280456 - crash at start or exit [@nsGenericElement::GetOwnerDoc ]

Status: RESOLVED FIXED

(SeaMonkey :: General, defect)

Description

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050130

BuildID 2005012805 was wfm, 2005012906 was showing the regression.

15 talkbacks from different people:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsGenericElement%3A%3AGetOwnerDoc&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

mine: 
Suite crash at start: TB3385943E, at exit: TB3385561E, TB3374255H (identical)
Firefox at start may be another bug: TB3388116  nsXTFService::CreateElement 

Maybe related:
Bug 280341 crash at startup [@ nsCOMArray_base::~nsCOMArray_base]
has three identical talkbacks but different from these here. They tell the
regression was first seen 2005012822.



http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3385943E
nsGenericElement::GetOwnerDoc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.h,
line 379]
nsCSSFrameConstructor::ProcessChildren 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 11918]
nsCSSFrameConstructor::ConstructDocElementFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 4209]
nsCSSFrameConstructor::ContentInserted 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9174]
PresShell::InitialReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 2727]
nsContentSink::StartLayout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsContentSink.cpp,
line 955]
HTMLContentSink::StartLayout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 3643]
CNavDTD::HandleDefaultStartToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 1284]
CNavDTD::HandleStartToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 1643]
CNavDTD::HandleToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 904]
CNavDTD::BuildModel 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 461]
nsParser::BuildModel 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp,
line 2047]

crash at exit:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3385561E
nsGenericElement::GetOwnerDoc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.h,
line 379]
DocumentViewerImpl::Close 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsDocumentViewer.cpp,
line 1119]
nsDocShell::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 3336]
nsXULWindow::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 489]
nsWebShellWindow::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 1583]
nsWebShellWindow::Close 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 330]
nsAppStartup::Quit 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 359]
nsAppStartup::Observe 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 943]
nsObserverService::NotifyObservers 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/ds/nsObserverService.cpp,
line 235]
nsXULWindow::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsXULWindow.cpp,
line 530]
nsWebShellWindow::Destroy 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 1583]
nsWebShellWindow::Close 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsWebShellWindow.cpp,
line 330]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1103]
nsWindow::DispatchStandardEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1143]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3866]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1389]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)

Comment 1

[Hermann Schwab]

http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&root=/cvsroot&subdir=/mozilla/content/base/src&command=DIFF_FRAMESET&file=nsGenericElement.h&rev2=3.148&rev1=3.147
363                  nsIDocument *GetOwnerDoc() const
364                  {
365 peterv   3.148     return nsContentUtils::GetDocument(mNodeInfo);
366 peterv   3.147   }

http://lxr.mozilla.org/mozilla/source/content/base/src/nsContentUtils.cpp#894
894 nsIDOMDocument *
895 nsContentUtils::GetDocumentFromCaller()
896 {
897   if (!sThreadJSContextStack) {
898     return nsnull;
899   }
900 
901   JSContext *cx = nsnull;
902   sThreadJSContextStack->Peek(&cx);
903 
904   nsCOMPtr<nsIDOMDocument> doc;
905 
906   if (cx) {
907     nsIScriptGlobalObject *sgo = nsJSUtils::GetDynamicScriptGlobal(cx);
908 
909     nsCOMPtr<nsIDOMWindowInternal> win(do_QueryInterface(sgo));
910     if (win) {
911       win->GetDocument(getter_AddRefs(doc));
912     }
913   }
914 
915   // This will return a pointer to something we're about to release,
916   // but that's ok here.
917   return doc;
918 }

Seems not to be ok anymore

Comment 2

[Hermann Schwab]

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3397726Q

nsNodeInfo::LastRelease 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsNodeInfo.cpp,
line 297]
nsEventStateManager::`scalar deleting destructor'

and same lines plus some more from some other guy:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=3394168#id

Comment 3

[Boris Zbarsky [:bzbarsky]]

See bug 278443 comment 10 

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Bug 278443 was backed out. Can you still see the crash?

Comment 5

[Hermann Schwab]

(In reply to comment #4)
> Bug 278443 was backed out. Can you still see the crash?

Backout was after the regular nightly build. I´m using now Tinderbox Build
2005013109 and don´t see the bug, I still saw with the nightly 2005013106 or so.
I´ll resolve the bug when next two nightlies don´t show the bug, I don´t want to
test on this slow machine starting and exiting and nothing inbetween.
I didn´t see the bug at work using an AthlonXP1600 + 512MB RAM + Win98SE, but I
didn´t do extensive testing.

Comment 6

[R.K.Aa.]

also see bug 280427

Comment 7

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050201

Seems to be fixed by back out of Bug 278443.

Comment 8

[Hermann Schwab]

*** Bug 280457 has been marked as a duplicate of this bug. ***

Comment 9

[R.K.Aa.]

*** Bug 280427 has been marked as a duplicate of this bug. ***