160929 - NS_NewFrameManager access violation

Status: RESOLVED DUPLICATE of bug 153815

(Core :: XPCOM, defect)

Description

[Rick DeBay]

I've sent about a dozen talkbacks on this bug.  Usually it occurs in
NS_NewFrameManager, or somewhere on its stack.  Every time except for once it
happened after closing another window opened by the site (the other window's
target was _blank).  It looks like a race condition from the dumps, as the
actual error location changes, but the path the code takes is always the same.

Comment 1

[Rick DeBay]

Attachment: MS error log

DrWatson Log for the multiple errors.
NT 4 sp6 2/ security roll-up.
Mozilla 2002072204

Don't release 1.1 w/o this.  I crash continuously with 1.1b!

Comment 2

[Boris Zbarsky [:bzbarsky]]

Rick, what are those talkback ids?  None of the stacks I can see on the 
talkback server for "[e-mail]" have anything to do with 
NS_NewFrameManager.  they're all bug 153815.

As a note, there's likely only a few days left till 1.1, so fixing anything in 
1.1 is unlikely at this point....

Comment 3

[Rick DeBay]

Incident IDs: 8958878M,8958838Y,8958696E,8921720H,8921564M,8737828X.
There are others, but that's should be a good sample.

The IDs 8638326H or 8638295Z (not sure which one, they happened within a minute
of each other) happened in NS_NewFrameManager.

Comment 4

[Rick DeBay]

You're probably right, this could be a dup of 153815.  All pages at
www.mail2web.com have animated banners.
I don't see some of the common signatures in the stacks like FrameChanged(),
but I do see NS_NewTimer(), and 153815 mentions timers still firing after the
page in question is gone.

Comment 5

[Boris Zbarsky [:bzbarsky]]

All but two of those stacks end in 
nsImageListener::FrameChanged
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsImageFrame.cpp, line 2390]
imgRequestProxy::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 295]
imgRequest::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 339] 

The two others end in

0x00000021
nsImageListener::FrameChanged
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsImageFrame.cpp, line 2390]
imgRequestProxy::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 295] 

and 

0x030abd10
imgRequestProxy::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequestProxy.cpp, line 295]
imgRequest::FrameChanged
[c:/builds/seamonkey/mozilla/modules/libpr0n/src/imgRequest.cpp, line 339] 

respectively.  So yeah, looks like this is a dup.



*** This bug has been marked as a duplicate of 153815 ***

Comment 6

[Hixie (not reading bugmail)]

Moving all threading bugs to XPCOM. See bug 160356.