Closed Bug 209598 Opened 17 years ago Closed 11 years ago

Crash opening link from other applications [@ nsXULDocument::InsertElement]

Categories

(Core :: XUL, defect, P3, critical)

Product:
Core
Component:
XUL
Version:
1.8 Branch
Platform:
x86
Windows XP
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.9.2a1

People

(Reporter: jay, Assigned: timeless)

References

(
URL
)

Details

(Keywords: crash, topcrash-, Whiteboard: not reproducible yet)

Crash Data

Attachments

(1 file, 2 obsolete files)

To push
994 bytes, patch
bzbarsky
: superreview+
Details | Diff | Splinter Review 
A lot of FireBird users are crashing trying to open urls and files from other
applications like Eudora and Trillian...as well as from local disk.  Most of the
crashes are with WinXP and Win2K, but it is happening on all flavors of Windows.
 Here is the latest from Talkback:

Rank    StackSignature    Count  

10   nsXULDocument::InsertElement   67 

 
 	Source File :
d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
line : 4260
 
====================================================================================================
     Count   Offset    Real Signature
[ 14   nsXULDocument::InsertElement b71150f4 - nsXULDocument::InsertElement ]
[ 12   nsXULDocument::InsertElement 0f73ab24 - nsXULDocument::InsertElement ]
[ 7   nsXULDocument::InsertElement 894109f1 - nsXULDocument::InsertElement ]
[ 6   nsXULDocument::InsertElement 32ce15ef - nsXULDocument::InsertElement ]
[ 6   nsXULDocument::InsertElement 0cf5d445 - nsXULDocument::InsertElement ]
[ 4   nsXULDocument::InsertElement b0f71961 - nsXULDocument::InsertElement ]
[ 4   nsXULDocument::InsertElement 33475db1 - nsXULDocument::InsertElement ]
[ 3   nsXULDocument::InsertElement f0053a7b - nsXULDocument::InsertElement ]
[ 2   nsXULDocument::InsertElement fd71240f - nsXULDocument::InsertElement ]
[ 1   nsXULDocument::InsertElement dceccb0b - nsXULDocument::InsertElement ]
[ 1   nsXULDocument::InsertElement 4be1beca - nsXULDocument::InsertElement ]
[ 1   nsXULDocument::InsertElement 330a3bc3 - nsXULDocument::InsertElement ]
 
     Crash date range: 2003-06-06 to 2003-06-16
     Min/Max Seconds since last crash: 2 - 1184258
     Min/Max Runtime: 4018 - 2609195
 
     Count   Platform List 
     30   Windows NT 5.0 build 2195
     24   Windows NT 5.1 build 2600
     6   Windows 98 4.10 build 67766446
     1   Windows 98 4.90 build 73010104
 
     Count   Build Id List 
     61   2003051616
 
     No of Unique Users        30
 
 Stack trace(Frame) 

	 nsXULDocument::InsertElement
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 4260] 
	 nsXULDocument::OverlayForwardReference::Merge
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3963] 
	 nsXULDocument::OverlayForwardReference::Resolve
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3802] 
	 nsXULDocument::ResolveForwardReferences
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 1395] 
	 nsXULDocument::ResumeWalk
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3187] 
	 nsXULDocument::CachedChromeStreamListener::OnStopRequest
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 4391] 
	 nsDocumentOpenInfo::OnStopRequest
[d:/nightlybuild/phoenix/trunk/mozilla/uriloader/base/nsURILoader.cpp  line 252] 
	 nsCachedChromeChannel::HandleStopLoadEvent
[d:/nightlybuild/phoenix/trunk/mozilla/rdf/chrome/src/nsChromeProtocolHandler.cpp
 line 477] 
	 PL_HandleEvent	[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c
 line 660] 
	 PL_ProcessPendingEvents
[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c  line 596] 
	 _md_EventReceiverProc
[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c  line 1396] 
	 USER32.dll + 0x4455 (0x77d44455)  
	 USER32.dll + 0x95d5 (0x77d495d5)  
	 nsAppShellService::Run
[d:/nightlybuild/phoenix/trunk/mozilla/xpfe/appshell/src/nsAppShellService.cpp 
line 479] 
	 main1	[d:/nightlybuild/phoenix/trunk/mozilla/toolkit/xre/nsAppRunner.cpp  line
1297] 
	 xre_main	[d:/nightlybuild/phoenix/trunk/mozilla/toolkit/xre/nsAppRunner.cpp 
line 1698] 
	 main	[d:/nightlybuild/phoenix/trunk/mozilla/browser/app/nsBrowserApp.cpp  line
52] 
	 WinMain	[d:/nightlybuild/phoenix/trunk/mozilla/browser/app/nsBrowserApp.cpp 
line 65] 
	 WinMainCRTStartup()  
	 kernel32.dll + 0x214c7 (0x77e814c7)   
 
