175285 - nsWidget::~nsWidget() crashes when view changes

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Gregor Rosenauer]

There seems to be a bug in nsWidget that causes Mozilla to crash when the Widget
is no longer displayed (e.g. the tab is changed or closed, or a new page is
rendered while a widget is still active (e.g. expanded popup) ).

Happening on build 2002100911, BeOS 5.0.4 x86 with BONE.
Steps to reproduce:

1. Enter the "query for bug"-form in Mozilla
2. enter a search-term anywhere
3. press "Search" and
4. quickly expand a popup (e.g. "Platform") while the next page is still loading
5. ka-WOOO-m

loading symbols
segment violation occurred
807a0560:   *      807874d8    fdiv    -0x00000080(%eax,%edi,2)
mozilla-bin:sc
   frame         retaddr
fcffc208   ed2a319b  nsBaseWidget::~nsBaseWidget(void) + 0000008b
fcffc220   ed2a2e8b  nsBaseWidget::Release(void) + 00000043
fcffc234   ed298508  nsAppShell::Run(void) + 000000e8
fcffc258   ed25f1c8  nsAppShellService::Run(void) + 00000024
fcffc268   80011116  main1(int, char **, nsISupports *) + 00000946
fcffc388   8001167d  main + 00000111
fcffc3b4   8000c125  _start + 00000061
mozilla-bin:ps
 PID  DEBUG NAME                              STATUS
 49d  curr  mozilla-bin                       semaphore
 49f        BApplication                      semaphore
 4a4        moz-thread                        semaphore
 4a5        moz-thread                        semaphore
 4a8        moz-thread                        semaphore
 4ba        w>Bugzilla is pondering your qu   semaphore
 4df        w>                                semaphore
 4f3        moz-thread                        semaphore
 516        team 196 debugtask                semaphore
mozilla-bin:regs
 eax 807a0560   ebp fcffc208   cs 001b
 edx 8088b308   esi 808f647c   ss 0023
 ecx 80886e60   edi fcffc250   ds 0023
 ebx ec97ba44   esp fcffc1f8   es 0023
                               fs 25a3
 eflags 00010282  eip 807a0560
 trap_no 0000000e  error_code 00000004
mozilla-bin:

Comment 1

[Paul]

Reporter:  Does this still happen for you, since the "thread-safetyness" patch
has been applied?

Comment 2

[Sergei Dolgov]

seems alike http://bugzilla.mozilla.org/show_bug.cgi?id=170209
and http://bugzilla.mozilla.org/show_bug.cgi?id=72488.

Comment 3

[Sergei Dolgov]

*** Bug 191208 has been marked as a duplicate of this bug. ***

Comment 4

[Sergei Dolgov]

Reason - wrong placement of DealWithPopups. Should be called for better stabilty
on CLOSEWINDOW in CallMethod() instead thread-unsafe current placement in
nsWindow::Destroy() 

Comment 5

[Sergei Dolgov]

Attachment: Patch. Moving rollup handling in proper place

See previous comment

Comment 6

[Sergei Dolgov]

*** Bug 72488 has been marked as a duplicate of this bug. ***

Comment 7

[Paul]

Comment on attachment 114320 [details] [diff] [review]
Patch. Moving rollup handling in proper place

I cannon reproduce the described problem with this patch applied.  I will check
it in.

Comment 8

[Paul]

This has been checked in