296375 - document.addBinding() segfaults called on a node with existing binding

Reporter

Description

•

20 years ago

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050523 Firefox/1.0+
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050523 Firefox/1.0+

This bug due to the request in
https://bugzilla.mozilla.org/show_bug.cgi?id=51261#c23.

Calling document.addBinding() produces a segmentation fault.

Completely fresh checkout: checkout start: Thu Jun 2 10:21:53 CEST 2005


Stacktrace (non-blank-line numbered for your convenience):

     1	(gdb) thread apply all bt

     2	Thread 6 (Thread 108567472 (LWP 10176)):
     3	#0  0x00b22d19 in __lll_mutex_lock_wait () from /lib/tls/libc.so.6
     4	#1  0x00aae1b4 in _L_mutex_lock_2570 () from /lib/tls/libc.so.6
     5	#2  0x0052eaf0 in __JCR_LIST__ () from
firefox-devbuild/dist/bin/libxpcom_core.so
     6	#3  0x06789868 in ?? ()
     7	#4  0x00a33034 in ?? () from /usr/lib/libstdc++.so.5
     8	#5  0x0a0291d8 in ?? ()
     9	#6  0x06789ac0 in ?? ()
    10	#7  0x06789868 in ?? ()
    11	#8  0x00a10233 in operator delete () from /usr/lib/libstdc++.so.5
    12	#9  0x00a10233 in operator delete () from /usr/lib/libstdc++.so.5
    13	#10 0x004ac47d in nsStringInputStream::Release (this=0xb6beacd8) at
/tmp/awuest/trees/statustext/mozilla/xpcom/io/nsStringStream.cpp:142
    14	#11 0x00fe1f73 in nsCOMPtr<nsIInputStream>::assign_assuming_AddRef
(this=0xb6bea914, newPtr=0x0) at ../../../dist/include/xpcom/nsCOMPtr.h:568
    15	#12 0x00fe1b76 in nsCOMPtr<nsIInputStream>::assign_with_AddRef
(this=0xb6bea914, rawPtr=0x0) at ../../../../dist/include/xpcom/nsCOMPtr.h:1224
    16	#13 0x00fe175f in nsCOMPtr<nsIInputStream>::operator= (this=0xb6bea914,
rhs=0x0) at ../../../../dist/include/xpcom/nsCOMPtr.h:713
    17	#14 0x010a97ec in nsHttpTransaction::Close (this=0xb6bea8d8, reason=0) at
/tmp/awuest/trees/statustext/mozilla/netwerk/protocol/http/src/nsHttpTransaction.cpp:532
    18	#15 0x0109b606 in nsHttpConnection::CloseTransaction (this=0xb6beaf38,
trans=0xb6bea8d8, reason=0)
    19	    at
/tmp/awuest/trees/statustext/mozilla/netwerk/protocol/http/src/nsHttpConnection.cpp:485
    20	#16 0x0109c28d in nsHttpConnection::OnInputStreamReady (this=0xb6beaf38,
in=0xb6f72224)
    21	    at
/tmp/awuest/trees/statustext/mozilla/netwerk/protocol/http/src/nsHttpConnection.cpp:749
    22	#17 0x0101ae26 in nsSocketInputStream::OnSocketReady (this=0xb6f72224,
condition=0) at
/tmp/awuest/trees/statustext/mozilla/netwerk/base/src/nsSocketTransport2.cpp:240
    23	#18 0x0101eade in nsSocketTransport::OnSocketReady (this=0xb6f72140,
fd=0xb6bd0680, outFlags=1)
    24	    at
/tmp/awuest/trees/statustext/mozilla/netwerk/base/src/nsSocketTransport2.cpp:1453
    25	#19 0x0102340e in nsSocketTransportService::Run (this=0xa01c020) at
/tmp/awuest/trees/statustext/mozilla/netwerk/base/src/nsSocketTransportService2.cpp:573
    26	#20 0x004d33e2 in nsThread::Main (arg=0xa029158) at
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsThread.cpp:118
    27	#21 0x00141796 in _pt_root (arg=0xa0291d8) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/pthreads/ptthread.c:220
    28	#22 0x00c0fde8 in start_thread () from /lib/tls/libpthread.so.0
    29	#23 0x00b1593a in clone () from /lib/tls/libc.so.6

    30	Thread 5 (Thread 181783472 (LWP 10178)):
    31	#0  0x00b22d19 in __lll_mutex_lock_wait () from /lib/tls/libc.so.6
    32	#1  0x00aae1b4 in _L_mutex_lock_2570 () from /lib/tls/libc.so.6
    33	#2  0x00150368 in __JCR_LIST__ () from firefox-devbuild/dist/bin/libnspr4.so
    34	#3  0x0ad5cc08 in ?? ()
    35	#4  0x00150368 in __JCR_LIST__ () from firefox-devbuild/dist/bin/libnspr4.so
    36	#5  0x00000001 in ?? ()
    37	#6  0x0ad5cc08 in ?? ()
    38	#7  0x0ad5ca48 in ?? ()
    39	#8  0x00128ae0 in PR_Free (ptr=0xa343bc8) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/malloc/prmem.c:477
    40	#9  0x00128ae0 in PR_Free (ptr=0xa343bc8) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/malloc/prmem.c:477
    41	#10 0x001426dc in _pt_thread_death (arg=0xa343a58) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/pthreads/ptthread.c:816
    42	#11 0x00c106a9 in deallocate_tsd () from /lib/tls/libpthread.so.0
    43	#12 0x00c0fdf6 in start_thread () from /lib/tls/libpthread.so.0
    44	#13 0x00b1593a in clone () from /lib/tls/libc.so.6

    45	Thread 4 (Thread 192273328 (LWP 10179)):
    46	#0  0x00c1245b in pthread_cond_timedwait@@GLIBC_2.3.2 () from
/lib/tls/libpthread.so.0
    47	#1  0x00139d24 in pt_TimedWait (cv=0x9f9bbb4, ml=0x9f9cca0,
timeout=838199) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/pthreads/ptsynch.c:280
    48	#2  0x0013a23b in PR_WaitCondVar (cvar=0x9f9bbb0, timeout=838199) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/pthreads/ptsynch.c:407
    49	#3  0x004d792b in TimerThread::Run (this=0x9f9be10) at
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/TimerThread.cpp:318
    50	#4  0x004d33e2 in nsThread::Main (arg=0xa343eb8) at
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsThread.cpp:118
    51	#5  0x00141796 in _pt_root (arg=0xa345020) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/pthreads/ptthread.c:220
    52	#6  0x00c0fde8 in start_thread () from /lib/tls/libpthread.so.0
    53	#7  0x00b1593a in clone () from /lib/tls/libc.so.6

    54	Thread 3 (Thread 202763184 (LWP 10181)):
    55	#0  0x00b22d19 in __lll_mutex_lock_wait () from /lib/tls/libc.so.6
    56	---Type <return> to continue, or q <return> to quit---
    57	#1  0x00aae1b4 in _L_mutex_lock_2570 () from /lib/tls/libc.so.6
    58	#2  0x0000ea61 in ?? ()
    59	#3  0x0c15ec08 in ?? ()
    60	#4  0x00150368 in __JCR_LIST__ () from firefox-devbuild/dist/bin/libnspr4.so
    61	#5  0x00000001 in ?? ()
    62	#6  0x0c15ec08 in ?? ()
    63	#7  0x0c15ea48 in ?? ()
    64	#8  0x00128ae0 in PR_Free (ptr=0xb73d1d00) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/malloc/prmem.c:477
    65	#9  0x00128ae0 in PR_Free (ptr=0xb73d1d00) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/malloc/prmem.c:477
    66	#10 0x001426dc in _pt_thread_death (arg=0xb73ad568) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/pthreads/ptthread.c:816
    67	#11 0x00c106a9 in deallocate_tsd () from /lib/tls/libpthread.so.0
    68	#12 0x00c0fdf6 in start_thread () from /lib/tls/libpthread.so.0
    69	#13 0x00b1593a in clone () from /lib/tls/libc.so.6

