Closed Bug 16843 Opened 25 years ago Closed 25 years ago

[DOGFOOD] Regression. Apprunner crashes when dismissing dialogs.

Categories

(Core :: Layout: Images, Video, and HTML Frames, defect, P1)

Product:
Core
Component:
Layout: Images, Video, and HTML Frames
Platform:
x86
Linux
Type:
defect

Tracking

()

Status:
VERIFIED WORKSFORME

People

(Reporter: slogan, Assigned: danm.moz)

Details

Steps:

The problem is seen in different areas. Here is one scenario.

Launch apprunner.
Tasks->Messenger.

I haven't yet registered my e-mail, so I get the mail profile wizard dialog.
Hit the cancel button in this dialog, or the window close control.

You will crash.

Stack:

#0  0x4019ab87 in PL_HashTableRawLookup (ht=0x8a35f60, keyHash=145037320,
    key=0x8a51808) at plhash.c:180
#1  0x40dedc26 in UndisplayedMap::GetEntryFor (this=0x8a35060,
    aParentContent=0x8a51808) at nsFrameManager.cpp:1690
#2  0x40dedf95 in UndisplayedMap::RemoveNodesFor (this=0x8a35060,
    aParentContent=0x8a51808) at nsFrameManager.cpp:1785
#3  0x40deacb3 in FrameManager::ClearAllUndisplayedContentIn (this=0x8976e18,
    aParentContent=0x8a51808) at nsFrameManager.cpp:573
#4  0x40f24c3b in DeletingFrameSubtree (aPresContext=0x895eda8,
    aPresShell=0x8976bc0, aFrameManager=0x8976e18, aRemovedFrame=0x8a51cc0,
    aFrame=0x8a51cc0) at nsCSSFrameConstructor.cpp:6735
#5  0x40f24f7c in nsCSSFrameConstructor::RemoveMappingsForFrameSubtree (
    this=0x8976b78, aPresContext=0x895eda8, aRemovedFrame=0x8a51cc0)
    at nsCSSFrameConstructor.cpp:6812
#6  0x40fb119b in nsTreeRowGroupFrame::Destroy (this=0x8a37240,
    aPresContext=@0x895eda8) at nsTreeRowGroupFrame.cpp:85
#7  0x40fe2c13 in nsFrameList::DestroyFrames (this=0x8a36478,
    aPresContext=@0x895eda8) at nsFrameList.cpp:28
#8  0x40de00ed in nsContainerFrame::Destroy (this=0x8a36440,
    aPresContext=@0x895eda8) at nsContainerFrame.cpp:85
#9  0x40f758aa in nsTableFrame::Destroy (this=0x8a36440,
    aPresContext=@0x895eda8) at nsTableFrame.cpp:401
#10 0x40fb08d9 in nsTreeFrame::Destroy (this=0x8a36440,
    aPresContext=@0x895eda8) at nsTreeFrame.cpp:299
#11 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x8a36418,
    aPresContext=@0x895eda8) at nsFrameList.cpp:28
#12 0x40de00ed in nsContainerFrame::Destroy (this=0x8a363e0,
    aPresContext=@0x895eda8) at nsContainerFrame.cpp:85
#13 0x40e0367b in nsLineBox::DeleteLineList (aPresContext=@0x895eda8,
    aLine=0x8a37318) at nsLineBox.cpp:188
#14 0x40dd31f3 in nsBlockFrame::Destroy (this=0x8a35b30,
    aPresContext=@0x895eda8) at nsBlockFrame.cpp:1058
#15 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x8a33538,
    aPresContext=@0x895eda8) at nsFrameList.cpp:28
#16 0x40de00ed in nsContainerFrame::Destroy (this=0x8a33500,
    aPresContext=@0x895eda8) at nsContainerFrame.cpp:85
#17 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x8a32320,
    aPresContext=@0x895eda8) at nsFrameList.cpp:28
#18 0x40de00ed in nsContainerFrame::Destroy (this=0x8a322e8,
    aPresContext=@0x895eda8) at nsContainerFrame.cpp:85
#19 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x8a322d8,
    aPresContext=@0x895eda8) at nsFrameList.cpp:28
#20 0x40de00ed in nsContainerFrame::Destroy (this=0x8a322a0,
    aPresContext=@0x895eda8) at nsContainerFrame.cpp:85
#21 0x40e24466 in ViewportFrame::Destroy (this=0x8a322a0,
    aPresContext=@0x895eda8) at nsViewportFrame.cpp:133
#22 0x40dea451 in FrameManager::~FrameManager (this=0x8976e18, __in_chrg=3)
    at nsFrameManager.cpp:333
#23 0x40dea382 in FrameManager::Release (this=0x8976e18)
