301270 - [@ nsTextControlFrame::SetValue]

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect)

Description

[timeless]

bz fixed one of the more recent crashers like this.

i have no idea what i was doing, i think i was probably stopping mozilla from
loading a talkback reports page.

if nobody can figure out what actually crashed (my money is on PreDestroy
managing to get called, but my money is less than $1), could someone at least
address the other highlighted areas?

Stack Signature	nsTextControlFrame::SetValue 23838c0c
Product ID	MozillaTrunk
Build ID	2005071606
Trigger Time	2005-07-16 14:48:43.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	gklayout.dll + (0006b34a)
URL visited	
User Comments	
Since Last Crash	79 sec
Total Uptime	544 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/forms/nsTextControlFrame.cpp,
line 3163
Stack Trace 	
nsTextControlFrame::SetValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/forms/nsTextControlFrame.cpp,
line 3163]
nsTextControlFrame::SetProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/forms/nsTextControlFrame.cpp,
line 2329]
nsHTMLInputElement::SetValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 666]
nsHTMLInputElement::Reset 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 2101]
nsHTMLInputElement::AfterSetAttr 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 499]
nsHTMLInputElement::SetAttr 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 211]
nsXBLPrototypeBinding::AttributeChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp,
line 504]
nsXBLBinding::AttributeChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLBinding.cpp,
line 765]
nsXULElement::SetAttr 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 1488]
nsGenericElement::SetAttribute 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1405]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2119]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1350]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1173]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3464]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1193]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1270]
JS_CallFunctionValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3918]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1400]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1580]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1681]
nsGlobalWindow::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 929]
DocumentViewerImpl::LoadComplete 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsDocumentViewer.cpp,
line 1008]
nsDocShell::EndPageLoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 4644]
nsWebShell::EndPageLoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsWebShell.cpp,
line 667]
nsDocShell::OnStateChange 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 4570]
nsDocLoader::FireOnStateChange 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 1210]
nsDocLoader::doStopDocumentLoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 844]
nsDocLoader::OnStopRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 665]
nsLoadGroup::RemoveRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsLoadGroup.cpp,
line 732]
nsCachedChromeChannel::HandleStopLoadEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/rdf/chrome/src/nsChromeProtocolHandler.cpp,
line 487]
0x778b0c24
0x000d000a

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

I can reproduce this quite frequently:

1. Set http://home.netscape.com as your homepage.
2. Set SeaMonkey to use Quick Launch.
3. Set http://home.netscape.com as your "Display on New Tab" preference.
4. Hold down CTRL-T (on Windows, at least) for about 5 seconds.
5. While those tabs are loading, do a File | Exit.
6. Launch SeaMonkey again, and if http://home.netscape.com is also set as your
homepage here, you'll likely crash.

This is probably due to the way Netscape.com works: it sets focus to the Search
<input> textfield once the page has finished loading.  Something probably goes
out of scope or null while the textfields are being torn down?

Comment 2

[Boris Zbarsky [:bzbarsky]]

So without quick launch this does not happen?

Comment 3

[Henrik Gemal]

when ever I launch Download Them All I crash
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB15831977H

Comment 4

[Boris Zbarsky [:bzbarsky]]

Probably not this bug. File a new bug with clear steps to reproduce (including URI to the exact XPI to install if an extension is involved).

Comment 5

[Dick Balaska]

I have a xul/js extension that has run for 2 years on custom Moz 1.5 (last version that worked with iNotes).  Now we are moving to custom Firefox 1.5.0.4 and i get this crash when i click a button in my dialog which hides two text editors and two buttons.

Here is my VC6 stack trace.  I find it interesting that cx, a pointer, is 0x0001 at js_Invoke().

