Closed Bug 160058 Opened 20 years ago Closed 13 years ago

crash when URL is loaded using target="_content" to browser window [@ nsWebShell::Destroy()]

Categories

(Core :: DOM: Navigation, defect)

x86
All
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Future

People

(Reporter: pbartecki, Assigned: adamlock)

References

()

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; PL; rv:1.1b) Gecko/20020722
BuildID:    20020722

xHermes always crashes Mozilla when floating window is used

Reproducible: Always
Steps to Reproduce:
1. Download and install xHermes xpi (http://hermes.mozdev.org/beta.html) .
2. Open xHermes floating window (Tools > xHermes)
3. Use it. The simplest way to crash Mozilla is to open File menu and start
opening links under that menu. There's no need to wait until the link is loaded
you can open them one by one. Before you'll do that 7 times Mozilla will crash.
 The same happens when any service is used (log in and log off to say Netscape
and it will also crash after 5-7th use, crash after 6 or 7th SMS is sent etc.) 

 

Actual Results:  xHermes crashes Mozilla

Expected Results:  Nice and polite animal this xHermes should be...

It does not crash when Sidebar version is used (File > Add xHermes to Sidebar).
It is not system specific, and the crash is present in all tested by me Mozilla
versions since Feb. 2002 (nighties and milestones).

There are no JS errors on JS Console.

xHermes is just XUL and JS I do not use any Mozilla components.

Some more info and TalkBack IDs with stack traces are on mozdev:
http://mozdev.org/bugs/show_bug.cgi?id=1699

I just can't find what couses this crash.. so I beg for help.
 Thanks in advance ;)
pete.
Old TalkBack ID's (stacks are in comments to this bug on mozdev)

TB7755363M
TB7755309X
TB7755219Y
TB8203333K

Few new ones using Mozilla 1.1Beta (Linux) and xHermes03-pre2.
TB8816635E
TB8816563M
TB8816501M
TB8816439X

from the mozdev bug:

bz> The first two ID's are:

0x083ea0c3
nsWebShell::Destroy()
nsWebShell::~nsWebShell()
nsDocShell::Release()
nsWebShell::Release()
XPCJSRuntime::GCCallback()
DOMGCCallback()
js_GC()
js_ForceGC()
JS_GC()
nsJSContext::Notify()
nsTimerImpl::Fire()
handleTimerEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke() 
Summary: xHermes crashes Mozilla every 6th use of any xHermes service → xHermes crashes Mozilla every 6th use of any xHermes service [nsWebShell::Destroy()]
over to XPCOM as other nsWebShell stuff seems to be with XPCOM. feel free to
toss around until this gets the right component
Assignee: attinasi → dougt
Component: Layout → XPCOM
QA Contact: petersen → scc
confirming and upping severity as it is a crash
Severity: normal → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash
webshell.
Assignee: dougt → adamlock
Component: XPCOM → Embedding: Docshell
QA Contact: scc → adamlock
Adam: Can I do anything else to help debugging this problem? Or could you point
me  the direction where shall I go to try to solve it on my own? 
  Any kind of advice is highly appreciated ;)  - thanks a lot, pete.
testcase.xpi registers new package xtest which in turn have to be loaded with:
mozilla -chrome chrome://xtest/content 
 Xtest window features cool XUL window with just one button which loads an URI
to main Mozilla window. Press this button consequently few times (6 to 10) and
Mozilla will crash.
xtest.xul has to be loaded as a separate window.

xultest.xul is just: 

<?xml version="1.0"?>
<window id="hermes-window"
  xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" >

<vbox flex="1">
<label>This button loads an URL to the main Mozilla Window. Click it few times
and Mozilla will crash (after 6 to 10 times).</label>
<button label="URL 1" oncommand="window.open('http://mozilla.org','_content');"

</vbox>
</window>
Keywords: testcase
This test case loads a xul window with <iframe> which has a HTML 4.01 valid
file as src. xtest.html was reduced to have just this code:

<form method="post" id="netscape" name="proform" target="_content"
action="http://ureg.netscape.com/iiop/UReg2/login/loginform">
<input type="submit" name="SUBMITNetscape" value="Sign in" />
<input type="hidden" name="U2_ENDURL" value="http://mailredirect.netscape.com/"

</form>

 - one button which loads URL in browser window via target="_content".
Mozilla will crash after you load this URL few times (hit button around 10
times).
Changed summary from: xHermes crashes Mozilla every 6th use of any xHermes
service, to: crash when URL is loaded using target="_content" to browser window.
Summary: xHermes crashes Mozilla every 6th use of any xHermes service [nsWebShell::Destroy()] → crash when URL is loaded using target="_content" to browser window [nsWebShell::Destroy()]
Is this reproducible in the latest versions of Mozilla?
Oh,.. sure it is. Here are some TalkBackIDs:

From 2002101612/Linux:
TB12781824K
TB12781803X
TB12781781Q
TB12781766W
TB12781739K

 20021018/Linux:
TB12781929E
TB12781916X
TB12781898X

I have used the first Test case, as No 2(with <form> element) didn't work and I
didn't want to check why at 9am..
 Test case sould be run as expained in comment #7 - and it _has_ to be loaded as
separate window (also installed as root).
0xaa7bca93
0x0277ce3d
nsWebShell::Destroy [c:/builds/seamonkey/mozilla/docshell/base/nsWebShell.cpp,
line 1248]
nsFrameLoader::Destroy
[c:/builds/seamonkey/mozilla/content/base/src/nsFrameLoader.cpp, line 267]
nsHTMLFrameInnerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/document/src/nsFrameFrame.cpp, line 776]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1104]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1104]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1104]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1104]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1104]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1104]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1104]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
nsBoxFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1104]
nsFrameList::DestroyFrames
[c:/builds/seamonkey/mozilla/layout/base/src/nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 143]
ViewportFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 68]
FrameManager::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 517]
PresShell::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 1839]
DocumentViewerImpl::Destroy
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 1135]
nsDocShell::Destroy [c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp,
line 3013]
nsWebShell::Destroy [c:/builds/seamonkey/mozilla/docshell/base/nsWebShell.cpp,
line 1248]
nsXULWindow::Destroy
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsXULWindow.cpp, line 410]
nsWebShellWindow::Destroy
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp, line 1660]
nsWebShellWindow::Close
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp, line 373]
nsWebShellWindow::HandleEvent
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp, line 472]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1163]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1180]
nsWindow::DispatchStandardEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1201]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3879]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1447]
USER32.dll + 0x2a244 (0x77e3a244)
USER32.dll + 0x4730 (0x77e14730)
USER32.dll + 0x558a (0x77e1558a)
ntdll.dll + 0x11a7f (0x77f91a7f)
USER32.dll + 0xdd30 (0x77e1dd30)
USER32.dll + 0x2a244 (0x77e3a244)
USER32.dll + 0x6b21 (0x77e16b21)
USER32.dll + 0x14f4a (0x77e24f4a)
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1468]
USER32.dll + 0x2a244 (0x77e3a244)
USER32.dll + 0x4730 (0x77e14730)
USER32.dll + 0x558a (0x77e1558a)
ntdll.dll + 0x11a7f (0x77f91a7f)
USER32.dll + 0xdd30 (0x77e1dd30)
USER32.dll + 0x2a244 (0x77e3a244)
USER32.dll + 0x6b21 (0x77e16b21) 

Registers:
EAX:	00230190 	EBX:	00000000 	ECX:	01d2e910 	EDX:	00230608
ESI:	02ddd014 	EDI:	02ddd128 	ESP:	0012f1c0 	EBP:	0012f1e8
EIP:	aa7bca93 	cf pf af zf sf of IF df nt RF vm   IOPL: 0
CS:	001b	DS:	0023	SS:	0023	ES:	0023	FS:	0038	GS:	0000
Summary: crash when URL is loaded using target="_content" to browser window [nsWebShell::Destroy()] → crash when URL is loaded using target="_content" to browser window [@ nsWebShell::Destroy()]
technutz, that new stack might be a different bug.

kerz just updated, and he's seeing a similar crash.
see bug #202484 for the bug on the recent crash.
Target Milestone: --- → Future
Both testcases WFM using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070101 Minefield/3.0a2pre ID:2007010104 [cairo]
WFM based on comment 15. Reporter address invalid. and nsWebShell::Destroy doesn't exist on crash-stats for last 3 days for any version of FF.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ nsWebShell::Destroy()]
You need to log in before you can comment on or make changes to this bug.