    70	Thread 2 (Thread 213253040 (LWP 10183)):
    71	#0  0x00b22d19 in __lll_mutex_lock_wait () from /lib/tls/libc.so.6
    72	#1  0x00aae1b4 in _L_mutex_lock_2570 () from /lib/tls/libc.so.6
    73	#2  0x01106938 in __JCR_LIST__ () from
/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libnecko.so
    74	#3  0x0cb5fc08 in ?? ()
    75	#4  0x00150368 in __JCR_LIST__ () from firefox-devbuild/dist/bin/libnspr4.so
    76	#5  0x00000001 in ?? ()
    77	#6  0x0cb5fc08 in ?? ()
    78	#7  0x0cb5fa48 in ?? ()
    79	#8  0x00128ae0 in PR_Free (ptr=0xb6bcea40) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/malloc/prmem.c:477
    80	#9  0x00128ae0 in PR_Free (ptr=0xb6bcea40) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/malloc/prmem.c:477
    81	#10 0x001426dc in _pt_thread_death (arg=0xb6bce8b8) at
/tmp/awuest/trees/statustext/mozilla/nsprpub/pr/src/pthreads/ptthread.c:816
    82	#11 0x00c106a9 in deallocate_tsd () from /lib/tls/libpthread.so.0
    83	#12 0x00c0fdf6 in start_thread () from /lib/tls/libpthread.so.0
    84	#13 0x00b1593a in clone () from /lib/tls/libc.so.6

