183382 - random listbox crash [@ nsCSSFrameConstructor::ContentInserted]

Status: RESOLVED INCOMPLETE

(Core :: XUL, defect)

Description

[timeless]

cvs build from 2weeks ago, i was playing around with variations of the above
data url. after it loaded i realized what was wrong with it and changed
|type"checkbox"| to |type="checkbox"|, then i loaded the new url.

nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x10936e68,
nsIPresContext * 
0x0d6b5700, nsIContent * 0x107db000, nsIContent * 0x1080d890, int 0,
nsILayoutHistoryState * 0x00000000, 
int 0) line 8975 + 30 bytes
StyleSetImpl::ContentInserted(StyleSetImpl * const 0x1067e9c0, nsIPresContext *
0x0d6b5700, nsIContent * 
0x107db000, nsIContent * 0x1080d890, int 0) line 1530
PresShell::ContentInserted(PresShell * const 0x0cb1ccb0, nsIDocument *
0x0dd2c848, nsIContent * 
0x107db000, nsIContent * 0x1080d890, int 0) line 5291 + 53 bytes
nsXBLBindingRequest::DocumentLoaded(nsIDocument * 0x10a51dd0) line 181
nsXBLStreamListener::Load(nsXBLStreamListener * const 0x0dc960a4, nsIDOMEvent *
0x0c8592a0) line 442
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x0c801ab8,
nsIPresContext * 
0x00000000, nsEvent * 0x0012f850, nsIDOMEvent * * 0x0012f800, nsIDOMEventTarget
* 0x10a51e04, unsigned int 
7, nsEventStatus * 0x0012f878) line 1860 + 41 bytes
nsDocument::HandleDOMEvent(nsDocument * const 0x10a51dd0, nsIPresContext *
0x00000000, nsEvent * 
0x0012f850, nsIDOMEvent * * 0x0012f800, unsigned int 7, nsEventStatus *
0x0012f878) line 3513
nsXMLDocument::EndLoad(nsXMLDocument * const 0x10a51dd0) line 559
nsXMLContentSink::DidBuildModel(nsXMLContentSink * const 0x0caf0798, int 0) line 434
nsExpatDriver::DidBuildModel(nsExpatDriver * const 0x0dd0e180, unsigned int 0,
int 1, nsIParser * 
0x10d77908, nsIContentSink * 0x0caf0798) line 972 + 23 bytes
nsParser::DidBuildModel(unsigned int 0) line 1262 + 41 bytes
nsParser::ResumeParse(int 1, int 1, int 1) line 1799
nsParser::OnStopRequest(nsParser * const 0x10d7790c, nsIRequest * 0x0caf06c0,
nsISupports * 0x00000000, 
unsigned int 0) line 2432 + 21 bytes
nsXBLStreamListener::OnStopRequest(nsXBLStreamListener * const 0x0dc960a0,
nsIRequest * 0x0caf06c0, 
nsISupports * 0x00000000, unsigned int 0) line 326 + 38 bytes
nsJARChannel::OnStopRequest(nsJARChannel * const 0x0caf06c4, nsIRequest *
0x0d7f401c, nsISupports * 
0x00000000, unsigned int 0) line 606 + 49 bytes
nsOnStopRequestEvent::HandleEvent() line 213
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x0cd3820c) line 116
PL_HandleEvent(PLEvent * 0x0cd3820c) line 644 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00fc9ce8) line 574 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x005a02a0, unsigned int 49306, unsigned int 0,
long 16555240) line 1335 + 
9 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e13f0f()
nsAppShellService::Run(nsAppShellService * const 0x0105a950) line 472
main1(int 4, char * * 0x002844c0, nsISupports * 0x00276f08) line 1541 + 32 bytes
main(int 4, char * * 0x002844c0) line 1902 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87903()

        nsCOMPtr<nsIListBoxObject> listBoxObject(do_QueryInterface(boxObject));
        nsIListBoxObject* bodyBoxObject = nsnull;
        listBoxObject->GetListboxBody(&bodyBoxObject); //<-- crash here

###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().:
'mRawPtr != 0', file ../../../../dist/include/xpcom\nsCOMPtr.h, line 650
Break: at file ../../../../dist/include/xpcom\nsCOMPtr.h, line 650

-	boxObject	{...}
\-	mRawPtr	0x10edd838
 |-	[nsBoxObject]	{...}
 ||+	nsPIBoxObject	{...}
 ||+	mRefCnt	{...}
 ||+	_mOwningThread	{...}
 ||+	mLayoutManager	{...}
 ||+	mPaintManager	{...}
 ||+	mPresState	{...}
 ||+	mContent	0x107db000
 |\+	mPresShell	0x0cb1cca8
 \+	nsISupports	{...}
+	bodyBoxObject	0x00000000
+	listBoxBody	0x00000024
-	listBoxObject	{...}
\+	mRawPtr	0x00000000

we know what's crashing, but it doesn't want to reproduce itself.
for some reason my poor gecko ended up with an nsBoxObject (nsIBoxObject) which
is not a nsListBoxObject and therefore doesn't implement nsIListBoxObject, so
the QI failed.

The problem is that this doesn't make sense. i'm proposing wallpapering over
this with an assertion.  I'm going to leave the stack alive in my debugger for
about a day so if anyone has questions about the crashed mozilla they can ask
them today

Comment 1

[Olivier Cahagne]

see bug 185558 which has a testcase and similar stack trace.

Comment 2

[Chase Tingley]

stack is very similar to bug 147244

Comment 3

[Chase Tingley]

Also, this doesn't crash for me on a trunk from about two days ago, or in fb
0.7.  The rendering is pretty screwed up, though.

Comment 4

[Sheila Mooney]

BZ, I don't find exactly the same signature anymore but I found something similar -https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsCSSFrameConstructor%3A%3AContentInserted&reason_type=contains&date=06%2F07%2F2012%2017%3A33%3A45&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsCSSFrameConstructor%3A%3AContentInserted%28nsIContent*%2C%20nsIContent*%2C%20nsILayoutHistoryState*%2C%20bool%29. 

Is this the same thing? Just trying to figure out if this is still a valid crash.

Comment 5

[Boris Zbarsky [:bzbarsky]]

I can't tell; this bug doesn't really have enough information to go on...

Comment 6

[Robert Kaiser]

(In reply to Boris Zbarsky (:bz) (On vacation until July 5) from comment #5)
> I can't tell; this bug doesn't really have enough information to go on...

Based on that comment, I'm resolving this as incomplete. If someone can provide current info and can still crash with this, please provide that info and reopen.