Closed Bug 20868 Opened 25 years ago Closed 25 years ago

Reload a few times and crash

Categories

(Core :: Networking, defect, P3)

x86
Windows NT
defect

Tracking

()

VERIFIED DUPLICATE of bug 20714

People

(Reporter: nisheeth_mozilla, Assigned: waterson)

References

()

Details

A build from 3:30 this afternoon is crashing intermittently while loading
mozilla.org with the following call stack because
nsNetModuleMgr::EnumerateModules() tries to addref an element in the
nsSupportsArray that has already been freed.  Warren, I'm assigning this to you
for initial investigation because you checked in a bunch of image loading
related changes recently and this crash is happening during the load of an
image.  Please feel free to pass the bug on to the correct person.  Thanks!

nsSupportsArray::ElementAt(nsSupportsArray * const 0x016579b0, unsigned
int 2) line 126 + 3 bytes
nsNetModuleMgr::EnumerateModules(nsNetModuleMgr * const 0x01657860, char
* 0x022bc690, nsISimpleEnumerator * * 0x0012be84) line 147 + 22 bytes
nsHTTPChannel::Open() line 676 + 61 bytes
nsHTTPChannel::AsyncRead(nsHTTPChannel * const 0x032faac0, unsigned int
0, int -1, nsISupports * 0x00000000, nsIStreamListener * 0x03276d20)
line 236 + 8 bytes
ImageNetContextImpl::GetURL(ilIURL * 0x0330a550, NET_ReloadMethod
NET_NORMAL_RELOAD, ilINetReader * 0x0326b8a0) line 560 + 33 bytes
IL_GetImage(char * 0x0330ab20, _IL_GroupContext * 0x032de3b0,
OpaqueObserverList * 0x0330ac60, _NI_IRGB * 0x00000000, unsigned int
600, unsigned int 58, unsigned int 0, void * 0x032de440) line 2068 + 35
bytes
ImageRequestImpl::Init(void * 0x032de3b0, char * 0x0330ab20,
nsIImageRequestObserver * 0x0330a9b4, unsigned int * 0x00000000,
unsigned int 600, unsigned int 58, unsigned int 0, ilINetContext *
0x032de440) line 259 + 49 bytes
ImageGroupImpl::GetImage(char * 0x0330ab20, nsIImageRequestObserver *
0x0330a9b4, unsigned int * 0x00000000, unsigned int 600, unsigned int
58, unsigned int 0) line 272 + 46 bytes
nsFrameImageLoader::Init(nsFrameImageLoader * const 0x0330a9b0,
nsIPresContext * 0x032dbba0, nsIImageGroup * 0x032de330, const nsString
& {...}, unsigned int * 0x00000000, const nsSize * 0x0341ae14, nsIFrame
* 0x0341ad98, unsigned int (nsIPresContext *, nsIFrameImageLoader *,
nsIFrame *, void *, unsigned int)* ...) line 173 + 57 bytes
nsPresContext::StartLoadImage(nsPresContext * const 0x032dbba0, const
nsString & {...}, unsigned int * 0x00000000, const nsSize * 0x0341ae14,
nsIFrame * 0x0341ad98, unsigned int (nsIPresContext *,
nsIFrameImageLoader *, nsIFrame *, void *, unsigned int)* 0x01ae9430
nsHTMLImageLoader::ImageLoadCB(nsIPresContext *, nsIFrameImageLoader *,
nsIFrame *, void *, unsigned int), ...) line 8
nsHTMLImageLoader::StartLoadImage(nsIPresContext * 0x032dbba0) line 201
+ 63 bytes
nsHTMLImageLoader::GetDesiredSize(nsIPresContext * 0x032dbba0, const
nsHTMLReflowState * 0x0012c2d4, nsHTMLReflowMetrics & {...}) line 417
nsImageFrame::GetDesiredSize(nsIPresContext * 0x032dbba0, const
nsHTMLReflowState & {...}, nsHTMLReflowMetrics & {...}) line 223 + 23
bytes
nsImageFrame::Reflow(nsImageFrame * const 0x0341ad98, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 1231432) line 260
nsLineLayout::ReflowFrame(nsIFrame * 0x0341ad98, nsIFrame * *
0x0012d05c, unsigned int & 1231432, nsHTMLReflowMetrics * 0x00000000)
line 960
nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineLayout
& {...}, nsLineBox * 0x032f49c0, nsIFrame * 0x0341ad98, unsigned char *
0x0012c3ec) line 3686 + 28 bytes
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & {...},
nsLineLayout & {...}, nsLineBox * 0x032f49c0, int * 0x0012cd60, unsigned
char * 0x0012cc00) line 3576 + 28 bytes
nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState & {...},
nsLineBox * 0x032f49c0, int * 0x0012cd60, unsigned char * 0x0012cc00)
line 3522 + 34 bytes
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & {...}, nsLineBox *
0x032f49c0, int * 0x0012cd60) line 3470 + 24 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox *
0x032f49c0, int * 0x0012cd60, int 0) line 2675 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2435 +
27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x0341ad50, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1490 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x0341ad50, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 605 + 31
bytes
nsTableCellFrame::Reflow(nsTableCellFrame * const 0x0341acf0,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 669