    85	Thread 1 (Thread -1218583904 (LWP 10159)):
    86	#0  0x00ae283c in __nanosleep_nocancel () from /lib/tls/libc.so.6
    87	#1  0x00ae265f in sleep () from /lib/tls/libc.so.6
    88	#2  0x0806945d in ah_crap_handler (signum=11) at nsSigHandlers.cpp:132
    89	#3  0x08069f79 in nsProfileLock::FatalSignalHandler (signo=11) at
nsProfileLock.cpp:209
    90	#4  <signal handler called>
    91	#5  0x00aab2f0 in malloc_consolidate () from /lib/tls/libc.so.6
    92	#6  0x00aab1cd in _int_free () from /lib/tls/libc.so.6
    93	#7  0x00aaa048 in free () from /lib/tls/libc.so.6
    94	#8  0x08069a46 in DemangleSymbol (aSymbol=0x11ddec7
"_ZN8nsCOMPtrI13nsIDOMElementE14assign_from_qiE16nsQueryInterfaceRK4nsID",
    95	    aBuffer=0xbfff4624
"nsCOMPtr<nsIDOMElement>::assign_from_qi(nsQueryInterface, nsID const&)",
aBufLen=4096) at nsStackFrameUnix.cpp:80
    96	#9  0x08069bb5 in DumpStackToFile (aStream=0xb6bca0) at
nsStackFrameUnix.cpp:129
    97	#10 0x08069416 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:125
    98	#11 0x08069f79 in nsProfileLock::FatalSignalHandler (signo=11) at
nsProfileLock.cpp:209
    99	#12 <signal handler called>
   100	#13 0x53e58955 in ?? ()
   101	#14 0x00450e6c in nsQueryInterface::operator() (this=0xbfff5b04,
aIID=@0x1938e14, answer=0xbfff5af0) at nsCOMPtr.cpp:47
   102	#15 0x0140f363 in nsCOMPtr<nsIDOMElement>::assign_from_qi
(this=0xbfff5b40, qi={mRawPtr = 0x52b008}, aIID=@0x1938e14) at
../../../dist/include/xpcom/nsCOMPtr.h:1232
   103	#16 0x0140d18d in nsCOMPtr (this=0xbfff5b40, qi={mRawPtr = 0x52b008}) at
../../../../dist/include/xpcom/nsCOMPtr.h:645
   104	#17 0x017fc468 in nsXBLBinding::GetAnonymousNodes (this=0xb6be6468) at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsXBLBinding.cpp:1271
   105	#18 0x017f8f32 in BuildContentLists (aKey=0xb6bf1780, aData=0xb6bf1770,
aClosure=0xbfff5e30) at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsXBLBinding.cpp:303
   106	#19 0x004647fe in hashEnumerate (table=0xb6be64f0, hdr=0xb6bf1b2c, i=0,
arg=0xbfff5ce0) at /tmp/awuest/trees/statustext/mozilla/xpcom/ds/nsHashtable.cpp:131
   107	#20 0x0045d35f in PL_DHashTableEnumerate (table=0xb6be64f0, etor=0x4647d0
<hashEnumerate>, arg=0xbfff5ce0) at
/tmp/awuest/trees/statustext/mozilla/xpcom/ds/pldhash.c:619
   108	#21 0x00465119 in nsHashtable::Enumerate (this=0xb6be64e8,
aEnumFunc=0x17f8e2e <BuildContentLists>, aClosure=0xbfff5e30)
   109	    at /tmp/awuest/trees/statustext/mozilla/xpcom/ds/nsHashtable.cpp:319
   110	#22 0x017f9d18 in nsXBLBinding::GenerateAnonymousContent
(this=0xb6be6468) at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsXBLBinding.cpp:527
   111	#23 0x017f975e in nsXBLBinding::GenerateAnonymousContent
(this=0xb6bf1718) at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsXBLBinding.cpp:437
   112	#24 0x01815b63 in nsXBLService::LoadBindings (this=0xb7323128,
aContent=0xb6beb470, aURL=0xb6bf19b8, aAugmentFlag=1, aBinding=0xbfff65c0,
aResolveStyle=0xbfff65bc)
   113	---Type <return> to continue, or q <return> to quit---
   114	    at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsXBLService.cpp:636
   115	#25 0x0181ac6c in nsBindingManager::AddLayeredBinding (this=0xb7387258,
aContent=0xb6beb470, aURL=0xb6bf19b8)
   116	    at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsBindingManager.cpp:630
   117	#26 0x016b5af2 in nsDocument::AddBinding (this=0xb732e6f8,
aContent=0xb6beb48c, aURI=@0xb6bf1698) at
/tmp/awuest/trees/statustext/mozilla/content/base/src/nsDocument.cpp:2730
   118	#27 0x004fb651 in XPTC_InvokeByIndex () at
/tmp/awuest/trees/statustext/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
   119	#28 0x00cddaac in XPCWrappedNative::CallMethod (ccx=@0xbfff694c,
mode=CALL_METHOD) at
/tmp/awuest/trees/statustext/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2104
   120	#29 0x00ce7d6b in XPC_WN_CallMethod (cx=0xb734ff68, obj=0xb73bfed8,
argc=2, argv=0xb6bd7140, vp=0xbfff6afc)
   121	    at
/tmp/awuest/trees/statustext/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1348
   122	#30 0x002d0b7f in js_Invoke (cx=0xb734ff68, argc=2, flags=0) at
/tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:1178
   123	#31 0x002e03df in js_Interpret (cx=0xb734ff68, pc=0xa21907d ":",
result=0xbfff7238) at /tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:3468
   124	#32 0x002d0c08 in js_Invoke (cx=0xb734ff68, argc=0, flags=2) at
/tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:1198
   125	#33 0x002d0fb9 in js_InternalInvoke (cx=0xb734ff68, obj=0xb6d18b40,
fval=-1227780280, flags=0, argc=0, argv=0x0, rval=0xbfff73dc)
   126	    at /tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:1275
   127	#34 0x0029d2a2 in JS_CallFunctionValue (cx=0xb734ff68, obj=0xb6d18b40,
fval=-1227780280, argc=0, argv=0x0, rval=0xbfff73dc)
   128	    at /tmp/awuest/trees/statustext/mozilla/js/src/jsapi.c:3858
   129	#35 0x0180ad92 in nsXBLProtoImplAnonymousMethod::Execute
(this=0xb703e9a0, aBoundElement=0xb6beb470)
   130	    at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsXBLProtoImplMethod.cpp:333
   131	#36 0x017fd824 in nsXBLPrototypeBinding::BindingAttached
(this=0xb703e788, aBoundElement=0xb6beb470)
   132	    at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp:390
   133	#37 0x017fad14 in nsXBLBinding::ExecuteAttachedHandler (this=0xb6bd5538)
at /tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsXBLBinding.cpp:768
   134	#38 0x0181b439 in nsBindingManager::ProcessAttachedQueue
(this=0xb7387258) at
/tmp/awuest/trees/statustext/mozilla/content/xbl/src/nsBindingManager.cpp:761
   135	#39 0x013fff1f in nsCSSFrameConstructor::ContentAppended
(this=0xb732ddb8, aContainer=0xb6d02158, aNewIndexInContainer=0)
   136	    at
/tmp/awuest/trees/statustext/mozilla/layout/base/nsCSSFrameConstructor.cpp:8576
   137	#40 0x0145d3be in PresShell::ContentAppended (this=0xb733bec8,
aDocument=0xb732e6f8, aContainer=0xb6d02158, aNewIndexInContainer=0)
   138	    at /tmp/awuest/trees/statustext/mozilla/layout/base/nsPresShell.cpp:5441
   139	#41 0x016b3fd9 in nsDocument::ContentAppended (this=0xb732e6f8,
aContainer=0xb6d02158, aNewIndexInContainer=0)
   140	    at
/tmp/awuest/trees/statustext/mozilla/content/base/src/nsDocument.cpp:2194
   141	#42 0x0183d721 in nsXULDocument::ContentAppended (this=0xb732e6f8,
aContainer=0xb6d02158, aNewIndexInContainer=0)
   142	    at
/tmp/awuest/trees/statustext/mozilla/content/xul/document/src/nsXULDocument.cpp:1172
   143	#43 0x0190b5a3 in nsXULContentBuilder::RebuildAll (this=0xb6d5d9d8) at
/tmp/awuest/trees/statustext/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp:1909