     (21071489)	URL: http://www.mozilla.org/unix/customizing.html
     (21071489)	Comments: Opening link from Eudora
     (21071457)	URL: http://www.library.unsw.edu.au/%7Elibadmin/unswstaffalert.htm
     (21071457)	Comments: Opening site from email
     (21070517)	URL: http://149.171.40.99/ALEPH//file/start-0
     (21070517)	Comments: Opening Zone Alarm Pro console.
     (21035471)	URL: http://intertwigly.com/index.rss2
     (21035471)	Comments: Opened an image from a Trillian send. 
     (21034965)	URL: http://intertwigly.com/index.rss2
     (21014437)	Comments: click on link in e-mail in the Bat!
     (21008403)	URL: file://C:\Documents and Settings\Owner\Desktop\Web\index.xml
     (21008403)	Comments: launching the browser while another instance was
running with multiple tabs open.
     (21003417)	URL: http://intertwigly.com/index.rss2
     (21001994)	URL: "C:\Program Files\python\Doc\index.html"
     (21001994)	Comments: I opened a (local) page when the browser was already
running.
     (21001766)	Comments: OPening new instance of firebird when one was open
     (20985099)	URL: www.syrogen.com
     (20984331)	URL: http://updates.cox.com/cgi-bin3/DM/y/hRKk0EEwWn0GqX0BAmv0At
     (20968313)	URL: www.ebay.co.uk
     (20968313)	Comments: Loading an HTML file from local disk  
     (20872949)	URL: file://C:\Documents and Settings\Owner\Desktop\Web\index.xml
     (20872949)	Comments: Double clicked on XML file with XSL (named index.xsl)
style definition file win Windows XP to open the file in MozillaFirebird.
     (20839112)	Comments: Trying to open an HTML file from hard drive
 
====================================================================================================
     Count   Offset    Real Signature
[ 2   nsXULDocument::InsertElement fb595d5e - nsXULDocument::InsertElement ]
 
     Crash date range: 2003-06-12 to 2003-06-16
     Min/Max Seconds since last crash: 35603 - 70394
     Min/Max Runtime: 641494 - 677097
 
     Count   Platform List 
     2   Windows NT 5.2 build 3790
 
     Count   Build Id List 
     2   2003051616
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsXULDocument::InsertElement
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 4260] 
	 nsXULDocument::OverlayForwardReference::Merge
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3963] 
	 nsXULDocument::OverlayForwardReference::Resolve
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3802] 
	 nsXULDocument::ResolveForwardReferences
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 1395] 
	 nsXULDocument::ResumeWalk
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3187] 
	 nsXULDocument::CachedChromeStreamListener::OnStopRequest
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 4391] 
	 nsDocumentOpenInfo::OnStopRequest
[d:/nightlybuild/phoenix/trunk/mozilla/uriloader/base/nsURILoader.cpp  line 252] 
	 nsCachedChromeChannel::HandleStopLoadEvent
[d:/nightlybuild/phoenix/trunk/mozilla/rdf/chrome/src/nsChromeProtocolHandler.cpp
 line 477] 
	 PL_HandleEvent	[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c
 line 660] 
	 PL_ProcessPendingEvents
[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c  line 596] 
	 _md_EventReceiverProc
[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c  line 1396] 
	 USER32.dll + 0x35142 (0x77d35142)  
	 USER32.dll + 0x35142 (0x77d35142)  
	 _setargv()  
	 kernel32.dll + 0xf38c (0x77e4f38c)  
	 kernel32.dll + 0x30abc (0x77e70abc)   
 
 
====================================================================================================
     Count   Offset    Real Signature
[ 2   nsXULDocument::InsertElement 2e3fd5ec - nsXULDocument::InsertElement ]
 
     Crash date range: 2003-06-07 to 2003-06-14
     Min/Max Seconds since last crash: 8818 - 296612
     Min/Max Runtime: 219042 - 2532287
 
     Count   Platform List 
     1   Windows NT 5.1 build 2600
     1   Windows NT 5.0 build 2195
 
     Count   Build Id List 
     2   2003051616
 
     No of Unique Users         2
 
 Stack trace(Frame) 

	 nsXULDocument::InsertElement
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 4260] 
	 nsXULDocument::OverlayForwardReference::Merge
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3963] 
	 nsXULDocument::OverlayForwardReference::Resolve
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3802] 
	 nsXULDocument::ResolveForwardReferences
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 1395] 
	 nsXULDocument::ResumeWalk
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3187] 
	 nsXULDocument::CachedChromeStreamListener::OnStopRequest
[d:/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 4391] 
	 nsDocumentOpenInfo::OnStopRequest
[d:/nightlybuild/phoenix/trunk/mozilla/uriloader/base/nsURILoader.cpp  line 252] 
	 nsCachedChromeChannel::HandleStopLoadEvent
[d:/nightlybuild/phoenix/trunk/mozilla/rdf/chrome/src/nsChromeProtocolHandler.cpp
 line 477] 
	 PL_HandleEvent	[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c
 line 660] 
	 PL_ProcessPendingEvents
[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c  line 596] 
	 nsEventQueueImpl::ProcessPendingEvents
[d:/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/nsEventQueue.cpp  line 391]  
 
 
====================================================================================================
     Count   Offset    Real Signature
[ 1   nsXULDocument::InsertElement() 1266c29a - nsXULDocument::InsertElement() ]
 
     Crash date range: 2003-06-10 to 2003-06-10
     Min/Max Seconds since last crash: 1386449 - 1386449
     Min/Max Runtime: 1386449 - 1386449
 
     Count   Platform List 
     1   Linux 2.4.20   
 
     Count   Build Id List 
     1   2003051615
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsXULDocument::InsertElement()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 690] 
	 Merge()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 684] 
	 Resolve()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3802] 
	 nsXULDocument::ResolveForwardReferences()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 1395] 
	 nsXULDocument::ResumeWalk()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3186] 
	 nsXULDocument::OnStreamComplete()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/content/xul/document/src/nsXULDocument.cpp
 line 3404] 
	 nsStreamLoader::OnStopRequest()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/netwerk/base/src/nsStreamLoader.cpp
 line 590] 
	 nsJARChannel::OnStopRequest()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/netwerk/protocol/jar/src/nsJARChannel.cpp
 line 590] 
	 nsInputStreamPump::OnStateStop()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/netwerk/base/src/nsInputStreamPump.cpp
 line 590] 
	 nsInputStreamPump::OnInputStreamReady()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/netwerk/base/src/nsInputStreamPump.cpp
 line 325] 
	 nsInputStreamReadyEvent::EventHandler()  
	 PL_HandleEvent()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c  line 660] 
	 PL_ProcessPendingEvents()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/plevent.c  line 594] 
	 nsEventQueueImpl::ProcessPendingEvents()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/xpcom/threads/nsEventQueue.cpp
 line 391] 
	 event_processor_callback()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/widget/src/gtk/nsAppShell.cpp 
line 188] 
	 our_gdk_io_invoke()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/widget/src/gtk/nsAppShell.cpp 
line 73] 
	 libglib-1.2.so.0 + 0xee00 (0x40365e00)  
	 libglib-1.2.so.0 + 0x104c8 (0x403674c8)  
	 libglib-1.2.so.0 + 0x10ad3 (0x40367ad3)  
	 libglib-1.2.so.0 + 0x10c6c (0x40367c6c)  
	 libgtk-1.2.so.0 + 0x8d7f7 (0x402897f7)  
	 nsAppShell::Run()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/widget/src/gtk/nsAppShell.cpp 
line 330] 
	 nsAppShellService::Run()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/xpfe/appshell/src/nsAppShellService.cpp
 line 479] 
	 main1()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/toolkit/xre/nsAppRunner.cpp 
line 672] 
	 xre_main()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/toolkit/xre/nsAppRunner.cpp 
line 1692] 
	 main()
[/home/cltbld/nightlybuild/phoenix/trunk/mozilla/browser/app/nsBrowserApp.cpp 
line 46] 
	 libc.so.6 + 0x159f1 (0x404c99f1)   
 