It's also interesting that the crash occurs because mEditor is corrupt (has been freed?) at nsTextControlFrame:3177, but mEditor must have been ok during the many uses of it earlier in this function.

nsTextControlFrame::SetValue(nsTextControlFrame * const 0x001eb99c, const nsAString_internal & {...}) line 3177 + 33 bytes
nsTextControlFrame::SetProperty(nsTextControlFrame * const 0x02a5150c, nsPresContext * 0x029c0058, nsIAtom * 0x010b4c20, const nsAString_internal & {...}) line 2342
nsHTMLInputElement::SetValueInternal(nsHTMLInputElement * const 0x001eb99c, const nsAString_internal & {...}, nsITextControlFrame * 0x029c0058) line 788
nsHTMLInputElement::SetValue(nsHTMLInputElement * const 0x02af8ff0, const nsAString_internal & {...}) line 714
XPTC_InvokeByIndex(nsISupports * 0x02af8ff0, unsigned int 88, unsigned int 1, nsXPTCVariant * 0x0012e4ac) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 16777218) line 2152 + 21 bytes
XPC_WN_GetterSetter(JSContext * 0x02b5f3d0, JSObject * 0x025a7be0, unsigned int 1, long * 0x0297430c, long * 0x0012e72c) line 1469 + 11 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 1188 + 17 bytes
js_InternalInvoke(JSContext * 0x02ce3178, JSObject * 0x025a7be0, long 38819904, unsigned int 0, unsigned int 1, long * 0x0012ea1c, long * 0x0012ea1c) line 1285 + 18 bytes
js_InternalGetOrSet(JSContext * 0x02b5f3d0, JSObject * 0x025a7be0, long 18182488, long 38819904, int 8, unsigned int 1, long * 0x0012ea1c, long * 0x0012ea1c) line 1344 + 25 bytes
js_SetProperty(JSContext * 0x02b5f3d0, JSObject * 0x025a7be0, long 18182488, long * 0x0012ea1c) line 3087 + 33 bytes
js_Interpret(JSContext * 0x02b5f3d0, unsigned char * 0x0296eb4f, long * 0x0012ead0) line 3419 + 733 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 1208 + 12 bytes
js_InternalInvoke(JSContext * 0x02ce3154, JSObject * 0x024ddfe0, long 45604408, unsigned int 0, unsigned int 1, long * 0x0012ed58, long * 0x0012ed58) line 1285 + 18 bytes
js_InternalGetOrSet(JSContext * 0x02b5f3d0, JSObject * 0x024ddfe0, long 18182488, long 45604408, int 8, unsigned int 1, long * 0x0012ed58, long * 0x0012ed58) line 1344 + 25 bytes
js_SetProperty(JSContext * 0x02b5f3d0, JSObject * 0x024ddfe0, long 18182488, long * 0x0012ed58) line 3087 + 33 bytes
js_Interpret(JSContext * 0x02b5f3d0, unsigned char * 0x0271d669, long * 0x0012ee0c) line 3419 + 733 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 1208 + 12 bytes
js_InternalInvoke(JSContext * 0x02b5f3f8, JSObject * 0x0257e8b8, long 39484704, unsigned int 0, unsigned int 1, long * 0x0012efd4, long * 0x0012efe8) line 1285 + 18 bytes
JS_CallFunctionValue(JSContext * 0x02b5f3d0, JSObject * 0x0257e8b8, long 39484704, unsigned int 1, long * 0x0012efd4, long * 0x0012efe8) line 4171 + 26 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x001eb99c, JSObject * 0x0257e8b8, JSObject * 0x025a7d20, unsigned int 1, long * 0x0012efd4, long * 0x0012efe8) line 1411 + 24 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02b5f3d0, nsIDOMEvent * 0x02cf0de0) line 186 + 28 bytes
nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const 0x001eb99c, nsListenerStruct * 0x02ac9368, nsIDOMEvent * 0x02cf0de0, nsIDOMEventTarget * 0x02a11108, unsigned int 47123944, unsigned int 26351584) line 1688
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x029aac68, nsPresContext * 0x00000000, nsEvent * 0x00000002, nsIDOMEvent * * 0x0012f208, nsIDOMEventTarget * 0x02a11108, unsigned int 7, nsEventStatus * 0x0012f354) line 1768
nsXULElement::HandleDOMEvent(nsXULElement * const 0x001eb99c, nsPresContext * 0x029c0058, nsEvent * 0x0012f308, nsIDOMEvent * * 0x0012f208, unsigned int 7, nsEventStatus * 0x0012f354) line 2139