nsContainerFrame::ReflowChild(nsIFrame * 0x0341acf0, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 605 + 31
bytes
nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x0341aca8,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, RowReflowState
& {...}, unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line
1057 + 44 bytes
nsTableRowFrame::Reflow(nsTableRowFrame * const 0x0341aca8,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 1450 + 35 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x0341aca8, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 605 + 31
bytes
nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const
0x0341ac68, nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...},
RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame *
0x00000000, nsReflowReason eReflowReason_Initial, int 1, int 0) line 463
+ 45 bytes
nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x0341ac68,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 1045 + 38 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x0341ac68, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 605 + 31
bytes
nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x0341ac08,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0, nsTableRowGroupFrame *
0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 1406
nsTableFrame::Reflow(nsTableFrame * const 0x0341ac08, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1259 + 42 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x0341ac08, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 605 + 31
bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x0341abb8,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 914 + 40 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x0341abb8, const nsRect &
{...}, int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 259
+ 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x03309fb0, int * 0x0012e414) line 3258 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox *
0x03309fb0, int * 0x0012e414, int 1) line 2624 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2435 +
27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x0341aaf0, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1490 + 15 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x0341aaf0, const nsRect &
{...}, int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 259
+ 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x032ddfa0, int * 0x0012ecac) line 3258 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox *
0x032ddfa0, int * 0x0012ecac, int 1) line 2624 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2435 +
27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x0341aa50, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1490 + 15 bytes
nsAreaFrame::Reflow(nsAreaFrame * const 0x0341aa50, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 289 + 25 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x0341aa50, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 605 + 31
bytes
RootFrame::Reflow(RootFrame * const 0x0341a120, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 333
nsContainerFrame::ReflowChild(nsIFrame * 0x0341a120, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 1, unsigned int & 0) line 605 + 31
bytes
nsScrollPortFrame::Reflow(nsScrollPortFrame * const 0x0341a1a8,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 421
nsContainerFrame::ReflowChild(nsIFrame * 0x0341a1a8, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 3, unsigned int & 0) line 605 + 31
bytes
nsGfxScrollFrameInner::ReflowFrame(nsIPresContext * 0x032dbba0,
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0, nsIFrame * 0x0341a1a8, const nsSize & {...}, const nsSize &
{...}, int & 0, nsIFrame * & 0x00000000) line 1211
nsGfxScrollFrameInner::ReflowScrollArea(nsIPresContext * 0x032dbba0,
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0, int & 0, int & 0, int & 1, nsIFrame * & 0x00000000) line 1279
nsGfxScrollFrame::Reflow(nsGfxScrollFrame * const 0x0341a160,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 471
nsContainerFrame::ReflowChild(nsIFrame * 0x0341a160, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 605 + 31
bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0341a0e0, nsIPresContext *
0x032dbba0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 527
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0330a1c0,
nsIPresContext * 0x032dbba0, nsHTMLReflowMetrics & {...}, const nsSize &
{...}, nsIRenderingContext & {...}) line 145
PresShell::ProcessReflowCommands(PresShell * const 0x03442110) line 1702