     (20917623)	Comments: Opening a link from an email client (evolution)  had
several tabs open in the browser.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
QA Contact: asa
Flags: blocking1.0?
I'm plussing this but reassigning to jst - could be related to some DOM/Content
changs? This is a gecko stack, not a firefox one.
Assignee: firefox → jst
Flags: blocking1.0? → blocking1.0+
Target Milestone: --- → Firefox1.0
Do we have any recent talkback data poiting to this problem? A lot has changed
since this bug was filed...
I only see a couple of incidents in current Talkback data with this stack
signature.  So doesn't look like a topcrash anymore.  Here are the 2 incidents:

Incident ID: 33815
Stack Signature	nsXULDocument::InsertElement 897eb27d
Product ID	Mozilla1.7
Build ID	2004031615
Trigger Time	2004-04-29 08:46:45.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	gklayout.dll + (0012a950)
URL visited	
User Comments	
Since Last Crash	sec
Total Uptime	sec
Trigger Reason	Access violation
Source File Name
c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp
Trigger Line No.	4120
Stack Trace 	
nsXULDocument::InsertElement
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 4120]
nsXULDocument::OverlayForwardReference::Resolve
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3629]
nsXULDocument::ResolveForwardReferences
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1364]
nsXULDocument::ResumeWalk
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3031]
nsXULDocument::OnStreamComplete
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3264]
nsStreamLoader::OnStopRequest
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsStreamLoader.cpp,
line 144]
nsJARChannel::OnStopRequest
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/netwerk/protocol/jar/src/nsJARChannel.cpp,
line 655]
nsCOMPtr_base::assign_with_AddRef
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpcom/glue/nsCOMPtr.cpp,
line 86]
nsInputStreamPump::OnStateStop
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 499]
nsInputStreamPump::OnInputStreamReady
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 340]
nsInputStreamReadyEvent::EventHandler
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp,
line 119]
PL_HandleEvent
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 672]
PL_ProcessPendingEvents
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 610]
_md_EventReceiverProc
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 1413]
USER32.dll + 0x3d79 (0x77d43d79)
USER32.dll + 0x3ddf (0x77d43ddf)
nsAppShellService::Run
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 524]
main1
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1308]
main
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1712]
WinMain
[c:/builds/tinderbox/Mozilla1.7b/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1734]
WinMainCRTStartup()
kernel32.dll + 0x214c7 (0x77e814c7)

And this one has a different stack, so not sure if it's the same problem:

Incident ID: 27834
Stack Signature	nsXULDocument::InsertElement 7dcdc7af
Email Address	
Product ID	MozillaTrunk
Build ID	2004041310
Trigger Time	2004-04-22 12:36:16.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	gklayout.dll + (0012a9c8)
URL visited	
User Comments	
Since Last Crash	sec
Total Uptime	sec
Trigger Reason	Access violation
Source File Name
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp
Trigger Line No.	4048
Stack Trace 	
nsXULDocument::InsertElement
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 4048]
nsXULDocument::OverlayForwardReference::Merge
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3770]
nsXULDocument::OverlayForwardReference::Resolve
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3626]
nsXULDocument::ResolveForwardReferences
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1345]
nsXULDocument::ResumeWalk
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3009]
nsXULDocument::OnPrototypeLoadDone
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 760]
nsXULPrototypeDocument::NotifyLoadDone
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULPrototypeDocument.cpp,
line 759]
nsXULDocument::EndLoad
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 725]
XULContentSinkImpl::DidBuildModel
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULContentSink.cpp,
line 460]
nsExpatDriver::DidBuildModel
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/htmlparser/src/nsExpatDriver.cpp,
line 1060]
nsParser::DidBuildModel
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 1248]
nsParser::ResumeParse
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 1820]
nsParser::OnStopRequest
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 2480]

Marking topcrash- for now.
Keywords: topcrash → topcrash-
Reporter, is this bug still valid?  Please try it on a newer build of FireFox.

