293787 - crash pressing reply in bugzilla [@ nsQueryInterface::operator - nsXULDocument::AttributeChanged]

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050511
Firefox/1.0+ ID:2005051108

required, have Adblock 0.5.2+ installed

repro:
1.open FF
2.Open a bugzilla bug and press reply for any of the posts
3.crash

this regressed between the:
20050510 11:08pdt (works) and 22:51pdt (fails) builds

checkins:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&filetype=match&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-05-10+10%3A29%3A00&maxdate=2005-05-10+22%3A12%3A00&cvsroot=%2Fcvsroot

(possible relation with Bug 293778 )

talkback TB5749989Z

reproducable on 3 different machines

Comment 1

[timeless]

Incident ID: 5749989
Stack Signature	0x00000009 cf68c0c4
Product ID	FirefoxTrunk
Build ID	2005051106
Trigger Time	2005-05-11 10:05:21.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	
URL visited	https://bugzilla.mozilla.org/show_bug.cgi?id=293778
User Comments	belongs to bug 293778 , press reply and crash
Since Last Crash	1708 sec
Total Uptime	1708 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x00000009
nsQueryInterface::operator() 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/build/nsCOMPtr.cpp,
line 52]
nsXULDocument::AttributeChanged 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1115]
nsXULElement::UnsetAttr 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 1756]
nsGenericElement::RemoveAttribute 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 1435]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2065]
XPC_WN_CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1320]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3611]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1340]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3611]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1340]
nsXPCWrappedJSClass::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsBrowserStatusFilter::OnLocationChange 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp,
line 231]
nsDocShell::SetCurrentURI 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 1377]
nsDocShell::OnNewURI 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 6913]
nsDocShell::InternalLoad 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 6028]
nsWebShell::OnLinkClickSync 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsWebShell.cpp,
line 552]
OnLinkClickEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsWebShell.cpp,
line 348]
PL_HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c,
line 699]
SETUPAPI.DLL + 0x30c24 (0x778b0c24)

Comment 2

[timeless]

bug 271669?

Comment 3

[Peter van der Woude [:Peter6]]

(In reply to comment #2)
> bug 271669?

Unlikely, this clearly regressed today
( see also bug 293778 )

Comment 4

[Radek 'sysKin' Czyz]

Ah, my yesterday's pet bug. Good to know I'm not alone.
I have more talkback IDs, and some are different. However this regressed in
exactly the same time frame so I'm quite sure it's the same bug.

I have get the following "classes" of crashes:
1. nsQueryInterface::operator() like here. Might crash directly (TB5763226X) or
after a jump to 0x0000000x (different x'es) (TB5744754H, TB5744241E)

2. js_LookupPropertyWithFlags - TB5746495E.

3, Many many: js_AllocStack, crashing when accessing a pointer which was just
allocated and null checked. TB5744727Y, TB5744629W, TB5742536Q

Additionaly I get something like TB5763894H (PL_DHashTableRawRemove) but it only
happened twice, always when *closing* a window/tab, so I'm not sure if it's just
a coincidence. This happened even after disabling adblock.

Firefox was rock stable before 20050510 for me.

Comment 5

[Oliver Saier]

I don't crash when pressing reply (as you can see) but I invariably crash when
reproducing bug 293778 (click any link in any newly opened window).
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050511
Firefox/1.0+
Adblock 0.5.2.039
(In reply to comment #0)
> Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050511
> Firefox/1.0+ ID:2005051108
> 
> required, have Adblock 0.5.2+ installed
> 
> repro:
> 1.open FF
> 2.Open a bugzilla bug and press reply for any of the posts
> 3.crash
> 
> this regressed between the:
> 20050510 11:08pdt (works) and 22:51pdt (fails) builds

Comment 6

[Ria Klaassen (not reading all bugmail)]

Yep, I see the same as comment #5 but only with a new profile.

Comment 7

[Ria Klaassen (not reading all bugmail)]

With Adblock enabled in my usual profile I'm also getting weird messages from a
confused bugzilla-server that I'm "trying to change the Severity field from
critical to major" or that "I'm posting exactly the same message like someone
else". Plain nonsense.

Comment 8

[Peter van der Woude [:Peter6]]

(In reply to comment #7)
> With Adblock enabled in my usual profile I'm also getting weird messages from a
> confused bugzilla-server that I'm "trying to change the Severity field from
> critical to major" or that "I'm posting exactly the same message like someone
> else". Plain nonsense.
This is most likely bug 293588 or one of its dependent bugs

Comment 9

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050514
Firefox/1.0+ ID:2005051401

WFM

(no more crashes) for
comment #0
or
bug 293778#c12

since Bug 293778 landed

Comment 10

[Chris]

(In reply to comment #9)
> Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050514
> Firefox/1.0+ ID:2005051401
> 
> WFM
> 
> (no more crashes) for
> comment #0
> or
> bug 293778#c12
> 
> since Bug 293778 landed

no problems here either
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050514
Firefox/1.0+

Comment 11

[Peter van der Woude [:Peter6]]

->WFM
everyone on forums went back to use Adblock and no additional crashes were reported