   144	#44 0x0191f25d in nsXULTemplateBuilder::Rebuild (this=0xb6d5d9d8) at
/tmp/awuest/trees/statustext/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp:244
   145	#45 0x0191f773 in nsXULTemplateBuilder::AttributeChanged
(this=0xb6d5d9d8, aDocument=0xb732e6f8, aContent=0xb6d02158, aNameSpaceID=0,
aAttribute=0xa346050, aModType=2)
   146	    at
/tmp/awuest/trees/statustext/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp:343
   147	#46 0x0190a5b9 in nsXULContentBuilder::AttributeChanged (this=0xb6d5d9d8,
aDocument=0xb732e6f8, aContent=0xb6d02158, aNameSpaceID=0, aAttribute=0xa346050,
aModType=2)
   148	    at
/tmp/awuest/trees/statustext/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp:1568
   149	#47 0x0183d527 in nsXULDocument::AttributeChanged (this=0xb732e6f8,
aElement=0xb6d02158, aNameSpaceID=0, aAttribute=0xa346050, aModType=2)
   150	    at
/tmp/awuest/trees/statustext/mozilla/content/xul/document/src/nsXULDocument.cpp:1136
   151	#48 0x01822d3d in nsXULElement::SetAttrAndNotify (this=0xb6d02158,
aNamespaceID=0, aAttribute=0xa346050, aPrefix=0x0, aOldValue=@0xbfff7ddc,
aParsedValue=@0xbfff7dbc,
   152	    aModification=0, aFireMutation=0, aNotify=1) at
/tmp/awuest/trees/statustext/mozilla/content/xul/content/src/nsXULElement.cpp:1571
   153	#49 0x018227cc in nsXULElement::SetAttr (this=0xb6d02158, aNamespaceID=0,
aName=0xa346050, aPrefix=0x0, aValue=@0xb6be63f8, aNotify=1)
   154	    at
/tmp/awuest/trees/statustext/mozilla/content/xul/content/src/nsXULElement.cpp:1495
   155	#50 0x0182d32a in nsXULElement::SetAttr (this=0xb6d02158, aNameSpaceID=0,
aName=0xa346050, aValue=@0xb6be63f8, aNotify=1)
   156	    at
/tmp/awuest/trees/statustext/mozilla/content/xul/content/src/nsXULElement.h:482
   157	#51 0x01827141 in nsXULElement::SetRef (this=0xb6d02158,
aValue=@0xb6be63f8) at
/tmp/awuest/trees/statustext/mozilla/content/xul/content/src/nsXULElement.cpp:2646
   158	#52 0x004fb651 in XPTC_InvokeByIndex () at
/tmp/awuest/trees/statustext/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
   159	#53 0x00cddaac in XPCWrappedNative::CallMethod (ccx=@0xbfff81b0,
mode=CALL_SETTER) at
/tmp/awuest/trees/statustext/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2104
   160	#54 0x00ce911a in XPCWrappedNative::SetAttribute (ccx=@0xbfff81b0) at
/tmp/awuest/trees/statustext/mozilla/js/src/xpconnect/src/xpcprivate.h:1902
   161	#55 0x00ce7f57 in XPC_WN_GetterSetter (cx=0xb734ff68, obj=0xb6d18808,
argc=1, argv=0xb6bd711c, vp=0xbfff8360)
   162	    at
/tmp/awuest/trees/statustext/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1372
   163	#56 0x002d0b7f in js_Invoke (cx=0xb734ff68, argc=1, flags=2) at
/tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:1178
   164	#57 0x002d0fb9 in js_InternalInvoke (cx=0xb734ff68, obj=0xb6d18808,
fval=-1227781320, flags=0, argc=1, argv=0xbfff8b20, rval=0xbfff8b20)
   165	    at /tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:1275
   166	#58 0x002d1258 in js_InternalGetOrSet (cx=0xb734ff68, obj=0xb6d18808,
id=-1220963400, fval=-1227781320, mode=JSACC_WRITE, argc=1, argv=0xbfff8b20,
rval=0xbfff8b20)
   167	    at /tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:1318
   168	#59 0x002f7b60 in js_SetProperty (cx=0xb734ff68, obj=0xb6d18808,
id=-1220963400, vp=0xbfff8b20) at
/tmp/awuest/trees/statustext/mozilla/js/src/jsobj.c:2891
   169	#60 0x002deb64 in js_Interpret (cx=0xb734ff68, pc=0xb71cc1e9 "6",
result=0xbfff8c7c) at /tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:3306
   170	#61 0x002d0c08 in js_Invoke (cx=0xb734ff68, argc=1, flags=2) at
/tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:1198
   171	#62 0x002d0fb9 in js_InternalInvoke (cx=0xb734ff68, obj=0xa0bcab0,
fval=-1225246288, flags=0, argc=1, argv=0xb734aab0, rval=0xbfff8ecc)
   172	---Type <return> to continue, or q <return> to quit---
   173	    at /tmp/awuest/trees/statustext/mozilla/js/src/jsinterp.c:1275
   174	#63 0x0029d2a2 in JS_CallFunctionValue (cx=0xb734ff68, obj=0xa0bcab0,
fval=-1225246288, argc=1, argv=0xb734aab0, rval=0xbfff8ecc)
   175	    at /tmp/awuest/trees/statustext/mozilla/js/src/jsapi.c:3858
   176	#64 0x01871d64 in nsJSContext::CallEventHandler (this=0xb733daa0,
aTarget=0xa0bcab0, aHandler=0xb6f839b0, argc=1, argv=0xb734aab0, rval=0xbfff8ecc)
   177	    at
/tmp/awuest/trees/statustext/mozilla/dom/src/base/nsJSEnvironment.cpp:1385
   178	#65 0x0188a62a in nsGlobalWindow::RunTimeout (this=0xb734fda8,
aTimeout=0xb734aa60) at
/tmp/awuest/trees/statustext/mozilla/dom/src/base/nsGlobalWindow.cpp:5257
   179	#66 0x0188b1c1 in nsGlobalWindow::TimerCallback (aTimer=0xb6bd00b8,
aClosure=0xb734aa60) at
/tmp/awuest/trees/statustext/mozilla/dom/src/base/nsGlobalWindow.cpp:5619
   180	#67 0x004d53c0 in nsTimerImpl::Fire (this=0xb6bd00b8) at
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsTimerImpl.cpp:394
   181	#68 0x004d55a6 in handleTimerEvent (event=0xb6db2f00) at
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsTimerImpl.cpp:459
   182	#69 0x004ccf18 in PL_HandleEvent (self=0xb6db2f00) at
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/plevent.c:698
   183	#70 0x004ccdb9 in PL_ProcessPendingEvents (self=0xa028fb8) at
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/plevent.c:633
   184	#71 0x004d0304 in nsEventQueueImpl::ProcessPendingEvents (this=0xa028f80)
at /tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsEventQueue.cpp:417
   185	#72 0x07586288 in event_processor_callback (source=0xb730e9f0,
condition=G_IO_IN, data=0xa028f80) at
/tmp/awuest/trees/statustext/mozilla/widget/src/gtk2/nsAppShell.cpp:67
   186	#73 0x0039ff8f in g_vsnprintf () from /usr/lib/libglib-2.0.so.0
   187	#74 0x0037ec30 in unblock_source () from /usr/lib/libglib-2.0.so.0
   188	#75 0x0037fc98 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
   189	#76 0x0037ffad in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
   190	#77 0x003806cf in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
   191	#78 0x0074943f in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
   192	#79 0x0758697a in nsAppShell::Run (this=0xa2b7638) at
/tmp/awuest/trees/statustext/mozilla/widget/src/gtk2/nsAppShell.cpp:139
   193	#80 0x02d94d0f in nsAppStartup::Run (this=0xa2b75f0) at
/tmp/awuest/trees/statustext/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:144
   194	#81 0x080574db in XRE_main (argc=1, argv=0xbfff9aa4, aAppData=0x8070040)
at /tmp/awuest/trees/statustext/mozilla/toolkit/xre/nsAppRunner.cpp:2059
   195	#82 0x0804f6c2 in main (argc=1, argv=0xbfff9aa4) at
/tmp/awuest/trees/statustext/mozilla/browser/app/nsBrowserApp.cpp:61
   196	(gdb)