-R
Keywords: qawanted
QA Contact: mozillamonks
Updating summary with FF09x and marking topcrash since there has been a fair
amount of Talkback data for this crash in recent Firefox 0.9.x releases and
Firefox10 Aviary branch builds. This crash is definitely still around.  Here is
a link to the Talkback data:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsXULDocument%3A%3AInsertElement&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=

And a recent incident from the Firefox10 branch:
Incident ID: 558065
Stack Signature	nsXULDocument::InsertElement 9dbc7f1d
Product ID	Firefox10
Build ID	2004081207
Trigger Time	2004-08-13 21:05:40.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001d48fa)
URL visited	
User Comments	accidentally tried to open firefox while it was already open,
using TBE's "single window mode." That probably caused the crash.
Since Last Crash	44961 sec
Total Uptime	44961 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 4078
Stack Trace 	
nsXULDocument::InsertElement 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 4078]
nsXULDocument::OverlayForwardReference::Merge 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3800]
nsXULDocument::OverlayForwardReference::Resolve 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3657]
nsXULDocument::ResolveForwardReferences 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1376]
nsXULDocument::ResumeWalk 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3040]
nsXULDocument::OnStreamComplete 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3264]
nsStreamLoader::OnStopRequest 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsStreamLoader.cpp,
line 144]
nsJARChannel::OnStopRequest 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/netwerk/protocol/jar/src/nsJARChannel.cpp,
line 672]
Keywords: topcrash- → topcrash
Summary: Crash opening link from other applications - MFB06 [@ nsXULDocument::InsertElement] → Crash opening link from other applications - FF09x [@ nsXULDocument::InsertElement]
Updating summary with FF10PR1 since this continues to be a topcrasher for that
release.
Summary: Crash opening link from other applications - FF09x [@ nsXULDocument::InsertElement] → Crash opening link from other applications - FF10PR1 [@ nsXULDocument::InsertElement]
comments contune to indcate that many of these crashes happen when the browser
window is launched from another application like outlook, tbird, flash
installer, etc.. to show some random webpage...  I tried many of the pages and
all loaded with out a hitch...

There was also this comment...   wonder if tbe is in the mix...

Opening a new instance
I had tabbrowser extensions running and set to have only one instance of Firefox
open, and I clicked the quick launch button by accident.

one frequent comment was crash when clicking on this link in mail messages...
maybe we can build a test case around that...

send this image to yourself 
 	http://www.normalbobsmith.com/unholyarmy/unholyarmy02_nikkievirgin.jpg
then view page or link, and get the page loaded into tabs and new windows and
new instances of the browser..
I tried building the test case above and ran it several times in different
combinations of loading in tbird, and launching firefox from the mail message..

no luck reproducing.
tried launching from aim as well. no crash.

knous tried with tbe installed. no luck

asa looked at the process list, and there is no consistent pattern of TBE or
other extensions running, but java or an extension component was in the process
list in all the reports he looked at.
Whiteboard: not reproducable yet
blocking-aviary1.0 since we're unable to reproduce this. We'll keep our eyes
open though, and if someone finds more clues as to what is going on here, do let
us know here.
Flags: blocking-aviary1.0+ → blocking-aviary1.0-
Still seeing crashes in Firefox 1.0 RC1 and RC2 Talkback data, although the
total number of incidents seems to be down since PR1.  I'm sure this will still
be around in 1.0, but we won't know until we get more data coming in.
Summary: Crash opening link from other applications - FF10PR1 [@ nsXULDocument::InsertElement] → Crash opening link from other applications - FF10RC2 [@ nsXULDocument::InsertElement]
Yup, still around in Firefox 1.0.  Comments are all over the place for this
stack signature, but a lot of the comments continue to mention clicking on links
from apps like eudora and outlook to open sites in Firefox:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsXULDocument%3A%3AInsertElement&vendor=All&product=Firefox10&platform=All&buildid=20041107&sdate=&stime=&edate=&etime=&sortby=comment
Summary: Crash opening link from other applications - FF10RC2 [@ nsXULDocument::InsertElement] → Crash opening link from other applications - FF10 [@ nsXULDocument::InsertElement]
I seem to have just had a crash with an (almost) identicle stack. This was
opening  bugmail links from outlook. So this appears to still be a problem on
the current trunk. Adding another stack as this is against the current trunk.

