244305 - top.close() crashes JS console [@ nsFrameManager::GetPropertyListFor ]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[[e-mail]]

#0  0x420b4b31 in nanosleep () from /lib/i686/libc.so.6
#1  0x420b49b1 in sleep () from /lib/i686/libc.so.6
#2  0x0806d6e2 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:135
#3  0x41802629 in nsProfileLock::FatalSignalHandler (signo=11) at
nsProfileLock.cpp:209
#4  0x40137f75 in pthread_sighandler () from /lib/i686/libpthread.so.0
#5  <signal handler called>
#6  nsFrameManager::GetPropertyListFor (this=0x18, aPropertyName=0x80bd5b0) at
nsFrameManager.cpp:1907
#7  0x40d2d6c8 in nsFrameManager::SetFrameProperty (this=0x18, aFrame=0x8a02b40,
aPropertyName=0x80bd5b0, aPropertyValue=0x0, aPropDtorFunc=0) at
nsFrameManager.cpp:1964
#8  0x40dfa1c5 in nsCSSFrameConstructor::ProcessRestyledFrames (this=0x8884848,
aChangeList=@0xbfffcec4, aPresContext=0x8423b30) at nsCSSFrameConstructor.cpp:9821
#9  0x40dfade0 in nsCSSFrameConstructor::AttributeChanged (this=0x8884848,
aPresContext=0x8423b30, aContent=0x88e7bf8, aNameSpaceID=0,
aAttribute=0x80bcfe8, aModType=2) at nsCSSFrameConstructor.cpp:10097
#10 0x40d7fbcd in PresShell::AttributeChanged (this=0x8884428,
aDocument=0x88b25a8, aContent=0x88e7bf8, aNameSpaceID=0, aAttribute=0x80bcfe8,
aModType=2) at nsPresShell.cpp:5259
#11 0x41148cbb in nsXULDocument::AttributeChanged (this=0x88b25a8,
aElement=0x88e7bf8, aNameSpaceID=0, aAttribute=0x80bcfe8, aModType=2) at
nsXULDocument.cpp:1140
#12 0x4120e3d4 in nsXULElement::SetAttrAndNotify (this=0x88e7bf8,
aNamespaceID=0, aAttribute=0x80bcfe8, aPrefix=0x0, aOldValue=@0xbfffd4a4,
aParsedValue=@0xbfffd484, aModification=0, aFireMutation=0, aNotify=1) at
nsXULElement.cpp:2148
#13 0x4120ddba in nsXULElement::SetAttr (this=0x88e7bf8, aNamespaceID=0,
aName=0x80bcfe8, aPrefix=0x0, aValue=@0x8a9dd20, aNotify=1) at nsXULElement.cpp:2073
#14 0x41219c4e in nsXULElement::SetAttr (this=0x88e7bf8, aNameSpaceID=0,
aName=0x80bcfe8, aValue=@0x8a9dd20, aNotify=1) at nsXULElement.h:461
#15 0x4120a03c in nsXULElement::SetAttribute (this=0x88e7bf8, aName=@0x8a9dc98,
aValue=@0x8a9dd20) at nsXULElement.cpp:1019
#16 0x40605150 in XPTC_InvokeByIndex () from /usr/src/mozilla/dist/bin/libxpcom.so
#17 0x406e3724 in XPCWrappedNative::CallMethod (ccx=@0xbfffd860,
mode=CALL_METHOD) at xpcwrappednative.cpp:2027
#18 0x406ee1ca in XPC_WN_CallMethod (cx=0x887a438, obj=0x886a140, argc=2,
argv=0x8a9ed68, vp=0xbfffda00) at xpcwrappednativejsops.cpp:1287
#19 0x400611ac in js_Invoke (cx=0x887a438, argc=2, flags=0) at jsinterp.c:1281
#20 0x400706f4 in js_Interpret (cx=0x887a438, result=0xbfffe0bc) at jsinterp.c:3370
#21 0x40061236 in js_Invoke (cx=0x887a438, argc=1, flags=2) at jsinterp.c:1301
#22 0x400615ae in js_InternalInvoke (cx=0x887a438, obj=0x8869688,
fval=144793808, flags=0, argc=1, argv=0xbfffe418, rval=0xbfffe2f4) at
jsinterp.c:1378
#23 0x4002e48b in JS_CallFunctionValue (cx=0x887a438, obj=0x8869688,
fval=144793808, argc=1, argv=0xbfffe418, rval=0xbfffe2f4) at jsapi.c:3631
#24 0x41182f26 in nsJSContext::CallEventHandler (this=0x884fc10,
aTarget=0x8869688, aHandler=0x8a160d0, argc=1, argv=0xbfffe418, rval=0xbfffe2f4)
at nsJSEnvironment.cpp:1263
#25 0x411df680 in nsJSEventListener::HandleEvent (this=0x88e7910,
aEvent=0x8a9dfe8) at nsJSEventListener.cpp:174
#26 0x40fb9fd8 in nsEventListenerManager::HandleEventSubType (this=0x88e78e0,
aListenerStruct=0x88e7970, aDOMEvent=0x8a9dfe8, aCurrentTarget=0x8a9e578,
aSubType=4, aPhaseFlags=2) at nsEventListenerManager.cpp:1460
#27 0x40fba389 in nsEventListenerManager::HandleEvent (this=0x88e78e0,
aPresContext=0x8423b30, aEvent=0xbffff380, aDOMEvent=0xbfffed4c,
aCurrentTarget=0x8a9e578, aFlags=2, aEventStatus=0xbffff138) at
nsEventListenerManager.cpp:1553
#28 0x41210fb5 in nsXULElement::HandleDOMEvent (this=0x88e78a8,
aPresContext=0x8423b30, aEvent=0xbffff380, aDOMEvent=0xbfffed4c, aFlags=2,
aEventStatus=0xbffff138) at nsXULElement.cpp:2765
#29 0x41211132 in nsXULElement::HandleDOMEvent (this=0x89efd80,
aPresContext=0x8423b30, aEvent=0xbffff380, aDOMEvent=0xbfffed4c, aFlags=2,
aEventStatus=0xbffff138) at nsXULElement.cpp:2783
#30 0x40f340ef in nsGenericElement::HandleDOMEvent (this=0x89ed0d0,
aPresContext=0x8423b30, aEvent=0xbffff380, aDOMEvent=0xbfffed4c, aFlags=7,
aEventStatus=0xbffff138) at nsGenericElement.cpp:1975
#31 0x4101cd29 in nsHTMLInputElement::HandleDOMEvent (this=0x89ed0d0,
aPresContext=0x8423b30, aEvent=0xbffff380, aDOMEvent=0x0, aFlags=1,
aEventStatus=0xbffff138) at nsHTMLInputElement.cpp:1355
#32 0x40d8211e in PresShell::HandleEventInternal (this=0x8884428,
aEvent=0xbffff380, aView=0x8883f40, aFlags=1, aStatus=0xbffff138) at
nsPresShell.cpp:6073
#33 0x40d81b47 in PresShell::HandleEvent (this=0x8884428, aView=0x8883f40,
aEvent=0xbffff380, aEventStatus=0xbffff138, aForceHandle=1,
aHandled=@0xbffff134) at nsPresShell.cpp:5966
#34 0x41177cd6 in nsViewManager::HandleEvent (this=0x8883df0, aView=0x8883f40,
aEvent=0xbffff380, aCaptured=0) at nsViewManager.cpp:2183
#35 0x4117749c in nsViewManager::DispatchEvent (this=0x8883df0,
aEvent=0xbffff380, aStatus=0xbffff200) at nsViewManager.cpp:1971
#36 0x4116d71e in HandleEvent (aEvent=0xbffff380) at nsView.cpp:76
#37 0x4177a0ca in nsWidget::DispatchEvent (this=0x8883f98, aEvent=0xbffff380,
aStatus=@0xbffff2cc) at nsWidget.cpp:1496
#38 0x41779cd6 in nsWidget::DispatchWindowEvent (this=0x8883f98,
event=0xbffff380) at nsWidget.cpp:1385
#39 0x41776fe2 in nsWidget::OnKey (this=0x8883f98, aEvent=@0xbffff380) at
nsWidget.cpp:104
#40 0x4176eb52 in handle_key_press_event (w=0x0, event=0x81e5fc8, p=0x8a00328)
at nsGtkEventHandler.cpp:593
#41 0x4176f590 in dispatch_superwin_event (event=0x81e5fc8, window=0x8a00328) at
nsGtkEventHandler.cpp:911
#42 0x4176f174 in handle_gdk_event (event=0x81e5fc8, data=0x0) at
nsGtkEventHandler.cpp:775
#43 0x4028fd6f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#44 0x402c1773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#45 0x402c1d39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#46 0x402c1eec in g_main_run () from /usr/lib/libglib-1.2.so.0
#47 0x401de2e3 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#48 0x41760131 in nsAppShell::Run (this=0x8171780) at nsAppShell.cpp:320
#49 0x417141b1 in nsAppShellService::Run (this=0x81714c8) at
nsAppShellService.cpp:523
#50 0x08063926 in main1 (argc=1, argv=0xbffff8c4, nativeApp=0x80f9510) at
nsAppRunner.cpp:1302
#51 0x080647ab in main (argc=1, argv=0xbffff8c4) at nsAppRunner.cpp:1779
#52 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6

