Closed Bug 290409 Opened 19 years ago Closed 15 years ago

crash at Yahoo chess when closing certain windows [@ Assertion::~Assertion][@ nsCheapStringSet::SetStr]

Categories

(Core :: Layout: Form Controls, defect)

1.7 Branch
x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED WORKSFORME

People

(Reporter: vinkev, Unassigned)

References

()

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2

n/a

Reproducible: Didn't try




incident ID : TB5097779H and TB5097775E

with the first incident, the url for said, "room window" is,
"http://games.yahoo.com/games/ante?room=chess_beg_k&prof_id=chat_pf_1&nosignedcab",
from what I can recall, these are static links; second incident when mentioning
"room window", the url for that is,
"http://games.yahoo.com/games/ante?room=chess_beg_d&prof_id=chat_pf_1&nosignedcab

Window XP's details on the crashes are, modname: ntdll.dll, version
5.1.2600.2180, offset: 000106c3; and, modname: unknown, ver: 0.0.0.0, offset
0c75ffc8

and for quirks, the details from Talkback and Windows XP can be found at,
"http://www3.telus.net/vinkev/talkback1.txt",
"http://www3.telus.net/vinkev/xp1.xml",
"http://www3.telus.net/vinkev/talkback2.txt", "http://www3.telus.net/vinkev/xp2.xml"

Java plugin version 1.5.0_02
Incident ID: 5097779
Stack Signature	ntdll.dll + 0x106c3 (0x7c9106c3) befdb61a
Product ID	Firefox10
Build ID	2005031717
Trigger Time	2005-04-14 17:35:36.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	ntdll.dll + (000106c3)
URL visited	http://games.yahoo.com/games/login2?page=ch&cat=beginner
User Comments	I was investigating a url of a Yahoo page from Yahoo chess because
of a previous crash which I had not send yet nor did I end that Firefox thread
which I should've done when Windows XP popped up that warning saying firefox.exe
encountered problem with
Since Last Crash	176 sec
Total Uptime	28032 sec
Trigger Reason	Access violation
Source File, Line No.	N/A

Stack Trace 	
ntdll.dll + 0x106c3 (0x7c9106c3)
msvcrt.dll + 0x1c3c9 (0x77c2c3c9)
msvcrt.dll + 0x1c3e7 (0x77c2c3e7)
msvcrt.dll + 0x19cd4 (0x77c29cd4)
nsCheapStringSet::SetStr 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpcom/build/../ds\nsCheapSets.h,
line 103]
nsHTMLSelectElement::SaveState 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsHTMLSelectElement.cpp,
line 1917]
nsGenericHTMLFormElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 3311]
nsGenericElement::SetDocumentInChildrenOf 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 1707]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericElement::SetDocumentInChildrenOf 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 1707]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
nsGenericHTMLElement::SetDocument 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1299]
DocumentViewerImpl::Close 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocumentViewer.cpp,
line 1158]
nsDocShell::Destroy 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 3328]
nsWebShell::Destroy 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/docshell/base/nsWebShell.cpp,
line 1231]
nsSubDocumentFrame::Destroy 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/document/src/nsFrameFrame.cpp,
line 568]
nsFrameList::DestroyFrames 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsBoxFrame::Destroy 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1065]
nsFrameList::DestroyFrame 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/base/src/nsFrameList.cpp,
line 214]
nsFrameManager::RemoveFrame 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsFrameManager.cpp,
line 757]
nsCSSFrameConstructor::ContentRemoved 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9535]
PresShell::ContentRemoved 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5278]
nsGenericElement::doRemoveChild 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 3122]
nsXULElement::RemoveChild 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 853]
XPCWrappedNative::CallMethod 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2034]
XPC_WN_CallMethod 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 949]
js_Interpret 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 2993]
js_Invoke 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 966]
js_InternalInvoke 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 1043]
JS_CallFunctionValue 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsapi.c,
line 3698]
nsJSContext::CallEventHandler 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1297]
nsJSEventListener::HandleEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1436]
nsEventListenerManager::HandleEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1516]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2841]
PresShell::HandleDOMEventWithTarget 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6139]
nsButtonBoxFrame::MouseClicked 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp,
line 178]
nsButtonBoxFrame::HandleEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp,
line 147]
PresShell::HandleEventInternal 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6103]
PresShell::HandleEventWithTarget 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5984]
nsEventStateManager::CheckForAndDispatchClick 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2985]
nsEventStateManager::PostHandleEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 1973]
PresShell::HandleEventInternal 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6111]
PresShell::HandleEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5921]
nsViewManager::HandleEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2326]
nsViewManager::DispatchEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2066]
HandleEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp,
line 77]
nsWindow::DispatchEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0x89a5 (0x77d489a5)
USER32.dll + 0x89e8 (0x77d489e8)
nsAppShell::Run 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]