There are over 800 incidents that match nsXULDocument::InsertElement and this is
the only bug relating to that stack. A quick check of a dozen or so of the
incidents shows that nearly all have the same stack as below. -> Nominating as a
blocker.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050805
Firefox/1.0+ ID:2005080506

Incident ID: 8121393
Stack Signature	nsXULDocument::InsertElement 9dbc7f1d
Product ID	FirefoxTrunk
Build ID	2005080506
Trigger Time	2005-08-05 15:13:01.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	FIREFOX.EXE + (001d751a)
URL visited	
User Comments	
Since Last Crash	7 sec
Total Uptime	24521 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 4289
Stack Trace 	
nsXULDocument::InsertElement 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 4289]
nsXULDocument::OverlayForwardReference::Merge 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 4011]
nsXULDocument::OverlayForwardReference::Resolve 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3860]
nsXULDocument::ResolveForwardReferences 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1361]
nsXULDocument::ResumeWalk 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3167]
nsXULDocument::OnStreamComplete 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3498]
nsStreamLoader::OnStopRequest 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsStreamLoader.cpp,
line 137]
nsJARChannel::OnStopRequest 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/modules/libjar/nsJARChannel.cpp,
line 712]
Flags: blocking1.8b4?
Summary: Crash opening link from other applications - FF10 [@ nsXULDocument::InsertElement] → Crash opening link from other applications [@ nsXULDocument::InsertElement]
this is pretty low on the topcrash list. Without a clear and reproducible set of
triggering steps, this isn't likely to be fixed for 1.5.
Flags: blocking1.8b4? → blocking1.8b4-
Whiteboard: not reproducable yet → not reproducible yet
QA Contact: mozillamonks → general
Some comments on tackback mention startup.  for example TB29415213 
Still seen on 2.0 branch, but at #214 no longer topcrash

TB44928635
Stack Signature	 nsXULDocument::InsertElement 9dbc7f1d
Product ID	Firefox2
Build ID	2008040413
Trigger Time	2008-05-09 02:31:46.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001db37a)
URL visited	
User Comments	
Since Last Crash	10786 sec
Total Uptime	370732 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 4496
Stack Trace 	
nsXULDocument::InsertElement  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 4496]
nsXULDocument::OverlayForwardReference::Merge  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 4196]
nsXULDocument::OverlayForwardReference::Resolve  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 4045]
nsXULDocument::ResolveForwardReferences  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 1361]
nsXULDocument::ResumeWalk  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 3341]
nsXULDocument::OnStreamComplete  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 3656]
nsStreamLoader::OnStopRequest  [mozilla/netwerk/base/src/nsStreamLoader.cpp, line 137]
nsJARChannel::OnStopRequest  [mozilla/modules/libjar/nsJARChannel.cpp, line 804]
Keywords: topcrash → topcrash-
Assignee: jst → jag
Component: General → XP Toolkit/Widgets
Product: Firefox → Core
QA Contact: general → xptoolkit.widgets
Target Milestone: Firefox1.0 → ---
Version: unspecified → 1.8 Branch
the crash cause should be the lack of a null check. note that similar code grew such a null check.
URL: http://bonsai.mozilla.org/cvsblame.cg...
Assignee: jag → timeless
Status: NEW → ASSIGNED
Attachment #320511 - Flags: review?(bzbarsky)
Attachment #320511 - Flags: review?(bzbarsky) → review+
Comment on attachment 320511 [details] [diff] [review]
match nsXULDocument::OverlayForwardReference::Merge

Actually, I take that back.  This code shouldn't be getting called if aParent doesn't have a current document.  Why is it being called?
Attachment #320511 - Flags: review+ → review-
And more importantly, what is "this code", now that I look more carefully?  Any patch without -p gets automatic r- as far as I'm concerned.
Attached patch bugzilla friendly (obsolete) — — Splinter Review 
sorry, there was a bonsai link. and solaris diff doesn't like -p. i didn't realize that bugzilla wouldn't swallow it.
Attachment #320511 - Attachment is obsolete: true
In that case, I stand by comment 19: that code shouldn't be called if aParent has no current document.  What's calling it, and why?
dunno, all i have is the stack traces you see here. which from memory suffer from some tail call optimizations.
Ah.  We're being called from overlay resolution.  OK.
Attachment #320761 - Flags: approval1.9?
Attached patch To push — — Splinter Review 
On the bright side, while you've seen this before, it's been several months.
Attachment #320761 - Attachment is obsolete: true
Attachment #355525 - Flags: superreview?(bzbarsky)
Attachment #320761 - Flags: approval1.9?
Attachment #355525 - Flags: superreview?(bzbarsky) → superreview+
http://hg.mozilla.org/mozilla-central/rev/549c937170ec
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.2a1
Crash Signature: [@ nsXULDocument::InsertElement]
You need to log in before you can comment on or make changes to this bug.