Console debug output of firefox run (non-blank-line numbered for your convenience):

     1	Type Manifest File:
/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/xpti.dat
     2	nsNativeComponentLoader: autoregistering begins.
     3	nsNativeComponentLoader: autoregistering succeeded
     4	nsNativeComponentLoader: registering deferred (0)
     5	nsNativeComponentLoader: autoregistering begins.
     6	nsNativeComponentLoader: autoregistering succeeded
     7	nsNativeComponentLoader: registering deferred (0)
     8	WARNING: nsExceptionService ignoring thread destruction after shutdown,
file /tmp/awuest/trees/statustext/mozilla/xpcom/base/nsExceptionService.cpp,
line 191
     9	No Persistent Registry Found.
    10	Type Manifest File: /home/awuest/.mozilla/firefox/qsazrhuz.default/xpti.dat
    11	nsNativeComponentLoader: autoregistering begins.
    12	*** Registering xpcomObsoleteModule components (all right -- a generic
module!)
    13	*** Registering xpconnect components (all right -- a generic module!)
    14	*** Registering nsUConvModule components (all right -- a generic module!)
    15	*** Registering nsI18nModule components (all right -- a generic module!)
    16	*** Registering necko_core_and_primary_protocols components (all right --
a generic module!)
    17	*** Registering necko_secondary_protocols components (all right -- a
generic module!)
    18	*** Registering nsJarModule components (all right -- a generic module!)
    19	*** Registering nsPrefModule components (all right -- a generic module!)
    20	*** Registering nsSecurityManagerModule components (all right -- a
generic module!)
    21	*** Registering nsRDFModule components (all right -- a generic module!)
    22	*** Registering nsParserModule components (all right -- a generic module!)
    23	*** Registering nsGfxGTKModule components (all right -- a generic module!)
    24	*** Registering nsIconDecoderModule components (all right -- a generic
module!)
    25	*** Registering nsImageLib2Module components (all right -- a generic module!)
    26	*** Registering nsWidgetGtk2Module components (all right -- a generic
module!)
    27	*** Registering nsLayoutModule components (all right -- a generic module!)
    28	*** Registering docshell_provider components (all right -- a generic module!)
    29	*** Registering embedcomponents components (all right -- a generic module!)
    30	*** Registering Browser_Embedding_Module components (all right -- a
generic module!)
    31	*** Registering nsEditorModule components (all right -- a generic module!)
    32	*** Registering nsTransactionManagerModule components (all right -- a
generic module!)
    33	*** Registering nsComposerModule components (all right -- a generic module!)
    34	*** Registering appshell components (all right -- a generic module!)
    35	*** Registering nsAccessibilityModule components (all right -- a generic
module!)
    36	*** Registering nsChromeModule components (all right -- a generic module!)
    37	*** Registering nsMorkModule components (all right -- a generic module!)
    38	*** Registering nsFindComponent components (all right -- a generic module!)
    39	*** Registering application components (all right -- a generic module!)
    40	*** Registering nsFileViewModule components (all right -- a generic module!)
    41	*** Registering RemoteServiceModule components (all right -- a generic
module!)
    42	*** Registering CommandLineModule components (all right -- a generic module!)
    43	*** Registering nsToolkitCompsModule components (all right -- a generic
module!)
    44	*** Registering nsSoftwareUpdate components (all right -- a generic module!)
    45	*** Registering BOOT components (all right -- a generic module!)
    46	*** Registering NSS components (all right -- a generic module!)
    47	*** Registering PKI components (all right -- a generic module!)
    48	*** Registering mozgnome components (all right -- a generic module!)
    49	*** Registering nsCookieModule components (all right -- a generic module!)
    50	*** Registering nsXMLExtrasModule components (all right -- a generic module!)
    51	*** Registering nsAutoConfigModule components (all right -- a generic
module!)
    52	*** Registering nsSystemPrefModule components (all right -- a generic
module!)
    53	*** Registering TransformiixModule components (all right -- a generic
module!)
    54	*** Registering nsUniversalCharDetModule components (all right -- a
generic module!)
    55	*** Registering nsWebServicesModule components (all right -- a generic
module!)
    56	*** Registering nsInspectorModule components (all right -- a generic module!)
    57	*** Registering nsGnomeVFSModule components (all right -- a generic module!)
    58	*** Registering nsNegotiateAuthModule components (all right -- a generic
module!)
    59	*** Registering nsPermissionsModule components (all right -- a generic
module!)
    60	*** Registering SearchServiceModule components (all right -- a generic
module!)
    61	*** Registering nsBrowserCompsModule components (all right -- a generic
module!)
    62	nsNativeComponentLoader: autoregistering succeeded
    63	nsNativeComponentLoader: registering deferred (0)
    64	nsNativeComponentLoader: registering deferred (0)
    65	nsNativeComponentLoader: registering deferred (0)
    66	nsNativeComponentLoader: autoregistering begins.
    67	nsNativeComponentLoader: autoregistering succeeded
    68	nsNativeComponentLoader: registering deferred (0)
    69	pldhash: for the table at address 0x9049fd0, the given entrySize of 44
probably favors chaining over double hashing.
    70	GFX: dpi=96 t2p=0.0666667 p2t=15 depth=24
    71	++WEBSHELL == 1
    72	WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file
/tmp/awuest/trees/statustext/mozilla/extensions/cookie/nsPermissionManager.cpp,
line 624
    73	++DOMWINDOW == 1
    74	*** loading the extensions datasource
    75	WARNING: nsExceptionService ignoring thread destruction after shutdown,
file /tmp/awuest/trees/statustext/mozilla/xpcom/base/nsExceptionService.cpp,
line 191
    76	--WEBSHELL == 0
    77	WARNING: unable to Flush() diry datasource during XPCOM shutdown, file
/tmp/awuest/trees/statustext/mozilla/rdf/base/src/nsRDFXMLDataSource.cpp, line 801
    78	###!!! ASSERTION: Main thread being held past XPCOM shutdown.: 'cnt ==
0', file /tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsThread.cpp, line 450
    79	Break: at file
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsThread.cpp, line 450
    80	Type Manifest File: /home/awuest/.mozilla/firefox/qsazrhuz.default/xpti.dat
    81	nsNativeComponentLoader: autoregistering begins.
    82	nsNativeComponentLoader: autoregistering succeeded
    83	nsNativeComponentLoader: registering deferred (0)
    84	pldhash: for the table at address 0x9e4a700, the given entrySize of 44
probably favors chaining over double hashing.
    85	GFX: dpi=96 t2p=0.0666667 p2t=15 depth=24
    86	++WEBSHELL == 1
    87	WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file
/tmp/awuest/trees/statustext/mozilla/extensions/cookie/nsPermissionManager.cpp,
line 624
    88	++DOMWINDOW == 1
    89	*** Item Installed via directory addition to Install Location: app-global
Item ID: {972ce4c6-7e08-4474-a285-3208198ce6fd}, attempting to register...
    90	*** Item Installed/Upgraded at Install Location: app-global Item ID:
{972ce4c6-7e08-4474-a285-3208198ce6fd}, attempting to register...
    91	*** loading the extensions datasource
    92	*** ... success, item is compatible
    93	WARNING: nsExceptionService ignoring thread destruction after shutdown,
file /tmp/awuest/trees/statustext/mozilla/xpcom/base/nsExceptionService.cpp,
line 191
    94	--WEBSHELL == 0
    95	###!!! ASSERTION: Main thread being held past XPCOM shutdown.: 'cnt ==
0', file /tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsThread.cpp, line 450
    96	Break: at file
/tmp/awuest/trees/statustext/mozilla/xpcom/threads/nsThread.cpp, line 450
    97	No Persistent Registry Found.
    98	Type Manifest File: /home/awuest/.mozilla/firefox/qsazrhuz.default/xpti.dat
    99	nsNativeComponentLoader: autoregistering begins.
   100	*** Registering xpcomObsoleteModule components (all right -- a generic
module!)
   101	*** Registering xpconnect components (all right -- a generic module!)
   102	*** Registering nsUConvModule components (all right -- a generic module!)
   103	*** Registering nsI18nModule components (all right -- a generic module!)
   104	*** Registering necko_core_and_primary_protocols components (all right --
a generic module!)
   105	*** Registering necko_secondary_protocols components (all right -- a
generic module!)
   106	*** Registering nsJarModule components (all right -- a generic module!)
   107	*** Registering nsPrefModule components (all right -- a generic module!)
   108	*** Registering nsSecurityManagerModule components (all right -- a
generic module!)
   109	*** Registering nsRDFModule components (all right -- a generic module!)
   110	*** Registering nsParserModule components (all right -- a generic module!)
   111	*** Registering nsGfxGTKModule components (all right -- a generic module!)
   112	*** Registering nsIconDecoderModule components (all right -- a generic
module!)
   113	*** Registering nsImageLib2Module components (all right -- a generic module!)
   114	*** Registering nsWidgetGtk2Module components (all right -- a generic
module!)
   115	*** Registering nsLayoutModule components (all right -- a generic module!)
   116	*** Registering docshell_provider components (all right -- a generic module!)
   117	*** Registering embedcomponents components (all right -- a generic module!)
   118	*** Registering Browser_Embedding_Module components (all right -- a
generic module!)
   119	*** Registering nsEditorModule components (all right -- a generic module!)
   120	*** Registering nsTransactionManagerModule components (all right -- a
generic module!)
   121	*** Registering nsComposerModule components (all right -- a generic module!)
   122	*** Registering appshell components (all right -- a generic module!)
   123	*** Registering nsAccessibilityModule components (all right -- a generic
module!)
   124	*** Registering nsChromeModule components (all right -- a generic module!)
   125	*** Registering nsMorkModule components (all right -- a generic module!)
   126	*** Registering nsFindComponent components (all right -- a generic module!)
   127	*** Registering application components (all right -- a generic module!)
   128	*** Registering nsFileViewModule components (all right -- a generic module!)
   129	*** Registering RemoteServiceModule components (all right -- a generic
module!)
   130	*** Registering CommandLineModule components (all right -- a generic module!)
   131	*** Registering nsToolkitCompsModule components (all right -- a generic
module!)
   132	*** Registering nsSoftwareUpdate components (all right -- a generic module!)
   133	*** Registering BOOT components (all right -- a generic module!)
   134	*** Registering NSS components (all right -- a generic module!)
   135	*** Registering PKI components (all right -- a generic module!)
   136	*** Registering mozgnome components (all right -- a generic module!)
   137	*** Registering nsCookieModule components (all right -- a generic module!)
   138	*** Registering nsXMLExtrasModule components (all right -- a generic module!)
   139	*** Registering nsAutoConfigModule components (all right -- a generic
module!)
   140	*** Registering nsSystemPrefModule components (all right -- a generic
module!)
   141	*** Registering TransformiixModule components (all right -- a generic
module!)
   142	*** Registering nsUniversalCharDetModule components (all right -- a
generic module!)
   143	*** Registering nsWebServicesModule components (all right -- a generic
module!)
   144	*** Registering nsInspectorModule components (all right -- a generic module!)
   145	*** Registering nsGnomeVFSModule components (all right -- a generic module!)
   146	*** Registering nsNegotiateAuthModule components (all right -- a generic
module!)
   147	*** Registering nsPermissionsModule components (all right -- a generic
module!)
   148	*** Registering SearchServiceModule components (all right -- a generic
module!)
   149	*** Registering nsBrowserCompsModule components (all right -- a generic
module!)
   150	nsNativeComponentLoader: autoregistering succeeded
   151	nsNativeComponentLoader: registering deferred (0)
   152	nsNativeComponentLoader: registering deferred (0)
   153	nsNativeComponentLoader: registering deferred (0)
   154	nsNativeComponentLoader: autoregistering begins.
   155	nsNativeComponentLoader: autoregistering succeeded
   156	nsNativeComponentLoader: registering deferred (0)
   157	pldhash: for the table at address 0xa16eaf8, the given entrySize of 44
probably favors chaining over double hashing.
   158	GFX: dpi=96 t2p=0.0666667 p2t=15 depth=24
   159	++WEBSHELL == 1
   160	WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file
/tmp/awuest/trees/statustext/mozilla/extensions/cookie/nsPermissionManager.cpp,
line 624
   161	++DOMWINDOW == 1
   162	WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file
/tmp/awuest/trees/statustext/mozilla/intl/strres/src/nsStringBundle.cpp, line 273
   163	++WEBSHELL == 2
   164	++DOMWINDOW == 2
   165	Note: styleverifytree is disabled
   166	Note: frameverifytree is disabled
   167	Note: verifyreflow is disabled
   168	++WEBSHELL == 3
   169	++DOMWINDOW == 3
   170	**** Stale search engine reference to
'NC:SearchCategory?engine=urn:search:engine:lxrmozilla.src'
   171	**** Stale search engine reference to
'NC:SearchCategory?engine=urn:search:engine:bugzilla.src'
   172	**** Stale search engine reference to
'NC:SearchCategory?engine=urn:search:engine:mozilla.src'
   173	**** Stale search engine reference to
'NC:SearchCategory?engine=urn:search:engine:dmoz.src'
   174	**** Stale search engine reference to
'NC:SearchCategory?engine=urn:search:engine:NetscapeSearch.src'
   175	JS DUMP: bind_orthogonal_implementation::ctor: binding
"chrome://global/content/bindings/general.xml#testbinding" on "[object
XULElement @ 0xb6be1158 (native @ 0xb6beb470)]".