    at nsFrameManager.cpp:315
#24 0x40e0f875 in PresShell::~PresShell (this=0x8976bc0, __in_chrg=3)
    at nsPresShell.cpp:544
#25 0x40e0f535 in PresShell::Release (this=0x8976bc0) at nsPresShell.cpp:475
#26 0x41019bb4 in nsCOMPtr<nsIPresShell>::~nsCOMPtr (this=0x893b6e0,
    __in_chrg=2) at ../../../dist/include/nsCOMPtr.h:457
#27 0x40fdcab1 in DocumentViewerImpl::~DocumentViewerImpl (this=0x893b6b8,
    __in_chrg=3) at nsDocumentViewer.cpp:273
#28 0x40fdc7c0 in DocumentViewerImpl::Release (this=0x893b6b8)
    at nsDocumentViewer.cpp:217
#29 0x40952996 in ?? () from /opt/raptor/ns/dist/bin/libraptorwebwidget.so
#30 0x40ecae64 in nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame (
    this=0x893ce68, __in_chrg=3) at nsFrameFrame.cpp:436
#31 0x40de3909 in nsFrame::Destroy (this=0x893ce68, aPresContext=@0x864d9c8)
    at nsFrame.cpp:353
#32 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x8909fe8,
    aPresContext=@0x864d9c8) at nsFrameList.cpp:28
#33 0x40de00ed in nsContainerFrame::Destroy (this=0x8909fb0,
    aPresContext=@0x864d9c8) at nsContainerFrame.cpp:85
#34 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x88fae78,
    aPresContext=@0x864d9c8) at nsFrameList.cpp:28
#35 0x40de00ed in nsContainerFrame::Destroy (this=0x88fae40,
    aPresContext=@0x864d9c8) at nsContainerFrame.cpp:85
#36 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x88fc978,
    aPresContext=@0x864d9c8) at nsFrameList.cpp:28
#37 0x40de00ed in nsContainerFrame::Destroy (this=0x88fc940,
    aPresContext=@0x864d9c8) at nsContainerFrame.cpp:85
#38 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x88f14c0,
    aPresContext=@0x864d9c8) at nsFrameList.cpp:28
#39 0x40de00ed in nsContainerFrame::Destroy (this=0x88f1488,
    aPresContext=@0x864d9c8) at nsContainerFrame.cpp:85
#40 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x88ef588,
    aPresContext=@0x864d9c8) at nsFrameList.cpp:28
#41 0x40de00ed in nsContainerFrame::Destroy (this=0x88ef550,
    aPresContext=@0x864d9c8) at nsContainerFrame.cpp:85
#42 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x88ce168,
    aPresContext=@0x864d9c8) at nsFrameList.cpp:28
#43 0x40de00ed in nsContainerFrame::Destroy (this=0x88ce130,
    aPresContext=@0x864d9c8) at nsContainerFrame.cpp:85
#44 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x88ccf40,
    aPresContext=@0x864d9c8) at nsFrameList.cpp:28
#45 0x40de00ed in nsContainerFrame::Destroy (this=0x88ccf08,
    aPresContext=@0x864d9c8) at nsContainerFrame.cpp:85
#46 0x40fe2c13 in nsFrameList::DestroyFrames (this=0x88ccef8,
    aPresContext=@0x864d9c8) at nsFrameList.cpp:28
#47 0x40de00ed in nsContainerFrame::Destroy (this=0x88ccec0,
    aPresContext=@0x864d9c8) at nsContainerFrame.cpp:85
#48 0x40e24466 in ViewportFrame::Destroy (this=0x88ccec0,
    aPresContext=@0x864d9c8) at nsViewportFrame.cpp:133
#49 0x40dea451 in FrameManager::~FrameManager (this=0x8362bc8, __in_chrg=3)
    at nsFrameManager.cpp:333
#50 0x40dea382 in FrameManager::Release (this=0x8362bc8)
    at nsFrameManager.cpp:315
#51 0x40e0f875 in PresShell::~PresShell (this=0x86c04b8, __in_chrg=3)
    at nsPresShell.cpp:544
#52 0x40e0f535 in PresShell::Release (this=0x86c04b8) at nsPresShell.cpp:475
#53 0x41019bb4 in nsCOMPtr<nsIPresShell>::~nsCOMPtr (this=0x87510b0,
    __in_chrg=2) at ../../../dist/include/nsCOMPtr.h:457
#54 0x40fdcab1 in DocumentViewerImpl::~DocumentViewerImpl (this=0x8751088,
    __in_chrg=3) at nsDocumentViewer.cpp:273
#55 0x40fdc7c0 in DocumentViewerImpl::Release (this=0x8751088)
    at nsDocumentViewer.cpp:217
