285579 - Firefox Trunk crash in Gmail [@ 0x0??????? - XPCWrappedNativeTearOff::JSObjectFinalized]

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Pavel Penaz]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050309 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050309 Firefox/1.0+

I crashed four times in 5 minutes, every time when I tried to forward email in
GMail and started writing in the message window of the email to be forwarded.

Talkback IDs: TB4246345Q, TB4246223M, TB4246148K, TB4243151E



Reproducible: Couldn't Reproduce

Comment 1

[Pavel Penaz]

Steps to reproduce:

1. Login to Gmail
2. Click Compose mail
3. Start clicking with your left mouse button in the To: address field. If
Firefox does not crach than click also a few times in the message window input
field. After few clicks Firefox crashes.. This happens every time, only the
number of clicks needed to trigger this crash differs from case to case.

Other talkback IDs: TB4246940K, TB4246989E, TB4246990Y, TB4246993H, TB4246996Q,
TB4246998G, TB4247004X

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050310
Firefox/1.0+

Comment 2

[Peter van der Woude [:Peter6]]

->NEW
->regr

Comment 3

[OstGote!]

Incident ID: 4246940
Stack Signature	 0x0295fc13 2269a000
Product ID	FirefoxTrunk
Build ID	2005030906
Trigger Time	2005-03-10 05:32:09.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	
User Comments	
Since Last Crash	1843 sec
Total Uptime	14335 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x0295fc13
XPCWrappedNativeTearOff::JSObjectFinalized 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcprivate.h,
line 1687]
XPCConvert::JSData2Native 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcconvert.cpp,
line 974]
nsXPConnect::WrapNative 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/nsXPConnect.cpp,
line 561]
nsScrollPortView::SmoothScrollAnimationCallback 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsScrollPortView.cpp,
line 687]
nsEventListenerManager::RemoveScriptEventListener 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1283]
nsEventListenerManager::CompileEventHandlerInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1414]
nsGenericElement::Normalize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 1749]
nsHTMLTableRowElement::GetCells 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/html/content/src/nsHTMLTableRowElement.cpp,
line 281]
nsEventStateManager::GetNextTabbableContent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 3432]
nsEventStateManager::ShiftFocusInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 3129]
nsImageLoader::FrameChanged 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsImageLoader.cpp,
line 227]
nsEventStateManager::PostHandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 1905]
nsEventStateManager::ChangeTextSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 1554]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5940]
PresShell::PushCurrentEventInfo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5608]
SortByZOrder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1192]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1929]
nsLayoutUtils::DoCompareTreePosition 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsLayoutUtils.cpp,
line 271]
nsWindow::~nsWindow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 899]
nsWindow::OnResize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5313]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5560]
nsWindow::DealWithPopups 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1272]
USER32.dll + 0x8709 (0x77d38709)
USER32.dll + 0x87eb (0x77d387eb)
USER32.dll + 0x89a5 (0x77d389a5)
USER32.dll + 0x89e8 (0x77d389e8)
nsBidiKeyboard::EnumerateKeyboards 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsBidiKeyboard.cpp,
line 147]
nsClassHashtable<nsCStringHashKey,nsPasswordManager::SignonHashEntry>::Get 
[../../../../dist/include/xpcom/nsClassHashtable.h, line 106]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 4

[Ryan VanderMeulen [:RyanVM]]

The patch from Bug 285000 appears to fix this issue (at least, I can't reproduce
it when I manually apply that to the source and make a build).  It doesn't fix
Bug 285546, though :(

Comment 5

[Frederic Bezies]

Confirming with a 1 hour old CVS based trunk homemade build under MacOSX 10.3.8.

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050311
Firefox/1.0+

It is really a PITA bug :(

Anybody with linux to move os from WindowsXP -> All ?

Comment 6

[Peter van der Woude [:Peter6]]

I'm unable to reproduce this once since the patch for bug 285546 has landed

Comment 7

[Pavel Penaz]

marking as dependant on bug 285546, resolution -> WFM

Comment 8

[R.K.Aa.]

*** Bug 285736 has been marked as a duplicate of this bug. ***