   176	Program firefox-devbuild/dist/bin/firefox-bin (pid = 10159) received
signal 11.
   177	Stack:
   178	nsProfileLock::FatalSignalHandler(int)+0x00000137
[firefox-devbuild/dist/bin/firefox-bin +0x00021F79]
   179	UNKNOWN [/lib/tls/libpthread.so.0 +0x0000AE48]

   180	Program firefox-devbuild/dist/bin/firefox-bin (pid = 10159) received
signal 11.
   181	Stack:
   182	nsProfileLock::FatalSignalHandler(int)+0x00000137
[firefox-devbuild/dist/bin/firefox-bin +0x00021F79]
   183	UNKNOWN [/lib/tls/libpthread.so.0 +0x0000AE48]
   184	UNKNOWN [/lib/tls/libc.so.6 +0x000721CD]
   185	__libc_free+0x00000088 [/lib/tls/libc.so.6 +0x00071048]
   186	DemangleSymbol(char const*, char*, int)+0x00000052
[firefox-devbuild/dist/bin/firefox-bin +0x00021A46]
   187	DumpStackToFile(_IO_FILE*)+0x00000167
[firefox-devbuild/dist/bin/firefox-bin +0x00021BB5]
   188	ah_crap_handler(int)+0x0000005A [firefox-devbuild/dist/bin/firefox-bin
+0x00021416]
   189	nsProfileLock::FatalSignalHandler(int)+0x00000137
[firefox-devbuild/dist/bin/firefox-bin +0x00021F79]
   190	UNKNOWN [/lib/tls/libpthread.so.0 +0x0000AE48]
   191	nsCOMPtr<nsIDOMElement>::assign_from_qi(nsQueryInterface, nsID
const&)+0x00000021
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x00307363]
   192	nsCOMPtr<nsIDOMElement>::nsCOMPtr(nsQueryInterface)+0x00000037
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x0030518D]
   193	nsXBLBinding::GetAnonymousNodes()+0x00000058
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x006F4468]
   194	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x006F0F32]
   195	UNKNOWN [firefox-devbuild/dist/bin/libxpcom_core.so +0x0008A7FE]
   196	PL_DHashTableEnumerate+0x00000089
[firefox-devbuild/dist/bin/libxpcom_core.so +0x0008335F]
   197	nsHashtable::Enumerate(int (*)(nsHashKey*, void*, void*),
void*)+0x00000057 [firefox-devbuild/dist/bin/libxpcom_core.so +0x0008B119]
   198	nsXBLBinding::GenerateAnonymousContent()+0x00000626
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x006F1D18]
   199	nsXBLBinding::GenerateAnonymousContent()+0x0000006C
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x006F175E]
   200	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x0070DB63]
   201	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x00712C6C]
   202	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x005ADAF2]
   203	XPTC_InvokeByIndex+0x00000029 [firefox-devbuild/dist/bin/libxpcom_core.so
+0x00121651]
   204	XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode)+0x00001154
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libxpconnect.so
+0x00080AAC]
   205	XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*,
long*)+0x000001A5
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libxpconnect.so
+0x0008AD6B]
   206	js_Invoke+0x00000F2A [firefox-devbuild/dist/bin/libmozjs.so +0x00050B7F]
   207	js_Interpret+0x0000E0BF [firefox-devbuild/dist/bin/libmozjs.so +0x000603DF]
   208	js_Invoke+0x00000FB3 [firefox-devbuild/dist/bin/libmozjs.so +0x00050C08]
   209	js_InternalInvoke+0x00000141 [firefox-devbuild/dist/bin/libmozjs.so
+0x00050FB9]
   210	JS_CallFunctionValue+0x0000002F [firefox-devbuild/dist/bin/libmozjs.so
+0x0001D2A2]
   211	nsXBLProtoImplAnonymousMethod::Execute(nsIContent*)+0x00000416
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x00702D92]
   212	nsXBLPrototypeBinding::BindingAttached(nsIContent*)+0x0000003C
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x006F5824]
   213	nsXBLBinding::ExecuteAttachedHandler()+0x0000006A
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x006F2D14]
   214	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x00713439]
   215	nsCSSFrameConstructor::ContentAppended(nsIContent*, int)+0x00000B7F
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x002F7F1F]
   216	PresShell::ContentAppended(nsIDocument*, nsIContent*, int)+0x0000009E
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x003553BE]
   217	nsDocument::ContentAppended(nsIContent*, int)+0x0000008F
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x005ABFD9]
   218	nsXULDocument::ContentAppended(nsIContent*, int)+0x00000093
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x00735721]
   219	nsXULContentBuilder::RebuildAll()+0x0000036F
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x008035A3]
   220	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x0081725D]
   221	nsXULTemplateBuilder::AttributeChanged(nsIDocument*, nsIContent*, int,
nsIAtom*, int)+0x0000004B
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x00817773]
   222	nsXULContentBuilder::AttributeChanged(nsIDocument*, nsIContent*, int,
nsIAtom*, int)+0x000000E7
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x008025B9]
   223	nsXULDocument::AttributeChanged(nsIContent*, int, nsIAtom*,
int)+0x00000315
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x00735527]nsXULElement::SetAttrAndNotify(int, nsIAtom*, nsIAtom*, nsAString
const&, nsAttrValue&, int, int, int)+0x00000535
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x0071AD3D]
   224	nsXULElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString const&,
int)+0x00000314
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x0071A7CC]
   225	nsXULElement::SetAttr(int, nsIAtom*, nsAString const&, int)+0x00000026
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x0072532A]
   226	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x0071F141]
   227	XPTC_InvokeByIndex+0x00000029 [firefox-devbuild/dist/bin/libxpcom_core.so
+0x00121651]
   228	XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode)+0x00001154
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libxpconnect.so
+0x00080AAC]
   229	XPCWrappedNative::SetAttribute(XPCCallContext&)+0x00000020
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libxpconnect.so
+0x0008C11A]
   230	XPC_WN_GetterSetter(JSContext*, JSObject*, unsigned int, long*,
long*)+0x000001C1
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libxpconnect.so
+0x0008AF57]
   231	js_Invoke+0x00000F2A [firefox-devbuild/dist/bin/libmozjs.so +0x00050B7F]
   232	js_InternalInvoke+0x00000141 [firefox-devbuild/dist/bin/libmozjs.so
+0x00050FB9]
   233	js_InternalGetOrSet+0x0000023B [firefox-devbuild/dist/bin/libmozjs.so
+0x00051258]
   234	js_SetProperty+0x00000374 [firefox-devbuild/dist/bin/libmozjs.so +0x00077B60]
   235	js_Interpret+0x0000C844 [firefox-devbuild/dist/bin/libmozjs.so +0x0005EB64]
   236	js_Invoke+0x00000FB3 [firefox-devbuild/dist/bin/libmozjs.so +0x00050C08]
   237	js_InternalInvoke+0x00000141 [firefox-devbuild/dist/bin/libmozjs.so
+0x00050FB9]
   238	JS_CallFunctionValue+0x0000002F [firefox-devbuild/dist/bin/libmozjs.so
+0x0001D2A2]
   239	nsJSContext::CallEventHandler(JSObject*, JSObject*, unsigned int, long*,
long*)+0x0000012C
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x00769D64]
   240	nsGlobalWindow::RunTimeout(nsTimeout*)+0x00000486
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x0078262A]
   241	nsGlobalWindow::TimerCallback(nsITimer*, void*)+0x00000037
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libgklayout.so
+0x007831C1]
   242	nsTimerImpl::Fire()+0x00000250
[firefox-devbuild/dist/bin/libxpcom_core.so +0x000FB3C0]
   243	handleTimerEvent(TimerEventType*)+0x0000010C
[firefox-devbuild/dist/bin/libxpcom_core.so +0x000FB5A6]
   244	PL_HandleEvent+0x00000054 [firefox-devbuild/dist/bin/libxpcom_core.so
+0x000F2F18]
   245	PL_ProcessPendingEvents+0x000000DC
[firefox-devbuild/dist/bin/libxpcom_core.so +0x000F2DB9]
   246	UNKNOWN [firefox-devbuild/dist/bin/libxpcom_core.so +0x000F6304]
   247	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libwidget_gtk2.so
+0x00037288]
   248	UNKNOWN [/usr/lib/libglib-2.0.so.0 +0x00043F8F]
   249	UNKNOWN [/usr/lib/libglib-2.0.so.0 +0x00022C30]
   250	g_main_context_dispatch+0x00000098 [/usr/lib/libglib-2.0.so.0 +0x00023C98]
   251	UNKNOWN [/usr/lib/libglib-2.0.so.0 +0x00023FAD]
   252	g_main_loop_run+0x0000019F [/usr/lib/libglib-2.0.so.0 +0x000246CF]
   253	gtk_main+0x000000BF [/usr/lib/libgtk-x11-2.0.so.0 +0x000D443F]
   254	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libwidget_gtk2.so
+0x0003797A]
   255	UNKNOWN
[/tmp/awuest/trees/statustext/mozilla/firefox-devbuild/dist/bin/components/libtoolkitcomps.so
+0x00043D0F]
   256	UNKNOWN [firefox-devbuild/dist/bin/firefox-bin +0x0000F4DB]
   257	XOpenDisplay+0x0000010E [firefox-devbuild/dist/bin/firefox-bin +0x000076C2]
   258	__libc_start_main+0x000000DA [/lib/tls/libc.so.6 +0x0001578A]
   259	Sleeping for 5 minutes.
   260	Type 'gdb firefox-devbuild/dist/bin/firefox-bin 10159' to attach your
debugger to this thread.