#56 0x40952996 in ?? () from /opt/raptor/ns/dist/bin/libraptorwebwidget.so
#57 0x403a0016 in ?? () from /opt/raptor/ns/dist/bin/libnsappshell.so
#58 0x403a0222 in ?? () from /opt/raptor/ns/dist/bin/libnsappshell.so
#59 0x40540330 in ?? () from /opt/raptor/ns/dist/bin/libwidget_gtk.so
#60 0x405400bc in ?? () from /opt/raptor/ns/dist/bin/libwidget_gtk.so
#61 0x40540124 in ?? () from /opt/raptor/ns/dist/bin/libwidget_gtk.so
#62 0x4053e662 in ?? () from /opt/raptor/ns/dist/bin/libwidget_gtk.so
#63 0x40543980 in ?? () from /opt/raptor/ns/dist/bin/libwidget_gtk.so
#64 0x40543a6a in ?? () from /opt/raptor/ns/dist/bin/libwidget_gtk.so
#65 0x4065379d in ?? () from /usr/lib/libgtk-1.2.so.0
#66 0x4061b037 in ?? () from /usr/lib/libgtk-1.2.so.0
#67 0x4061a52f in ?? () from /usr/lib/libgtk-1.2.so.0
#68 0x40618800 in ?? () from /usr/lib/libgtk-1.2.so.0
#69 0x4064b5b8 in ?? () from /usr/lib/libgtk-1.2.so.0
#70 0x405ef320 in ?? () from /usr/lib/libgtk-1.2.so.0
#71 0x40692ab2 in ?? () from /usr/lib/libgdk-1.2.so.0
#72 0x406bc2c6 in ?? () from /usr/lib/libglib-1.2.so.0
#73 0x406bc801 in ?? () from /usr/lib/libglib-1.2.so.0
#74 0x406bc979 in ?? () from /usr/lib/libglib-1.2.so.0
#75 0x405eef3a in ?? () from /usr/lib/libgtk-1.2.so.0
#76 0x4052a239 in ?? () from /opt/raptor/ns/dist/bin/libwidget_gtk.so
#77 0x4039e0c1 in ?? () from /opt/raptor/ns/dist/bin/libnsappshell.so
#78 0x804b7d7 in main1 (argc=1, argv=0xbffffae4) at nsAppRunner.cpp:612
#79 0x804ba59 in main (argc=1, argv=0xbffffae4) at nsAppRunner.cpp:722
#80 0x4029acb3 in ?? () from /lib/libc.so.6
Assignee: karnaze → trudelle
Peter, I see a tree in the stack and would normally reassign to Hyatt.
Assignee: trudelle → danm
Priority: P3 → P1
Target Milestone: M11
reassigning to danm as p1 for m11
This will happen when you close _any_ window, including the simplest prompt
dialogs.
OK, I'll log the question I've already asked Syd in email, but haven't heard back from him yet.
Do you guys have Troy's fix for bug 16781 ?  I have that in my tree, and I can't reproduce
Syd's crash.  I'd like to think I'd have noticed if I were having Waterson's problem.
yes, cls has it in his tree, and it still crashes.
Adding myself to the cc list. My windows build came up running like a charm. I
don't see this problem. My linux build is still 20 minutes or so from finishing.
could be related: 16832
danm: recent changes to nsEventQueue.cpp just seem wrong; e.g., at line 294,
you NS_RELEASE(mElderQueue) after summarily nulling it at line 287! (This is
one of the crashers I'm hitting.) I changed NS_RELEASE(mElderQueue) to
NS_RELEASE(old), and end up crashing somewhere else -- looks like the
WebShell's event queue is being double-freed.

Is it worth trying to back out these changes?
Status: NEW → RESOLVED
Closed: 25 years ago
Resolution: --- → WORKSFORME
Doug thanks for pointing this out. With a linux build from this evening, the
only crash I see left (and this is just on Linux) has to do with dismissing
dialogs and the stack trace is identitcal to that of 16832.

I'm going to mark this as works for me and change the tree blocker to be 16832.
I'll take a look at that now and decide we should open the tree or not.

Folks, feel free to object if you feel I'm marking this as worksforme now when
that really isn't the case.
The real bug was actual 16832. See it for more details.
Status: RESOLVED → VERIFIED
In the Oct 21 build (1999102108),I can't get the crash to occur.
Product: Core → Core Graveyard
Component: Layout: HTML Frames → Layout: Images
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.