Incident ID: 5097775
Stack Signature	0x0c75ffc8 38dddee1
Product ID	Firefox10
Build ID	2005031717
Trigger Time	2005-04-14 17:30:07.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	http://games.yahoo.com/games/login2?page=ch&cat=beginner
User Comments	I closed a Yahoo chess room window that displays the players then
I proceded to close the windows displaying the rooms listing,
"http://games.yahoo.com/games/login2?page=ch&cat=beginner".
Since Last Crash	27856 sec
Total Uptime	27856 sec
Trigger Reason	Access violation
Source File, Line No.	N/A

Stack Trace
0x0c75ffc8
Assertion::~Assertion 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/rdf/base/src/nsInMemoryDataSource.cpp,
line 249]
InMemoryDataSource::~InMemoryDataSource 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/rdf/base/src/nsInMemoryDataSource.cpp,
line 945]
nsComponentManagerImpl::FreeServices 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpcom/components/nsComponentManager.cpp,
line 2060]
ScopedXPCOMStartup::~ScopedXPCOMStartup 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 784]
main 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)
Keywords: crash
I don't know where it belongs, but certainly not in Extension manager component.
->General
Assignee: bugs → firefox
Component: Extension/Theme Manager → General
QA Contact: bugs → general
Assignee: firefox → nobody
Component: General → Layout: Form Controls
Product: Firefox → Core
QA Contact: general → layout.form-controls
Summary: crash at Yahoo chess when closing certain windows → crash at Yahoo chess when closing certain windows [@ Assertion::~Assertion][@ nsCheapStringSet::SetStr]
Version: unspecified → 1.7 Branch
Is this a problem on trunk?
This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/
I think some of these are still causing problems on FF2 branch:
https://bugzilla.mozilla.org/buglist.cgi?query_format=&long_desc_type=substring&long_desc=0x77c29cd4

Related TB search signature: 0x7c911f6c

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20060926 BonEcho/2.0

The way to reproduce Yahoo crash is to open a few Yahoo email messages in different tabs, and then close some of them. Continue browsing using new tab(s). FF will crash sooner or later.

Extensions:
Adblock Plus 0.7.1.2
Diggler 0.9
DOM Inspector 1.8.1
Gmail Manager 0.5.2
IE View 1.3.0
Image Zoom 0.2.6
MediaPlayerConnectivity 0.7.3
Nightly Tester Tools 1.0.4
Talkback 2.0
Update Channel Selector 1.0.1
Is this crash still reproducible in Firefox 3.5?  If it isn't, we should resolve it as RESOLVED WORKSFORME.
In communicating with Canh, the bug reporter, the issue hasn't been seen again, so I am resolving and verifying as Worksforme.  If the issue resurfaces, we will reopen the bug.
Status: UNCONFIRMED → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
Status: RESOLVED → VERIFIED
Crash Signature: [@ Assertion::~Assertion] [@ nsCheapStringSet::SetStr]
You need to log in before you can comment on or make changes to this bug.