236824 - Crash on reload of page with xul box and menu inside xbl document

Status: RESOLVED DUPLICATE of bug 205735

(Core :: XBL, defect)

Description

[Martijn Wargers (dead)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040302 Firefox/0.8.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040302 Firefox/0.8.0+

See testcase. I have a div with -moz-binding:url(#rd5)
In this binding I have the following content:
<content xmlns:html="http://www.w3.org/1999/xhtml">
<xul:box>
<xul:menu>text1
<children/>
</xul:menu>
</xul:box>
</content>
The first time it is loaded it does not crash. 
However the string 'This can crash for unknown reason' is not visible in the dom
inspector.
When you press reload, the browser crashes.

Maybe this is similar to bug 236796 and bug 236270, but maybe it is different,
because this time it is not hanging but really crashing.

Reproducible: Always
Steps to Reproduce:
1.Every time
2.
3.

Actual Results:  
Crash

Expected Results:  
No crash

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase crasher

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

Confirming with build 2004-03-08-08 on Windows XP, but not stack and since
Talkback isn't coming up...

Comment 3

[Rene Pronk]

I don't get a crash with Mozilla 1.7a (WinXP) but I do get a hang. The hang
seems to different from bug 236796 and bug 236270 because I see a totally
different stack.

When I load the testcase I get an assertion right here:

http://lxr.mozilla.org/seamonkey/source/content/base/src/nsGenericElement.cpp#809

807 nsGenericElement::~nsGenericElement()
808 {
809   NS_PRECONDITION(!mDocument, "Please remove this from the document properly");
810


After the assertion I do get see "text" on the screen but mozilla won't load any
new pages. Resizing the window gives another assertion and when I close the
browser I get an unknown exception at:



ns_if_addref(nsIContent * 0xdddddddd) line 114 + 9 bytes
nsXBLInsertionPoint::GetDefaultContent() line 66 + 9 bytes
ChangeDocumentForDefaultContent(nsHashKey * 0x02b50978, void * 0x020754e0, void
* 0x00000000) line 491 + 12 bytes
hashEnumerate(PLDHashTable * 0x02fb6bc8, PLDHashEntryHdr * 0x02fb6c64, unsigned
int 0, void * 0x0012e638) line 115 + 26 bytes
PL_DHashTableEnumerate(PLDHashTable * 0x02fb6bc8, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x1001ae30 hashEnumerate(PLDHashTable
*, PLDHashEntryHdr *, unsigned int, void *), void * 0x0012e638) line 619 + 34 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x012be160
ChangeDocumentForDefaultContent(nsHashKey *, void *, void *), void * 0x00000000)
line 303 + 21 bytes
nsXBLBinding::ChangeDocument(nsXBLBinding * const 0x02f9e178, nsIDocument *
0x02f81598, nsIDocument * 0x00000000) line 1011
nsBindingManager::ChangeDocumentFor(nsBindingManager * const 0x02f82c50,
nsIContent * 0x02f9f860, nsIDocument * 0x02f81598, nsIDocument * 0x00000000)
line 566
nsGenericElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 1726
nsGenericHTMLElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 1287
nsGenericElement::SetDocumentInChildrenOf(nsIContent * 0x02f9f1c0, nsIDocument *
0x00000000, int 1) line 1705
nsGenericElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 1758
+ 17 bytes
nsGenericHTMLElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 1287
nsHTMLBodyElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 507
nsGenericElement::SetDocumentInChildrenOf(nsIContent * 0x02f9dc10, nsIDocument *
0x00000000, int 1) line 1705
nsGenericElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 1758
+ 17 bytes
nsGenericHTMLElement::SetDocument(nsIDocument * 0x00000000, int 1, int 1) line 1287
nsDocument::SetScriptGlobalObject(nsIScriptGlobalObject * 0x00000000) line 1618
DocumentViewerImpl::Close(DocumentViewerImpl * const 0x02f83660) line 1136
nsDocShell::Destroy(nsDocShell * const 0x02dff6bc) line 3060
nsWebShell::Destroy(nsWebShell * const 0x02dff6bc) line 1230
nsFrameLoader::Destroy(nsFrameLoader * const 0x02dff660) line 373
nsSubDocumentFrame::Destroy(nsSubDocumentFrame * const 0x02de07e0,
nsIPresContext * 0x021347a8) line 580
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x02de0618, nsIPresContext *
0x021347a8) line 137
nsBoxFrame::Destroy(nsBoxFrame * const 0x02de0618, nsIPresContext * 0x021347a8)
line 1065 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x02d60700, nsIPresContext *
0x021347a8) line 137
nsBoxFrame::Destroy(nsBoxFrame * const 0x02d60700, nsIPresContext * 0x021347a8)
line 1065 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x02d605c8, nsIPresContext *
0x021347a8) line 137
nsBoxFrame::Destroy(nsBoxFrame * const 0x02d605c8, nsIPresContext * 0x021347a8)
line 1065 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x02d600b4, nsIPresContext *
0x021347a8) line 137
nsBoxFrame::Destroy(nsBoxFrame * const 0x02d600b4, nsIPresContext * 0x021347a8)
line 1065 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x02d5ffe0, nsIPresContext *
0x021347a8) line 137
nsBoxFrame::Destroy(nsBoxFrame * const 0x02d5ffe0, nsIPresContext * 0x021347a8)
line 1065 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x02d5fce0, nsIPresContext *
0x021347a8) line 137
nsBoxFrame::Destroy(nsBoxFrame * const 0x02d5fce0, nsIPresContext * 0x021347a8)
line 1065 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x02143810, nsIPresContext *
0x021347a8) line 137
nsBoxFrame::Destroy(nsBoxFrame * const 0x02143810, nsIPresContext * 0x021347a8)
line 1065 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x021436a4, nsIPresContext *
0x021347a8) line 137
nsBoxFrame::Destroy(nsBoxFrame * const 0x021436a4, nsIPresContext * 0x021347a8)
line 1065 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x021347a8) line 130
nsContainerFrame::Destroy(nsContainerFrame * const 0x021435a8, nsIPresContext *
0x021347a8) line 137
ViewportFrame::Destroy(ViewportFrame * const 0x021435a8, nsIPresContext *
0x021347a8) line 68
FrameManager::Destroy(FrameManager * const 0x021460c8) line 480
PresShell::Destroy(PresShell * const 0x020a8570) line 1879
DocumentViewerImpl::Destroy(DocumentViewerImpl * const 0x020f3740) line 1220
nsDocShell::Destroy(nsDocShell * const 0x01fa2b2c) line 3061
nsWebShell::Destroy(nsWebShell * const 0x01fa2b2c) line 1230
nsXULWindow::Destroy(nsXULWindow * const 0x01fcee10) line 491
nsWebShellWindow::Destroy(nsWebShellWindow * const 0x01fcee10) line 1665 + 9 bytes
nsWebShellWindow::Close(nsWebShellWindow * const 0x01fcee74) line 373
nsWebShellWindow::HandleEvent(nsGUIEvent * 0x0012f130) line 486
nsWindow::DispatchEvent(nsWindow * const 0x00a1d41c, nsGUIEvent * 0x0012f130,
nsEventStatus & nsEventStatus_eIgnore) line 1064 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f130) line 1085
nsWindow::DispatchStandardEvent(unsigned int 101) line 1104 + 15 bytes
nsWindow::ProcessMessage(unsigned int 16, unsigned int 0, long 0, long *
0x0012f588) line 3770
nsWindow::WindowProc(HWND__ * 0x000801a4, unsigned int 16, unsigned int 0, long
0) line 1346 + 27 bytes
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d444f5()
USER32! 77d44525()
NTDLL! 77f75da3()
USER32! 77d458ce()
nsWindow::DefaultWindowProc(HWND__ * 0x000801a4, unsigned int 274, unsigned int
61536, long 1704898) line 1372
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d45b2c()
USER32! 77d45b4b()
nsWindow::WindowProc(HWND__ * 0x000801a4, unsigned int 274, unsigned int 61536,
long 1704898) line 1353 + 31 bytes
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d444f5()
USER32! 77d44525()
NTDLL! 77f75da3()
USER32! 77d458ce()
nsWindow::DefaultWindowProc(HWND__ * 0x000801a4, unsigned int 161, unsigned int
20, long 1704898) line 1372
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d45b2c()
USER32! 77d45b4b()
nsWindow::WindowProc(HWND__ * 0x000801a4, unsigned int 161, unsigned int 20,
long 1704898) line 1353 + 31 bytes
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d43d79()
USER32! 77d43ddf()
nsAppShellService::Run(nsAppShellService * const 0x00a65050) line 484
main1(int 1, char * * 0x002e2638, nsISupports * 0x00a04dd8) line 1291 + 32 bytes
main(int 1, char * * 0x002e2638) line 1678 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e814c7()

Comment 4

[Boris Zbarsky [:bzbarsky]]

Sounds like that nsXBLInsertionPoint is deleted....

Comment 5

[Kevin Berkheiser]

Crashed for me when hitting the back button.

TB9576E

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316

Comment 6

[Frederic Bezies]

Adding talkbackid keyword, because of TB sent in comment#5. I'm just following
"crashweek" orders ;o)

Comment 7

[Asa Dotzler [:asa]]

*** This bug has been marked as a duplicate of 205735 ***