Please note the line starting with "JS DUMP" (line 175). After this 'dump()',
the document.addBinding() is called (see testcase). The 'dump()' after
addBinding() is never reached.


In case you wonder about what the code should do: it should supply a facility to
add orthogonal bindings (i.e. bindings or a chain of bindings with functionality
which does not need to inherit from other bindings or chains of bindings). It
implements quasi-multiple inheritance, with the difference that addBinding()
just links the additional bindings into the existing bindings chain, i.e.
conflict resolution is solved by simple 'subclassing'. See also
rant^H^H^H^Hcomment https://bugzilla.mozilla.org/show_bug.cgi?id=213163#c33.

It doesn't matter that addBinding has to add the binding at the top of the chain
(i.e. at the point where no other (normal) bindings have been bound to the
current element), the same behaviour can also be reproduced when factoring the
'bind_orthogonal_implementation' code out and call it via a mouseover event
after the browser was loaded.

But maybe these are just the two corner cases (inserting binding at the top and
at the bottom of the chain), but it would work in between (altough I cannot
imagine this since it is always an insertion at the bottom, except for the
topmost insertion).

Reproducible: Always

Steps to Reproduce:
1. Compile
2. Run
3. Crash

Actual Results:  
Segmentation fault (see backtraces above)

Expected Results:  
Execute the addBinding() function and add the specified binding to the element.

Linux 2.4.21-32.0.1.ELsmp #1 SMP Tue May 17 17:52:23 EDT 2005 i686 i686 i386
GNU/Linux

Andreas Wuest

Reporter

Comment 1

•

20 years ago

Attached file Testcase #1 to reproduce document.addBinding() segfault — Details

Adds a new super class, which in its constructor calls document.addBinding to
bind an additional binding which can be specified in an attribute
'orthogonalBinding'. Call to addBinding crashes.

Andreas Wuest

Reporter

Comment 2

•

20 years ago

PS: Just to make sure: changing the attribute to low caps has no effect, except
that I can't get a sensible stacktrace anymore...

Andreas Wuest

Reporter

Updated

•

20 years ago

Blocks: 213163

Andreas Wuest

Reporter

Updated

•

20 years ago

Attachment #185144 - Attachment is patch: false

Boris Zbarsky [:bzbarsky]

Comment 3

•

20 years ago

For future reference, a testcase should generally be runnable in the browser
without having to change the source...  Makes it a lot easier to work with.

Boris Zbarsky [:bzbarsky]

Comment 4

•

20 years ago

So the problem here is probably that this code is reentering the binding
construction somehow before it's quite done.  The crash is happening because
nsXBLBinding::GenerateAnonymousContent hits a null array in its hashtable...

Severity: normal → critical

Component: DOM: Core → XBL

Keywords: crash

Summary: document.addBinding() segfaults → document.addBinding() segfaults when called from binding constructor for same element

Andreas Wuest

Reporter

Comment 5

•

20 years ago

(In reply to comment #4)

> So the problem here is probably that this code is reentering the binding
> construction somehow before it's quite done.  The crash is happening because
> nsXBLBinding::GenerateAnonymousContent hits a null array in its hashtable...

Sorry, but I have to disagree with you. As I mentioned above, the segfault also
happens when using something like this:

  <binding id="bind_orthogonal_implementation">
    <implementation>
      <property name="orthogonalbinding" onget="return
this.getAttribute('orthogonalbinding');"/>
      <method name="bind_orthogonal_implementation">
        <body>
          <![CDATA[
            if (this.orthogonalbinding) {
              dump("JS DUMP:
bind_orthogonal_implementation::bind_orthogonal_implementation: binding \"" +
this.orthogonalbinding + "\" on \"" + this + "\".\n");
              document.addBinding(this, this.orthogonalbinding);
              dump("JS DUMP:
bind_orthogonal_implementation::bind_orthogonal_implementation: after
document.addBinding() invocation.\n");
            }
          ]]>
        </body>
      </method>
    </implementation>
  </binding>

and invoking it via

orthogonalbinding="chrome://global/content/bindings/general.xml#testbinding"
onmouseover="bind_orthogonal_implementation();"

by hovering over the toolbarbutton.

In this case, the binding obvioulsy happens *after* this element and everything
has been initialised! (You can even do some browsing before.)

See testcase #2 and backtrace #2.

PS: Should I try to rework the testcases somehow to be able to load it directly
into the browser without having to recompile?

Andreas Wuest

Reporter

Comment 6

•

20 years ago

Attached file Stacktrace and console debug output for testcase #1 — Details

Andreas Wuest

Reporter

Updated

•

20 years ago

Attachment #185144 - Attachment description: Testcase to reproduce document.addBinding() segfault → Testcase #1 to reproduce document.addBinding() segfault

Andreas Wuest

Reporter

Comment 7

•

20 years ago

Attached file Testcase #2 to reproduce document.addBinding() segfault — Details

Andreas Wuest

Reporter

Comment 8

•

20 years ago

Attached file Stacktrace and console debug output for testcase #2 — Details

Andreas Wuest

Reporter

Updated

•

20 years ago

Summary: document.addBinding() segfaults when called from binding constructor for same element → document.addBinding() segfaults when calling element is the target of the binding

Boris Zbarsky [:bzbarsky]

Comment 9

•

20 years ago

Actually, this should just crash any time it's called on a node which already
has a binding.

Part of the problem is deCOM that leads to us not holding a ref to a binding we
need and hence it actually going away while we're working with it.  Fixing that
gets me a little further, but still crashes...

Summary: document.addBinding() segfaults when calling element is the target of the binding → document.addBinding() segfaults called on a node with existing binding

Boris Zbarsky [:bzbarsky]

Comment 10

•

20 years ago

Brian, could you possibly look into this?  I won't have a chance to till July at
this point.  Two problems I've found so far are:

1) In nsXBLService::LoadBindings when we are in the aAugmentFlag we do:

    bindingManager->SetBinding(aContent, newBinding);
    baseBinding->SetBaseBinding(binding);

That first call destroys |binding|, since we're not holding a ref to it.  Just
taking a ref before calling SetBinding helps with this.

