232460 - Crash [@ nsCOMPtr_base::~nsCOMPtr_base()] from nsPopupBoxObject::ShowPopup

Status: RESOLVED INCOMPLETE

(Core :: XUL, defect, P5)

Description

[timeless]

mozilla1.6 branch (vendor modifications)
script adds an event handler which tosses up the common dialog box on click.
clicked a few times.
cancelled the dialogs.
crashed:

 	xpcom.dll!nsCOMPtr_base::~nsCOMPtr_base()  Line 64 + 0x3	C++
>	gklayout.dll!nsPopupBoxObject::ShowPopup(nsIDOMElement *
aSrcContent=0x038d7334, nsIDOMElement * aPopupContent=0x03135a1c, int aXPos=411,
int aYPos=56, const unsigned short * aPopupType=0x013caf0c, const unsigned short
* anAnchorAlignment=0x013cc174, const unsigned short *
aPopupAlignment=0x013c7368)  Line 193 + 0xaa	C++
 	gklayout.dll!nsXULTooltipListener::LaunchTooltip(nsIContent *
aTarget=0x0012fc70, int aX=411, int aY=56)  Line 509	C++
 	gklayout.dll!nsXULTooltipListener::ShowTooltip()  Line 401	C++
 	xpcom.dll!nsTimerImpl::Fire()  Line 382 + 0x7	C++
 	xpcom.dll!nsTimerManager::FireNextIdleTimer()  Line 616	C++
 	gkwidget.dll!nsAppShell::Run()  Line 142	C++
 	appshell.dll!nsAppShellService::Run()  Line 484	C++
 	mozilla.exe!main1(int argc=1244428, char * * argv=0x01281df0, nsISupports *
nativeApp=0x04d5ceec)  Line 1291 + 0x9	C++
 	mozilla.exe!main(int argc=1, char * * argv=0x002a4620)  Line 1678 + 0x16	C++
 	mozilla.exe!WinMain(HINSTANCE__ * __formal=0x00400000, HINSTANCE__ *
__formal=0x00400000, char * args=0x00151f1a, HINSTANCE__ * __formal=0x00400000)
 Line 1702 + 0x17	C++
 	mozilla.exe!WinMainCRTStartup()  Line 392 + 0xf	C
 	kernel32.dll!GetCurrentDirectoryW()  + 0x44	

-	popupSetFrame	0x04d5ce68	nsIFrame *
|+	nsISupports	{...}	nsISupports
|+	mRect	{...}	nsRect
|+	mContent	0xfeeefeee	nsIContent *
|+	mStyleContext	0xfeeefeee	nsStyleContext *
|+	mParent	0xfeeefeee	nsIFrame *
|+	mNextSibling	0xfeeefeee	nsIFrame *
\	mState	4277075694	unsigned int

Comment 1

[Radek 'sysKin' Czyz]

I just got something similar on
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

It's the same deconstructor but a different stack - can someone confirm if it's
the same bug or not? Talkback TB1902856H.

Happened when I closed a tab.

Comment 2

[Daniel Veditz [:dveditz]]

Without a reproducible testcase I don't think this bug is doing us much good anymore. All that code has by now changed significantly.