Closed Bug 285579 Opened 17 years ago Closed 17 years ago

Firefox Trunk crash in Gmail [@ 0x0??????? - XPCWrappedNativeTearOff::JSObjectFinalized]

Categories

(Core :: XPConnect, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: pavel.penaz, Assigned: bryner)

References

Details

(Keywords: crash, regression)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050309 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050309 Firefox/1.0+

I crashed four times in 5 minutes, every time when I tried to forward email in
GMail and started writing in the message window of the email to be forwarded.

Talkback IDs: TB4246345Q, TB4246223M, TB4246148K, TB4243151E



Reproducible: Couldn't Reproduce
Steps to reproduce:

1. Login to Gmail
2. Click Compose mail
3. Start clicking with your left mouse button in the To: address field. If
Firefox does not crach than click also a few times in the message window input
field. After few clicks Firefox crashes.. This happens every time, only the
number of clicks needed to trigger this crash differs from case to case.

Other talkback IDs: TB4246940K, TB4246989E, TB4246990Y, TB4246993H, TB4246996Q,
TB4246998G, TB4247004X

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050310
Firefox/1.0+
->NEW
->regr
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: regression
Keywords: crash
Assignee: firefox → bryner
Component: General → XPConnect
Product: Firefox → Core
Incident ID: 4246940
Stack Signature	 0x0295fc13 2269a000
Product ID	FirefoxTrunk
Build ID	2005030906
Trigger Time	2005-03-10 05:32:09.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	
User Comments	
Since Last Crash	1843 sec
Total Uptime	14335 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x0295fc13
XPCWrappedNativeTearOff::JSObjectFinalized 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcprivate.h,
line 1687]
XPCConvert::JSData2Native 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcconvert.cpp,
line 974]
nsXPConnect::WrapNative 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/nsXPConnect.cpp,
line 561]
nsScrollPortView::SmoothScrollAnimationCallback 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsScrollPortView.cpp,
line 687]
nsEventListenerManager::RemoveScriptEventListener 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1283]
nsEventListenerManager::CompileEventHandlerInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1414]
nsGenericElement::Normalize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 1749]
nsHTMLTableRowElement::GetCells 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/html/content/src/nsHTMLTableRowElement.cpp,
line 281]
nsEventStateManager::GetNextTabbableContent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 3432]
nsEventStateManager::ShiftFocusInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 3129]
nsImageLoader::FrameChanged 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsImageLoader.cpp,
line 227]
nsEventStateManager::PostHandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 1905]
nsEventStateManager::ChangeTextSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 1554]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5940]
PresShell::PushCurrentEventInfo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5608]
SortByZOrder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1192]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1929]
nsLayoutUtils::DoCompareTreePosition 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsLayoutUtils.cpp,
line 271]
nsWindow::~nsWindow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 899]
nsWindow::OnResize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5313]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5560]
nsWindow::DealWithPopups 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1272]
USER32.dll + 0x8709 (0x77d38709)
USER32.dll + 0x87eb (0x77d387eb)
USER32.dll + 0x89a5 (0x77d389a5)
USER32.dll + 0x89e8 (0x77d389e8)
nsBidiKeyboard::EnumerateKeyboards 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsBidiKeyboard.cpp,
line 147]
nsClassHashtable<nsCStringHashKey,nsPasswordManager::SignonHashEntry>::Get 
[../../../../dist/include/xpcom/nsClassHashtable.h, line 106]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x16d4f (0x7c816d4f)
Summary: Firefox Trunk crash in Gmail : XPCWrappedNativeTearOff::JSObjectFinalized → Firefox Trunk crash in Gmail [@ 0x0??????? - XPCWrappedNativeTearOff::JSObjectFinalized]
The patch from Bug 285000 appears to fix this issue (at least, I can't reproduce
it when I manually apply that to the source and make a build).  It doesn't fix
Bug 285546, though :(
Confirming with a 1 hour old CVS based trunk homemade build under MacOSX 10.3.8.

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050311
Firefox/1.0+

It is really a PITA bug :(

Anybody with linux to move os from WindowsXP -> All ?
Flags: blocking-aviary1.1?
I'm unable to reproduce this once since the patch for bug 285546 has landed
marking as dependant on bug 285546, resolution -> WFM
Status: NEW → RESOLVED
Closed: 17 years ago
Depends on: 285546
Resolution: --- → WORKSFORME
*** Bug 285736 has been marked as a duplicate of this bug. ***
Flags: blocking-aviary1.1?
Crash Signature: [@ 0x0??????? - XPCWrappedNativeTearOff::JSObjectFinalized]
You need to log in before you can comment on or make changes to this bug.