16652 - crash launching browser from editor using task menu

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[buster]

only occurs if you have apprunner pref set to launch editor first:
user_pref("general.startup.browser", false);
user_pref("general.startup.editor", true);

Fresh clobber pull and build

Crash every time bringing up browser from editor task menu with prefs set as
above.






void
nsPresContext::PreferenceChanged(const char* aPrefName)
{
  // Initialize our state from the user preferences
  GetUserPreferences();

  if (mShell) {
    // Have the root frame's style context remap its style based on the
    // user preferences
    nsIFrame* rootFrame;

    mShell-
>GetRootFrame(&rootFrame);        <--- mShell is garbage, not null



nsPresContext::PreferenceChanged(const char * 0x02a9b210) line 233   19 bytes
PrefChangedCallback(const char * 0x02a9b210, void * 0x029e9be0) line 55
pref_DoCallback(const char * 0x02a9b210) line 2296   17 bytes
pref_HashPref(const char * 0x02a9b210, PrefValue {...}, int 32, int 0) line 1867
  9 bytes
PREF_SetDefaultCharPref(const char * 0x02a9b210, const char * 0x034fba40) line
801   17 bytes
nsPref::SetDefaultCharPref(nsPref * const 0x01fc9070, const char * 0x02a9b210,
const char * 0x034fba40) line
692   13 bytes
XPTC_InvokeByIndex(nsISupports * 0x01fc9070, unsigned int 38, unsigned int 2,
nsXPTCVariant * 0x0012e4fc)
line 135
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x02386090,
nsXPCWrappedNative * 0x034fbce0, const
XPCNativeMemberDescriptor * 0x02682248, nsXPCWrappedNativeClass::CallMode
CALL_METHOD, unsigned int 2, long *
0x00f6cea8, long * 0x0012e6a0) line 791   43 bytes
WrappedNative_CallMethod(JSContext * 0x02386090, JSObject * 0x030af818, unsigned
int 2, long * 0x00f6cea8,
long * 0x0012e6a0) line 186   34 bytes
js_Invoke(JSContext * 0x02386090, unsigned int 2, unsigned int 0) line 672   26
bytes
js_Interpret(JSContext * 0x02386090, long * 0x0012ef18) line 2248   15 bytes
js_Invoke(JSContext * 0x02386090, unsigned int 0, unsigned int 0) line 688   13
bytes
js_Interpret(JSContext * 0x02386090, long * 0x0012f74c) line 2248   15 bytes
js_Invoke(JSContext * 0x02386090, unsigned int 1, unsigned int 2) line 688   13
bytes
js_InternalCall(JSContext * 0x02386090, JSObject * 0x02755ad0, long 41248528,
unsigned int 1, long *
0x0012f8cc, long * 0x0012f884) line 765   15 bytes
JS_CallFunction(JSContext * 0x02386090, JSObject * 0x02755ad0, JSFunction *
0x02aeb240, unsigned int 1, long
* 0x0012f8cc, long * 0x0012f884) line 2653   32 bytes
nsJSContext::CallFunction(nsJSContext * const 0x02a979a0, void * 0x02755ad0,
void * 0x02aeb240, unsigned int
1, void * 0x0012f8cc, int * 0x0012f8c8) line 231   39 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x034f19f0) line 103   48 bytes
nsEventListenerManager::HandleEvent(nsIPresContext
& {...}, nsEvent * 0x0012fc24, nsIDOMEvent * * 0x0012facc,
unsigned int 7, nsEventStatus
& nsEventStatus_eIgnore) line 1025   21 bytes
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x02a975f4,
nsIPresContext
& {...}, nsEvent *
0x0012fc24, nsIDOMEvent * * 0x0012facc, unsigned int 1, nsEventStatus
& nsEventStatus_eIgnore) line 2895
nsWebShell::OnEndDocumentLoad(nsWebShell * const 0x02a9fc64, nsIDocumentLoader *
0x02a9e830, nsIChannel *
0x02e96a80, unsigned int 0, nsIDocumentLoaderObserver * 0x02a9fc64) line 3322
34 bytes
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x02a9e830, nsIChannel
* 0x02e96a80, unsigned int 0)
line 847
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x02a9e834, nsIChannel *
0x00000000, nsISupports *
0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 728
nsLoadGroup::SubGroupIsEmpty(unsigned int 0) line 119   43 bytes
nsLoadGroup::RemoveChannel(nsLoadGroup * const 0x02f1a260, nsIChannel *
0x034f1780, nsISupports * 0x00000000,
unsigned int 0, const unsigned short * 0x00000000) line 604
nsFileChannel::OnStopRequest(nsFileChannel * const 0x034f1784, nsIChannel *
0x034f2f80, nsISupports *
0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 423
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x034f3040) line
293
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x034f32e0) line 164   12 bytes

Comment 1

[troy]

Checked in patch from Johnny Stenback.

Comment 2

[troy]

The patch I was referring to was a change to the pres shell's destructor to
break the pres context's weak link back to the pres shell

Comment 3

[Chris Petersen]

Fixed in the Oct 21 build 1999102110.