PresShell::HandleDOMEventWithTarget(PresShell * const 0x028e78bc, nsIContent * 0x028e78bc, nsEvent * 0x0012f308, nsEventStatus * 0x0012f354) line 6478
nsButtonBoxFrame::DoMouseClick(nsButtonBoxFrame * const 0x001eb99c, nsGUIEvent * 0x0012f464, int 0) line 182
nsButtonBoxFrame::MouseClicked(nsButtonBoxFrame * const 0x001eb99c, nsPresContext * 0x029c0058, nsGUIEvent * 0x0012f464) line 61 + 11 bytes
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x02753eb0, nsPresContext * 0x029c0058, nsGUIEvent * 0x0012f464, nsEventStatus * 0x0012f824) line 150
PresShell::HandleEventInternal(PresShell * const 0x001eb99c, nsEvent * 0x00000000, nsIView * 0x00000000, unsigned int 1, nsEventStatus * 0x0012f824) line 6422
PresShell::HandleEventWithTarget(PresShell * const 0x02bd9870, nsEvent * 0x0012f464, nsIFrame * 0x02753eb0, nsIContent * 0x02ac92a8, unsigned int 1, nsEventStatus * 0x0012f824) line 6277
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 0x001eb99c, nsPresContext * 0x029c0058, nsMouseEvent * 0x02bd9870, nsEventStatus * 0x0012f824) line 3039
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x02c08850, nsPresContext * 0x029c0058, nsEvent * 0x0012f95c, nsIFrame * 0x02753eb0, nsEventStatus * 0x0012f824, nsIView * 0x027bfac0) line 2016 + 13 bytes
PresShell::HandleEventInternal(PresShell * const 0x001eb99c, nsEvent * 0x00000000, nsIView * 0x027bfac0, unsigned int 1, nsEventStatus * 0x0012f824) line 6451 + 59 bytes
PresShell::HandleEvent(PresShell * const 0x00000000, nsIView * 0x027bfac0, nsGUIEvent * 0x0012f95c, nsEventStatus * 0x0012f824, int 1, int & 34829480) line 6215 + 19 bytes
nsViewManager::HandleEvent(nsViewManager * const 0x001eb99c, nsView * 0x00000000, nsGUIEvent * 0x0012f95c, int 34687160) line 2559
nsViewManager::DispatchEvent(nsViewManager * const 0x02b5d258, nsGUIEvent * 0x027bfac0, nsEventStatus * 0x0012f8b0) line 2246 + 30 bytes
HandleEvent(nsGUIEvent * 0x0012f95c) line 174
nsWindow::DispatchEvent(nsWindow * const 0x02b1a204, nsGUIEvent * 0x0012f95c, nsEventStatus & nsEventStatus_eIgnore) line 1258 + 3 bytes
nsWindow::DispatchWindowEvent(nsWindow * const 0x001eb99c, nsGUIEvent * 0x00000000) line 1279
nsWindow::DispatchMouseEvent(nsWindow * const 0x001eb99c, unsigned int 301, unsigned int 0, nsPoint * 0x00000000) line 6019
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x001eb99c, unsigned int 301, unsigned int 0, nsPoint * 0x00000000) line 6270 + 19 bytes
nsWindow::ProcessMessage(nsWindow * const 0x001eb99c, unsigned int 514, unsigned int 0, long 22282827, long * 0x0012fcac) line 4662 + 16 bytes
nsWindow::WindowProc(HWND__ * 0x000b0aa0, unsigned int 514, unsigned int 0, long 45195780) line 1440 + 16 bytes
USER32! 77e4158f()
USER32! 77e41dc9()
USER32! 77e41e7e()
nsAppStartup::Run(nsAppStartup * const 0x0114be08) line 151
XRE_main(int 25744536, char * * 0x0091baac, const nsXREAppData * 0x0114be08) line 2376
main(int 1, char * * 0x00917d00) line 61 + 18 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 7c598989()

Comment 6

[timeless]

unfortunately the 0x1 is probably your optimizer playing tricks on your debugger. it's not worth much.

if you can trigger this, please rebuild --disable-optimize. although beyond that, i'm not sure what to do (i clearly didn't spend much time worrying about this bug).

Comment 7

[Martijn Wargers (dead)]

I suspect the fix from bug 373586 might have fixed this.

Comment 8

[Mats Palmgren (inactive)]

Can anyone still reproduce this crash in a recent trunk build?

Comment 9

[Mats Palmgren (inactive)]

-> WORKSFORME