2) With #1 fixed we crash in ObjectEntry::SetValue, called from
nsBindingManager::SetAnonymousNodesFor.  In particular, the
nsVoidArray::EnumerateForwards in ~nsAnonymousContentList crashes, with this stack:

0  0x0000000e in ?? ()
#1  0xb7e72bc9 in nsCOMArray_base::~nsCOMArray_base () at nsIComponentManager.h:29
#2  0xb71fa912 in nsCOMArray<nsIContent>::~nsCOMArray () at nsCOMArray.h:52
#3  0xb75bfe2c in nsXBLInsertionPoint::~nsXBLInsertionPoint ()
    at ../../../../mozilla/content/xtf/src/nsXTFElementWrapper.cpp:58
#4  0xb75baf0a in DeleteInsertionPoint (aElement=0x8853050, aData=0x0)
    at ../../../../mozilla/content/xbl/src/nsBindingManager.cpp:124
#5  0xb7e6d4b0 in nsVoidArray::EnumerateForwards (this=0x8861fd0, 
    aFunc=0xb75baee0 <DeleteInsertionPoint>, aData=0x0)
    at ../../../mozilla/xpcom/ds/nsVoidArray.cpp:648

At a guess, we are trying to double-delete insertion points or something along
those lines, since we're just augmenting an existing binding and hence reusing
its existing insertion point table.  That is, I'm not sure the "binding manager
table owns insertion points" model introduced in bug 194834 is correct (or
rather it's not enforced right now; other places have pointers to the same
insertion points).

Assignee: general → general

Status: UNCONFIRMED → NEW

Ever confirmed: true

Flags: blocking1.8b3?

Benjamin Smedberg

Comment 11

•

20 years ago

Bumping... this sucks.

Flags: blocking1.8b4?

Flags: blocking1.8b3?

Flags: blocking1.8b3-

Boris Zbarsky [:bzbarsky]

Comment 12

•

19 years ago

Just to make it clear, this is a major XBL usability regression in 1.8, and I
think we should definitely fix it before we branch 1.8....

Benjamin Smedberg

Updated

•

19 years ago

Whiteboard: [no l10n impact]

Mike Connor [:mconnor]

Updated

•

19 years ago

Flags: blocking1.8b4? → blocking1.8b4+

Whiteboard: [no l10n impact] → [no l10n impact] [needed before branch]

Jaime Mitchell (use bugmail@jaimem.org.uk for email)

Updated

•

19 years ago

Blocks: branching1.8

Chris Beard

Comment 13

•

19 years ago

Is anyone working on this?  If not, who should?

/cb

Chris Beard

Updated

•

19 years ago

Whiteboard: [no l10n impact] [needed before branch] → [no l10n impact] [needed before branch] [at risk?]

Boris Zbarsky [:bzbarsky]

Comment 14

•

19 years ago

I'm not aware of anyone working on this yet.  As for who should.... bryner wrote
the code and probably knows it better than anyone else.  I could try to work on
it, but I really don't know how and why most of this code works, so my approach
would be mostly along the lines of backing out parts of bug 194834.

Chris Beard

Comment 15

•

19 years ago

ok, so bz, if you could take this, and perhaps get an assist from bryner?

/cb

Assignee: general → bzbarsky

Boris Zbarsky [:bzbarsky]

Comment 16

•

19 years ago

I'm not going to be able to work on this until at least two weeks from now.

Chris Beard

Updated

•

19 years ago

No longer blocks: branching1.8

Whiteboard: [no l10n impact] [needed before branch] [at risk?] → [no l10n impact]

Boris Zbarsky [:bzbarsky]

Updated

•

19 years ago

Whiteboard: [no l10n impact] → [no l10n impact][ETA: 8/19]

Boris Zbarsky [:bzbarsky]

Comment 17

•

19 years ago

bryner, could you possibly take a look at this?  I really don't quite understand
why the code you wrote in bug 194834 is doing what it's doing, and at the same
time I don't really want to try to back it out wholesale -- enough stuff has
changed since that that would be pretty painful.

Keywords: helpwanted

Whiteboard: [no l10n impact][ETA: 8/19] → [no l10n impact][ETA: unknown]

Boris Zbarsky [:bzbarsky]

Updated

•

19 years ago

Blocks: 194834

Mike Schroepfer

Updated

•

19 years ago

Flags: blocking1.8b5+

Mike Schroepfer

Updated

•

19 years ago

Flags: blocking1.8b5+

Boris Zbarsky [:bzbarsky]

Comment 18

•

19 years ago

Bryner said he'd look at this...

Assignee: bzbarsky → bryner

Target Milestone: --- → mozilla1.8beta4

Brian Ryner (not reading)

Assignee

Comment 19

•

19 years ago

Attached file self-contained testcase — Details

Brian Ryner (not reading)

Assignee

Comment 20

•

19 years ago

Attached patch idea for a fix — Details — Splinter Review

As Boris mentioned, there are two problems.  The first is that the old binding
can be deleted as the new binding is inserted into the chain.  That's fixed by
simply reordering things in LoadBindings().

The other problem happens when GenerateAnonymousContent() is called on a
binding for the second time.  The binding will already have the insertion
points created, in mInsertionPointTable.  They are inserted into a
newly-created VoidArray which is then set as the anonymous content list for the
node on the binding manager.  So, the binding manager goes to replace one
VoidArray that contains nsXBLInsertionPoints with a second void array
containing the same points.  Since the insertion points are deleted as the old
array is removed, the new array has pointers to freed memory.

My fix here is simply to remove any duplicate insertion points from the old
nsVoidArray prior to swapping them, so that only insertion points that are no
longer referenced will be deleted.

Attachment #194492 - Flags: superreview?(bzbarsky)

Attachment #194492 - Flags: review?(bzbarsky)

Boris Zbarsky [:bzbarsky]

Comment 21

•

19 years ago

Comment on attachment 194492 [details] [diff] [review]
idea for a fix

Nice!  r+sr=bzbarsky

Attachment #194492 - Flags: superreview?(bzbarsky)

Attachment #194492 - Flags: superreview+

Attachment #194492 - Flags: review?(bzbarsky)

Attachment #194492 - Flags: review+

Brian Ryner (not reading)

Assignee

Comment 22

•

19 years ago

checked in on the trunk.

Status: NEW → RESOLVED

Closed: 19 years ago

Resolution: --- → FIXED

Brian Ryner (not reading)

Assignee

Updated

•

19 years ago

Attachment #194492 - Flags: approval1.8b4?

Tracy Walker [:tracy]

Comment 23

•

19 years ago

Brian, thanks for the human testcase. ;-)

verified on the trunk with: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.9a1) Gecko/20050901 Firefox/1.6a1

Status: RESOLVED → VERIFIED

Asa Dotzler [:asa]

Updated

•

19 years ago

Attachment #194492 - Flags: approval1.8b4? → approval1.8b4+

Brian Ryner (not reading)

Assignee

Comment 24

•

19 years ago

checked in on the branch

Keywords: fixed1.8

Tracy Walker [:tracy]

Comment 25

•

19 years ago

verified on Firefox 1.4 -mozilla1.8 branch- Win, Lin and Mac : 2005-09-07

Keywords: fixed1.8, helpwanted → verified1.8

Nickolay_Ponomarev

Comment 26

•

18 years ago

http://lxr.mozilla.org/mozilla/source/content/xbl/test/test_bug296375.xul

Flags: in-testsuite+

Testcase #1 to reproduce document.addBinding() segfault 20 years ago Andreas Wuest 3.38 KB, text/plain		Details
Stacktrace and console debug output for testcase #1 20 years ago Andreas Wuest 43.33 KB, text/plain		Details
Testcase #2 to reproduce document.addBinding() segfault 20 years ago Andreas Wuest 3.57 KB, text/plain		Details
Stacktrace and console debug output for testcase #2 20 years ago Andreas Wuest 35.48 KB, text/plain		Details
self-contained testcase 19 years ago Brian Ryner (not reading) 451 bytes, application/vnd.mozilla.xul+xml		Details
idea for a fix 19 years ago Brian Ryner (not reading) 2.72 KB, patch	bzbarsky : review+ bzbarsky : superreview+ asa : approval1.8b4+	Details \| Diff \| Splinter Review