PresShell::ExitReflowLock(PresShell * const 0x03442110, int 1, int 1)
line 762
PresShell::ContentAppended(PresShell * const 0x03442118, nsIDocument *
0x032da120, nsIContent * 0x0165b32c, int 0) line 2152
nsDocument::ContentAppended(nsDocument * const 0x032da120, nsIContent *
0x0165b32c, int 0) line 1544
nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x032da120,
nsIContent * 0x0165b32c, int 0) line 1041
HTMLContentSink::NotifyAppend(nsIContent * 0x0165b32c, int 0) line 3673
SinkContext::FlushTags() line 1771
HTMLContentSink::WillInterrupt(HTMLContentSink * const 0x032dab70) line
2223 + 11 bytes
CNavDTD::WillInterruptParse(CNavDTD * const 0x032ca570) line 3285 + 27
bytes
nsParser::ResumeParse(nsIDTD * 0x00000000, int 0) line 995
nsParser::OnDataAvailable(nsParser * const 0x03442ce4, nsIChannel *
0x032a6ba0, nsISupports * 0x00000000, nsIInputStream * 0x032d4658,
unsigned int 0, unsigned int 5635) line 1326 + 19 bytes
nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const
0x032d9d30, nsIChannel * 0x032a6ba0, nsISupports * 0x00000000,
nsIInputStream * 0x032d4658, unsigned int 0, unsigned int 5635) line
1448 + 43 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const
0x032a6370, nsIChannel * 0x032a6ba0, nsISupports * 0x00000000,
nsIInputStream * 0x032d4658, unsigned int 0, unsigned int 5635) line 212
+ 46 bytes
nsChannelListener::OnDataAvailable(nsChannelListener * const 0x032a7560,
nsIChannel * 0x032a6ba0, nsISupports * 0x00000000, nsIInputStream *
0x032d4658, unsigned int 0, unsigned int 5635) line 1597
nsHTTPResponseListener::OnDataAvailable(nsHTTPResponseListener * const
0x032d4550, nsIChannel * 0x032a9ac0, nsISupports * 0x032a6ba0,
nsIInputStream * 0x032d4658, unsigned int 0, unsigned int 5635) line 196
+ 55 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const
0x032d5420) line 370
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x032d5470) line 93 + 12
bytes
PL_HandleEvent(PLEvent * 0x032d5470) line 522 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0136f930) line 483 + 9 bytes
_md_EventReceiverProc(void * 0x031e0400, unsigned int 49375, unsigned
int 0, long 20379952) line 947 + 9 bytes
USER32! 77e71250()
Assignee: warren → valeski
Looks like one for Jud.
Assignee: valeski → dougt
Assigning to dougt. The supports array elements are xpcom/proxy objs. I suspect
something's going wrong w/ our ownership model in this instance..??
chris, could this be related to your change:

http://cvs-mirror.mozilla.org/webtools/bonsai/cvsview2.cgi?diff_mode=context&wh
itespace_mode=show&file=nsNetModuleMgr.cpp&root=/cvsroot&subdir=mozilla/netwerk
/base/src&command=DIFF_FRAMESET&rev1=1.16&rev2=1.17
It very well may be related to my change.
Target Milestone: M12
Seems like a dogfood item.
Assignee: dougt → waterson
Reassigning to waterson as he looks into it. Since proxy hasn't changed much in
the time frame when stability went to hell it's not likely to be dougt.
Severity: normal → critical
Status: NEW → RESOLVED
Closed: 25 years ago
Resolution: --- → DUPLICATE
After checking in fixes for 20714, I was able to reload www.mozilla.org to my

heart's content.

*** This bug has been marked as a duplicate of 20714 ***
Bulk move of all Necko (to be deleted component) bugs to new Networking

component.
Status: RESOLVED → VERIFIED
verified duplicate
You need to log in before you can comment on or make changes to this bug.