Comment 1

[Boris Zbarsky [:bzbarsky]]

What's at frame 6?

Comment 2

[[e-mail]]

I think it's frame 8 you want:
9820 frameManager->SetFrameProperty(changeDate->mFrame,
9821   nsLayoutAtoms::changeListProperty, nsnull, nsnull);
frameManager = (nsFrameManager *) 0x18
9810 nsFrameManager *frameManager = aPresContext->FrameManager();
aPresContext = (nsIPresContext *) 0x899cc18
aPresContext->GetPresShell() = (nsIPresShell *) 0x0

Comment 3

[Boris Zbarsky [:bzbarsky]]

So in frame 10 the shell points to the context but not vice versa?

Comment 4

[Adam Hauner]

"top.close()" issue has same stack as "parent.close()" (TB1568364H and
TB1568149X on W2K are available for compare). "parent.close()" issue is covered
by bug 232356.

Boris, could you check, if this bug should be duped agains it or vice versa and
preserve correct dependencies?

Comment 5

[Boris Zbarsky [:bzbarsky]]

They're probably dups, yes.

Comment 6

[Adam Hauner]

WFM with 2004112306/trunk/W2K (same as bug 232356)
Anybody is able to reproduce with actual builds?

Comment 7

[Charles Fenwick]

Per comment 6 and my testing on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8b2) Gecko/20050328, am marking WFM.

Comment 8

[Rotem Liss]

*** Bug 297632 has been marked as a duplicate of this bug. ***