26276 - Random SMP crash.

Status: VERIFIED WORKSFORME

(SeaMonkey :: General, defect, P3)

Description

[e75644]

This problem seems similiar to the bug 21556 entry. I'm running SMP machine with 
NT 4.0 SP 6a too, so it's possible the problems are related. Not tried 
reproducing yet. After filling out a text-box element in a form, I tried to 
select a bit of the text using mouse. First of all, the selection area didn't 
work properly, but jumped "off" when I tried to mark more than one line. I tried 
this agains everal times, and after some wedging around with the mouse, the 
browser crashed:

nsStreamListenerEvent::~nsStreamListenerEvent() line 76 + 24 bytes
nsOnStopRequestEvent::~nsOnStopRequestEvent() line 258
nsOnStopRequestEvent::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsStreamListenerEvent::DestroyPLEvent(PLEvent * 0x03ba6c10) line 104 + 30 bytes
PL_DestroyEvent(PLEvent * 0x03ba6c10) line 549 + 10 bytes
PL_HandleEvent(PLEvent * 0x03ba6c10) line 536 + 9 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00fd4e10) line 487 + 9 bytes
_md_EventReceiverProc(void * 0x0098050c, unsigned int 49535, unsigned int 0, 
long 16600592) line 975 + 9 bytes
USER32! 77e7124c()

Destructor code is:
nsStreamListenerEvent::~nsStreamListenerEvent()
{
    NS_IF_RELEASE(mListener);
    NS_IF_RELEASE(mChannel);
    NS_IF_RELEASE(mContext);

    if (nsnull != mEvent)
    {
        delete mEvent;
        mEvent = nsnull;
    }
}

Crash occurs (assuming no code replacements by optimization) on 
NS_IF_RELEASE(mChannel). At this point of execution, both mListenerand mContext 
are NULL, but mChannel->nsIRequest->nsISupports->__vfptr is 0xdddddddd. "this" 
is otherwise valid.

Comment 1

[e75644]

I haven't been able to reproduce this bug after some trying on different 
text-fields. In fact even the text-selection by mouse works fine, but the 
selection-problem does occur when using keyboard. I guess it's possible I was 
using keyboard to try to mark the text at least at some point. However, I'm 
unable to reproduce the crash this way either. Bug 26295 occurs on the site I 
encountered this bug on, andis reproducible, so it's possible they're related.

Comment 2

[Asa Dotzler [:asa]]

mailto:[e-mail] if you are still unable to reproduce this crash go ahead 
and mark it Resolved WORKSFORME.  If you can reproduce this crash then please 
include the build ID so we can attempt to verify. 

Comment 3

[e75644]

Haven't been able to reproduce on the same code or the recent builds since that. 
I'm going to assume it was some kind of side-effect from 26295. Unless otherwise 
noted, my bugs refer to recent CVS-pulls, ofcourse that's hard to tell... Filed 
the arrow-key marking problem under bug 26390 since the actual subject of the 
bug has changed.

Comment 4

[cbegle]

*** Bug 26436 has been marked as a duplicate of this bug. ***

Comment 5

[e75644]

Leaving this marked WORKSFORME because I haven't seen it happen with the latest 
builds yet. The original WORKSFORME designation was intendedto indicate the bug 
description was incorrect, as the crash turned out to have been a random SMP 
thing as noted in bug 26436. The marking problems mentioned in the bug 
description have been fixed.

Comment 6

[leger]

Marking Verified per last comment.