInfo   59 
     Source File : nsGlobalWindow.cpp line : 4931

From Smart Analysis:

[ 12 GlobalWindowImpl::GetScrollInfo f9944603 - GlobalWindowImpl::GetScrollInfo ]
[ 3  GlobalWindowImpl::GetScrollInfo ee7eef23 - GlobalWindowImpl::GetScrollInfo ]
[ 2  GlobalWindowImpl::GetScrollInfo 53db7d5c - GlobalWindowImpl::GetScrollInfo ]
 
     Crash date range: 2002-06-22 to 2002-07-02
     Min/Max Seconds since last crash: 112 - 192050
     Min/Max Runtime: 9984 - 676721
     Keyword List :  
     Count   Platform List 
     12   Windows NT 5.1 build 2600
     3   Windows NT 5.0 build 2195
     2   Windows 98 4.10 build 67766446
 
     Count   Build Id List 
     17   2002061104
 
     No of Unique Users        12
 

STACK TRACE:

	 GlobalWindowImpl::GetScrollInfo	[nsGlobalWindow.cpp  line 4931] 
	 GlobalWindowImpl::GetScrollY	[nsGlobalWindow.cpp  line 1833] 
	 GlobalWindowImpl::GetPageYOffset	[nsGlobalWindow.cpp  line 1800] 
	 XPTC_InvokeByIndex	[xptcinvoke.cpp  line 106] 
	 XPCWrappedNative::CallMethod	[xpcwrappednative.cpp  line 1996] 
	 XPC_WN_GetterSetter	[xpcwrappednativejsops.cpp  line 1299] 
	 js_Invoke	[jsinterp.c  line 790] 
	 js_InternalInvoke	[jsinterp.c  line 881] 
	 js_GetProperty	[jsobj.c  line 2525] 
	 js_Interpret	[jsinterp.c  line 2576] 
	 js_Execute	[jsinterp.c  line 970] 
	 JS_EvaluateUCScriptForPrincipals	[jsapi.c  line 3377] 
	 nsJSContext::EvaluateString	[nsJSEnvironment.cpp  line 703] 
	 GlobalWindowImpl::RunTimeout	[nsGlobalWindow.cpp  line 4497] 
	 GlobalWindowImpl::TimerCallback	[nsGlobalWindow.cpp  line 4862] 
	 nsTimerImpl::Fire	[nsTimerImpl.cpp  line 345] 
	 nsTimerManager::FireNextIdleTimer	[nsTimerImpl.cpp  line 593] 
	 nsAppShell::Run	[nsAppShell.cpp  line 134] 
	 nsAppShellService::Run	[nsAppShellService.cpp  line 451] 
	 main1	[nsAppRunner.cpp  line 1472] 
	 main	[nsAppRunner.cpp  line 1808] 
	 WinMain	[nsAppRunner.cpp  line 1826] 
	 WinMainCRTStartup()  
	 kernel32.dll + 0x1eb69 (0x77e7eb69)   

URLs\COMMENTS:
 
     (7880496)	URL: www.gamecopyworld.com
     (7880496)	Comments: hit the back button  died. 
     (7814185)	URL: www.google.com
     (7794567)	URL: http://www.fileforum.com/detail.php3?fid=1022486151
     (7794567)	Comments: I'd been away from my computer for a while now. Browser
window was open  don't know what it was on.
     (7646235)	Comments: It appeared to have to do with some javascript request
from a particular page I was visiting.I've never seen this happen before
     (7612560)	URL: gamecopyworld.com
     (7612560)	Comments: playing mp3 on winamp  wordpad open  explorer open 
selected a download on gamecopyworld.com -crash
     (7610563)	URL: http://www.fileforum.com/detail.php3?fid=1022486151
     (7610563)	Comments: I was closing out 3 open mozilla windows. I still had
one left. I hit the X to close the download manager window first and it crashed.

Comment 1

[Jay Patel [:jay]]

Adding M1BR to summary.  This is a topcrasher on both the MozillaTrunk and
Gecko1.0 Branch.  Also adding qawanted keyword to see if we can get this
reproduced.  Here are a couple of recent incidents:

MozillaTrunk:
Incident ID 8089543
Stack Signature GlobalWindowImpl::GetScrollInfo 002a2300
Email Address [e-mail]
Product ID MozillaTrunk
Build ID 2002070708
Trigger Time 2002-07-07 21:08:07
Platform Win32
Operating System Windows 98 4.10 build 67766446
Module JSDOM.DLL
URL visited closing a tab
User Comments
Trigger Reason Access violation
Source File Name c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp
Trigger Line No. 4950
Stack Trace
GlobalWindowImpl::GetScrollInfo
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 4950]
GlobalWindowImpl::GetScrollY
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1845]
GlobalWindowImpl::GetPageYOffset
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1812]
XPTC_InvokeByIndex
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 1996]
XPC_WN_GetterSetter
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1299]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 790]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 881]
js_GetProperty [c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2525]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2576]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 806]
nsXPCWrappedJSClass::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1195]
nsXPCWrappedJS::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 430]
PrepareAndDispatch
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 117]
SharedStub
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 139]
nsEventListenerManager::HandleEventSubType
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1222]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1443]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 745]
nsXULDocument::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2602]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3435]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3428]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3428]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3428]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3428]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3428]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3428]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3428]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3428]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6197]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6115]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2105]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 306]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1916]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 83]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1038]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1055]
nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5097]
ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5352]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3814]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1304]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x24407 (0xbff94407)
0x00648bf6 
----------------------------------------------------------------------------
Gecko1.0 Branch:
Incident ID 8047167
Stack Signature GlobalWindowImpl::GetScrollInfo 057e8c5f
Email Address
Product ID Gecko1.0
Build ID 2002070508
Trigger Time 2002-07-06 04:57:06
Platform Win32
Operating System Windows NT 5.0 build 2195
Module jsdom.dll
URL visited
User Comments
Trigger Reason Access violation
Source File Name d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp
Trigger Line No. 4847
Stack Trace
GlobalWindowImpl::GetScrollInfo
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 4847]
GlobalWindowImpl::GetScrollY
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 1798]
GlobalWindowImpl::GetPageYOffset
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 1765]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2028]
XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1299]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881]
js_GetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2525]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2576]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806]
nsXPCWrappedJSClass::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 1195]
nsXPCWrappedJS::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 430]
PrepareAndDispatch
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 117]
SharedStub
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp,
line 139]
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1220]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1441]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 736]
nsXULDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 2451]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3449]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3442]
nsXULElement::HandleChromeEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4690]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 732]
nsDocument::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3291]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1652]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1646]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1646]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1646]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1646]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1646]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6287]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6205]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2086]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1897]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1033]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1050]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4939]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 5194]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3765]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1295]
USER32.DLL + 0x1b60 (0x77e11b60)
USER32.DLL + 0x1cca (0x77e11cca)
USER32.DLL + 0x83f1 (0x77e183f1)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 458]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1473]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1809]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1827]
WinMainCRTStartup()
KERNEL32.DLL + 0xd326 (0x77e8d326) 

Here are some user comments to help us reproduce:
MozillaTrunk:
(8056526)	URL: www.kmsp.tv
     (8056526)	Comments: closing a tab
     (8032903)	Comments: closed a tab in the browser
     (7956767)	URL: http://zm.nu
     (7956767)	Comments: Automatic page loader
     (7939580)	Comments: started download  closed bunch of mozilla windows. 
download completed successfullly
     (7839188)	URL: http://www.tempratech.com/chill1.html

Comment 2

[greer]

Branch shows this on Linux. OS -> All

Comment 3

[timeless]

Attachment: if mDocShell is null, we'd crash

Comment 4

[timeless]

brendan, a large portion of the mDocShell users check for null before jumping
(bug 49615 even explicitly added an explanation about that) the talkback
comments would seem to indicate we're in that sort of edge case. Comments?

Comment 5

[Johnny Stenback (:jst)]

Comment on attachment 97124 [details] [diff] [review]
if mDocShell is null, we'd crash

The fact that mDocShell is nsnull is not an error, so just return NS_OK, but
please initialize all the out params before returning. 

With that, sr=jst

Comment 6

[timeless]

Attachment: if mDocShell is null return NS_OK and null the out params

Comment 7

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 97215 [details] [diff] [review]
if mDocShell is null return NS_OK and null the out params

r=biesi
noting sr=jst from above

Comment 8

[Johnny Stenback (:jst)]

Fixed.

Comment 9

[Daniel de Wildt]

*** Bug 165687 has been marked as a duplicate of this bug. ***