Closed Bug 262183 Opened 20 years ago Closed 20 years ago

FFTrunk and Trunk crash [@ nsSHEntry::GetChildAt]

Categories

(Core :: DOM: Navigation, defect)

Product:
Core
Component:
DOM: Navigation
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.8beta1

People

(Reporter: jay, Assigned: darin.moz)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

Attachments

(1 file)

v1 patch
843 bytes, patch
Biesinger
: review+
bzbarsky
: superreview+
Details | Diff | Splinter Review
This is a regression on the Trunk that started showing up on 9/22. This might be a result of the checkin for bug 260314. Most comments mention using the back button and although the stack signature is the same, there appears to be at least 3 unique stacks showing up in Talkback data. MozillaTrunk crashes (for more info go to http://talkback-public.mozilla.org/reports/mozilla/Trunk/smart-analysis.all): Count Offset Real Signature [ 9 nsSHEntry::GetChildAt 82171484 - nsSHEntry::GetChildAt ] Crash date range: 23-SEP-04 to 23-SEP-04 Min/Max Seconds since last crash: 28 - 7073 Min/Max Runtime: 28 - 13824 Count Platform List 9 Windows XP [Windows NT 5.1 build 2600] Count Build Id List 7 2004092206 2 2004092306 No of Unique Users 1 Stack trace(Frame) nsSHEntry::GetChildAt [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp line 397] nsDocShell::GetChildSHEntry [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 2325] nsDocShell::LoadURI [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 662] nsFrameLoader::LoadFrame [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsFrameLoader.cpp line 324] nsGenericHTMLFrameElement::LoadSrc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp line 3545] nsGenericHTMLFrameElement::SetParent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp line 3559] nsGenericElement::AppendChildTo [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp line 2559] SinkContext::CloseContainer [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp line 1362] HTMLContentSink::CloseContainer [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp line 3051] CNavDTD::CloseContainer [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 3515] CNavDTD::CloseContainersTo [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 3547] CNavDTD::CloseContainersTo [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 3733] CNavDTD::HandleEndToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 2079] CNavDTD::HandleToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 1000] CNavDTD::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 480] nsParser::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp line 1902] nsParser::ResumeParse [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp line 1766] nsParser::ContinueParsing [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp line 1364] gkparser.dll + 0x28224 (0x604c8224) nsExpatDriver::AddRef [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsExpatDriver.cpp line 303] 0x8556104d (946281) Comments: Pressing the "Back" button ================================================= Count Offset Real Signature [ 2 nsSHEntry::GetChildAt a36bdefb - nsSHEntry::GetChildAt ] Crash date range: 23-SEP-04 to 23-SEP-04 Min/Max Seconds since last crash: 29 - 105 Min/Max Runtime: 89 - 194 Count Platform List 2 Windows XP [Windows NT 5.1 build 2600] Count Build Id List 2 2004092206 No of Unique Users 1 Stack trace(Frame) nsSHEntry::GetChildAt [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp line 397] nsDocShell::CloneAndReplace [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 6520] nsDocShell::AddChildSHEntry [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 2380] nsDocShell::DoAddChildSHEntry [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 2413] nsDocShell::AddToSessionHistory [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 6364] nsDocShell::OnNewURI [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 6148] nsDocShell::OnLoadingSite [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 6189] nsDocShell::CreateContentViewer [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 4521] nsDSURIContentListener::DoContent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDSURIContentListener.cpp line 127] nsDocumentOpenInfo::TryContentListener [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp line 721] nsDocumentOpenInfo::DispatchContent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp line 467] nsDocumentOpenInfo::OnStartRequest [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp line 325] nsHttpChannel::CallOnStartRequest [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp line 677] nsHttpChannel::ProcessNormal [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp line 835] nsHttpChannel::ProcessResponse [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp line 774] nsHttpChannel::OnStartRequest [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp line 3572] nsInputStreamPump::OnStateStart [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp line 383] nsInputStreamPump::OnInputStreamReady [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp line 345] nsInputStreamReadyEvent::EventHandler [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/io/nsStreamUtils.cpp line 119] PL_HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c line 693] PL_ProcessPendingEvents [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c line 631] _md_EventReceiverProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c line 1434] USER32.dll + 0x30494 (0x77d70494) USER32.dll + 0x30494 (0x77d70494) gkwidget.dll + 0x142b2 (0x605242b2) _setargv() kernel32.dll + 0x16d4f (0x7c816d4f) kernel32.dll + 0x399f3 (0x7c8399f3) FirefoxTrunk crashes (for more info go to http://talkback-public.mozilla.org/reports/firefox/FFTrunk/smart-analysis.all): Count Offset Real Signature [ 4 nsSHEntry::GetChildAt 55ff7eff - nsSHEntry::GetChildAt ] Crash date range: 22-SEP-04 