260887 - FF10PR1 Crash using fastfind with multiple tabs [@ nsTypeAheadFind::GetSelection]

Status: RESOLVED FIXED

(Toolkit :: Find Toolbar, defect)

Description

[Jay Patel [:jay]]

The summary might need to be changed, but from looking at the latest Talkback
data, it looks like a lot of users are crashing using the fastfind feature
across multiple tabs or while opening new tabs.  It's a topcrasher for Windows
and Linux under this stack signature for Firefox 1.0 PR1.  Here is the latest
from Talkback:

Rank    StackSignature    Count  

17   nsTypeAheadFind::GetSelection   109 

 
 	Source File :
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/toolkit/components/typeaheadfind/src/nsTypeAheadFind.cpp
line : 937
 
====================================================================================================
     Count   Offset    Real Signature
[ 25   nsTypeAheadFind::GetSelection 161580cb - nsTypeAheadFind::GetSelection ]
[ 20   nsTypeAheadFind::GetSelection d2f956c8 - nsTypeAheadFind::GetSelection ]
[ 17   nsTypeAheadFind::GetSelection 0b5ce3cc - nsTypeAheadFind::GetSelection ]
[ 6   nsTypeAheadFind::GetSelection 51491218 - nsTypeAheadFind::GetSelection ]
[ 5   nsTypeAheadFind::GetSelection 00d880ff - nsTypeAheadFind::GetSelection ]
[ 2   nsTypeAheadFind::GetSelection f2d2de35 - nsTypeAheadFind::GetSelection ]
[ 2   nsTypeAheadFind::GetSelection be0a9a57 - nsTypeAheadFind::GetSelection ]
 
     Crash date range: 14-SEP-04 to 16-SEP-04
     Min/Max Seconds since last crash: 579 - 149845
     Min/Max Runtime: 579 - 149845
 
     Count   Platform List 
     53   Windows XP [Windows NT 5.1 build 2600] 
     24   Windows 2K [Windows NT 5.0 build 2195] 
 
     Count   Build Id List 
     77   2004091322
 
     No of Unique Users        76
 
 Stack trace(Frame) 

	 nsTypeAheadFind::GetSelection
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/toolkit/components/typeaheadfind/src/nsTypeAheadFind.cpp
 line 937] 
	 nsTypeAheadFind::Find
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/toolkit/components/typeaheadfind/src/nsTypeAheadFind.cpp
 line 784] 
	 XPTC_InvokeByIndex
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
 line 102] 
	 XPCWrappedNative::CallMethod
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp
 line 2028] 
	 XPC_WN_CallMethod
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp
 line 1287] 
	 js_Invoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 941] 
	 js_Interpret
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 2973] 
	 js_Invoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 958] 
	 js_InternalInvoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 1035] 
	 JS_CallFunctionValue
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsapi.c  line
3698] 
	 nsJSContext::CallEventHandler
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp
 line 1297] 
	 nsJSEventListener::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/dom/src/events/nsJSEventListener.cpp
 line 184] 
	 nsEventListenerManager::HandleEventSubType
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp
 line 1436] 
	 nsEventListenerManager::HandleEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp
 line 1516] 
	 nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp
 line 2841] 
	 nsXULElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp
 line 2860] 
	 nsGenericElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp
 line 1990] 
	 nsHTMLInputElement::HandleDOMEvent
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp
 line 1399] 
	 PresShell::HandleEventInternal
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp
 line 6057] 
	 PresShell::HandleEventWithTarget
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp
 line 5982] 
	 nsTextControlFrame::FireOnInput
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/layout/html/forms/src/nsTextControlFrame.cpp
 line 3031] 
	 nsTextInputListener::EditAction
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/layout/html/forms/src/nsTextControlFrame.cpp
 line 490] 
	 nsEditor::NotifyEditorObservers
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/editor/libeditor/base/nsEditor.cpp
 line 1632] 
	 nsPlaintextEditor::DeleteSelection
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp
 line 885] 
	 nsTextControlFrame::SetValue
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/layout/html/forms/src/nsTextControlFrame.cpp
 line 3179] 
	 nsTextControlFrame::SetProperty
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/layout/html/forms/src/nsTextControlFrame.cpp
 line 2375] 
	 nsHTMLInputElement::SetValue
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp
 line 694] 
	 XPTC_InvokeByIndex
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
 line 102] 
	 XPCWrappedNative::CallMethod
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp
 line 2028] 
	 XPC_WN_GetterSetter
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp
 line 1311] 
	 js_Invoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 941] 
	 js_InternalInvoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 1035] 
	 js_InternalGetOrSet
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 1078] 
	 js_SetProperty
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsobj.c  line
2849] 
	 js_Interpret
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 2164] 
	 js_Invoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 958] 
	 js_InternalInvoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 1035] 
	 js_InternalGetOrSet
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 1078] 
	 js_SetProperty
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsobj.c  line
2849] 
	 js_Interpret
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 2164] 
	 js_Invoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 958] 
	 js_InternalInvoke
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c 
line 1035] 
	 JS_CallFunctionValue
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/js/src/jsapi.c  line
3698] 
	 nsJSContext::CallEventHandler
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp
 line 1297] 
	 GlobalWindowImpl::RunTimeout
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp
 line 5083] 
	 GlobalWindowImpl::TimerCallback
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp
 line 5445] 
	 nsAppShellService::Run
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/xpfe/appshell/src/nsAppShellService.cpp
 line 495] 
	 main
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp
 line 58] 
	 kernel32.dll + 0x16d4f (0x7c816d4f)   
 
     (841107)	URL:
http://narek-store.com/shop/SearchResults.asp?ProdStock=MD-7585-CD
     (837884)	Comments: opening new tabbed window
     (837695)	URL: www.slashdot.org
     (837695)	Comments: I think I tried to get back to my homepage (slashdot) by
clicking ALT+HOME
     (836766)	URL: http://www.palmbrasil.com.br/modelos/palm-m130-tabela.html
     (836766)	Comments: the crash happened when i was in this page and tryied to
create a new table
     (836132)	URL: chrome://browser/content/browser.xul
     (836020)	Comments: Opening a new tab. My home url is http://www.onlamp.com/
 but I don't think it was the problem.
     (835631)	Comments: One tab displayed.  Pressed <ctl> T to display new
second tab.  Second tab displayed  then crashed.
     (835318)	Comments: ctrl-t to open a new tab
     (834827)	Comments: Opened a new Tab in Browser
     (833986)	Comments: Opening a new tab
     (833944)	Comments: I was opening a new tab to brose about:config. Firefox
crashed after it opened the new tab. 
     (833226)	Comments: I was having 5 tabs open  was trying to search in one of
em and then tried to open a new tab with CTRL + T when my browser chrashed.
     (831872)	Comments: I'd opened a new tab. Not really sure what happened....
     (831320)	Comments: I had just alt-tabbed back to the browser from another
application.
     (829025)	Comments: I had the browser open with multiple tabs in the window.
 I clicked on the firefox icon on the quick launch toolbar and firefox crashed.
 The crash may have been caused by the single window extension.
     (828325)	URL: www.netsys.com
     (828325)	Comments: open a url in linux arquives
     (827346)	Comments: attempting to open a new tab (Ctrl-T)
     (826902)	URL: www.die-staemme.de
     (826902)	Comments: i switched between the tabs. nothing special!  3 tabs
opened   1 txt (www.gamefaqs.com)  2 php (shb-board.makaze.net  www.die-staemme.de)
     (825906)	URL: www.google.com
     (825906)	Comments: Was opening other tab when Firefox shut down.
     (825346)	Comments: Created a new tab.
     (823887)	Comments: I was at http://www.suprnova.org and switched to an
already opened tab and press my google link from the bookmarks bar.    After
that I got the message of the crash and all that stuff.  
     (823067)	Comments: Opened new tab (Ctrl-T)
     (822960)	URL: http://www.yoper.com/yoperreleasepackages.txt
     (822960)	Comments: blackboard.midsouthcc.edu opend in another tab.  Crash
happened when I opened a new tab (Ctrl-T)
     (822737)	URL: www.lambdatheultimate.org
     (822737)	Comments: Opened new tab - was about to type URL when it crashed.
     (822542)	Comments: opening a new tab when 4 were already open
     (821131)	Comments: I clicked a bookmark button on the bookmark toolbar
which points to http://www.dictionary.com/
     (821014)	Comments: I hit CTRL+T to open a new tab.
     (818245)	Comments: just searched on google and sought out a site my search
was "best goth love song" and I hit the second option
     (817083)	Comments: ?
     (816607)	Comments: Opening a third tab
     (815233)	Comments: I opened the 3rd tab while there is a "find" text box
opened at the box
     (813484)	Comments: I alt-tabbed to the application (Firefox) then hit
Ctrl-T to open a new tab.  Then I hit F6 because I noticed the focus wasn't in
the address bar...then it crashed.
     (810905)	Comments: Hit Ctrl-T to open new tab  and it crashed before
opening. I had two or three open  but can't remember exactly where they were
pointing.
     (810697)	Comments: new tab caused crash

Comment 1

[Jay Patel [:jay]]

Might be too late, but if anyone can take a look at this one soon, that would be
great!  This has creeped up into the top 15 topcrash list for PR1.

I have tried reproducing this for a while now, but with no luck.

Blake: Got time to dig through the stack?

Comment 2

[timeless]

(a)presshell is probably null

Comment 3

[Blake Ross]

Jay,

I just added a bunch of guards to try to fix this. Time will tell, I suppose.

Comment 4

[Frank Wein [:mcsmurf]]

blake: Not that i have anything against that you fixed this bug, but could you 
maybe attach the patch here that you checked in?

Comment 5

[Asaf Romano (gone)]

*** Bug 262043 has been marked as a duplicate of this bug. ***