to 23-SEP-04 Min/Max Seconds since last crash: 112 - 11594 Min/Max Runtime: 2545 - 11706 Count Platform List 2 Windows XP [Windows NT 5.1 build 2600] 1 Windows XP [Windows NT 5.2 build 3790] 1 Windows 2K [Windows NT 5.0 build 2195] Count Build Id List 3 2004092207 1 2004092308 No of Unique Users 3 Stack trace(Frame) nsSHEntry::GetChildAt [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp line 396] nsDocShell::LoadURI [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp line 662] nsFrameLoader::LoadFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsFrameLoader.cpp line 321] nsGenericHTMLFrameElement::LoadSrc [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp line 3541] SinkContext::OpenContainer [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp line 1279] HTMLContentSink::OpenContainer [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp line 3023] CNavDTD::HandleDefaultStartToken [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 1432] CNavDTD::HandleStartToken [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 1808] CNavDTD::HandleToken [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 992] CNavDTD::BuildModel [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp line 471] nsParser::BuildModel [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp line 1902] (944397) Comments: Clicked back-button using this page http://www.flexbeta.net/main/comments.php?catid=1&shownews=9443 ===================================================================== Count Offset Real Signature [ 1 nsSHEntry::GetChildAt() a9d90656 - nsSHEntry::GetChildAt() ] Crash date range: 22-SEP-04 to 22-SEP-04 Min/Max Seconds since last crash: 0 - 0 Min/Max Runtime: 0 - 0 Count Platform List 1 [Linux 2.6.8-1.521] Count Build Id List 1 2004092206 No of Unique Users 1 Stack trace(Frame) nsSHEntry::GetChildAt() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp line 396] nsDocShell::CloneAndReplace() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp line 704] nsDocShell::AddChildSHEntry() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp line 2380] nsDocShell::AddChildSHEntry() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp line 710] nsDocShell::DoAddChildSHEntry() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp line 710] nsDocShell::AddToSessionHistory() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp line 6358] nsDocShell::OnNewURI() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp line 1211] nsDocShell::OnLoadingSite() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp line 120] nsDocShell::CreateContentViewer() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp line 4518] nsDSURIContentListener::DoContent() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDSURIContentListener.cpp line 127] nsDocumentOpenInfo::TryContentListener() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp line 721] nsDocumentOpenInfo::DispatchContent() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp line 704] nsDocumentOpenInfo::OnStartRequest() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp line 321] nsHttpChannel::CallOnStartRequest() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp line 677] nsInputStreamPump::OnStateStart() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp line 383] nsInputStreamPump::OnInputStreamReady() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp line 342] nsInputStreamReadyEvent::EventHandler() PL_HandleEvent() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c line 693] PL_ProcessPendingEvents() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c line 627] nsEventQueueImpl::ProcessPendingEvents() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/nsEventQueue.cpp line 395] event_processor_callback() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp line 67] libglib-2.0.so.0 + 0x4921f (0x0018e21f) libglib-2.0.so.0 + 0x23e4a (0x00168e4a) libglib-2.0.so.0 + 0x24f28 (0x00169f28) libglib-2.0.so.0 + 0x25260 (0x0016a260) libglib-2.0.so.0 + 0x258a3 (0x0016a8a3) libgtk-x11-2.0.so.0 + 0x10ec33 (0x03ea3c33) nsAppShell::Run() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp line 144] nsAppShellService::Run() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp line 489] xre_main() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp line 692] main() [/builds/tinderbox/firefox/Linux_2.4.20-28.8_Clobber/mozilla/browser/app/nsBrowserApp.cpp line 60] libc.so.6 + 0x14ad4 (0x00b63ad4) (934548) URL: http://gmail.google.com/ (934548) Comments: loading gmail
Assigning to Darin since he fixed bug 260314...hopefully he can shed some light on these crashes.
Assignee: nobody → darin
Target Milestone: --- → mozilla1.8beta
Status: NEW → ASSIGNED
Attached patch v1 patch — — Splinter Review
Simple patch. The old code used NS_IF_ADDREF, and I naively thought I could do away with it. It turns out that AddChild permits the addition of NULL-valued "holes" in mChildren, so null checking mChildren[i] is a must. Thanks to biesi for spotting this.
Attachment #160577 - Flags: review?(cbiesinger)
Attachment #160577 - Flags: review?(cbiesinger) → review+
Attachment #160577 - Flags: superreview?(bzbarsky)
Comment on attachment 160577 [details] [diff] [review] v1 patch Doh. I should have caught that... we have to have the holes because otherwise timing issues would screw up framesets. sr=bzbarsky
Attachment #160577 - Flags: superreview?(bzbarsky) → superreview+
fixed-on-trunk
Status: ASSIGNED → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
*** Bug 262737 has been marked as a duplicate of this bug. ***
*** Bug 264327 has been marked as a duplicate of this bug. ***
*** Bug 214706 has been marked as a duplicate of this bug. ***
*** Bug 268232 has been marked as a duplicate of this bug. ***
Component: History: Session → Document Navigation
QA Contact: history.session → docshell
Crash Signature: [@ nsSHEntry::GetChildAt]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: