Closed Bug 304420 Opened 18 years ago Closed 18 years ago

Crash regression [@ nsWindowSH::SetProperty]

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
Windows 2000
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: stevee, Assigned: jst)

References

Details

(Keywords: crash, regression, topcrash+)

Crash Data

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050812
Firefox/1.0+ ID:2005081203

Many crash reports have been filed recently @ nsWindowSH::SetProperty

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsWindowSH%3A%3ASetProperty&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

For me, I will get crashes just by visiting http://news.bbc.co.uk
Others report that simply going to http://www.nu.nl or 
http://www.newscientist.com/home.ns result in a similar crash.
None of the sites crash for me with Mozilla/5.0 (Windows; U; Windows NT 5.0;
en-US; rv:1.8b4) Gecko/20050810 Firefox/1.0+ ID:2005081009
I can crash on newscientist.com but only if I have either Adblock or
MediaPlayerConnectivity extensions. With both disabled, I don't crash.
Nominating to block, this only appeared in yesterdays builds and there are 37 TB
reports so this will become a high topcrash when the topcrash list updates later
today.
Flags: blocking1.8b4?
No problems for me.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050811
Firefox/1.0+ ID:2005081123

Suggests one of these checkins:
http://tinderbox.mozilla.org/bonsai/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1123829262

Hmm. If I disable extension MediaPlayerConnectivity 0.40 then the crash seems to
go away. INVALID?
(In reply to comment #5)
> Hmm. If I disable extension MediaPlayerConnectivity 0.40 then the crash seems to
> go away. INVALID?

I was about to confirm that, but I just got TB8310215H - definitely without
mediaplayerconnectivity.
Incident ID: 8310215
Stack Signature	nsWindowSH::SetProperty a0aca8bc
Product ID	FirefoxTrunk
Build ID	2005081106
Trigger Time	2005-08-12 06:49:39.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	firefox.exe + (0013c9e2)
URL visited	.
User Comments	
Since Last Crash	6325 sec
Total Uptime	13168 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp,
line 3922
Stack Trace 	
nsWindowSH::SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp,
line 3922]
XPC_WN_Helper_SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 910]
js_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2843]
JS_GetElement 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3019]
XPC_WN_Helper_SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 910]
js_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2843]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3307]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1193]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3464]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1193]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1270]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3919]
nsJSContext::GetGlobalObject 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1495]
nsGlobalWindow::GetScrollInfo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6253]
WindowStateHolder::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6492]
nsAppStartup::Observe 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 495]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
KERNEL32.DLL + 0x2893d (0x7c59893d)
Assignee: nobody → general
Component: General → DOM
Product: Firefox → Core
QA Contact: general → ian
*** Bug 304429 has been marked as a duplicate of this bug. ***
Mossop has duped me to this bug, but I don't get a crash by simply visiting
http://www.nu.nl/ 
For steps how to reproduce the crash see Bug 304429.
http://news.bbc.co.uk is ok here but
http://www.newscientist.com/home.ns crashes only with Adblock+ 0.5.9 enabled
(it's enough to disable it in Adblock Preferences)
http://www.nu.nl/ sometimes crashes even with Adblock+ disabled in EM

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050812
Firefox/1.0+ ID:2005081207
I get a crash everywhere, without any extensions, when using the Continuous
Reload Bookmarklet: http://subsimple.com/bookmarklets/collection_navigation.asp
This worked well yesterday, also with Adblock enabled.
Also reported by someone else on the forum.
The name is a tiny bit different: nsWindowSH::GetProperty
TB8318586Y TB8318650H 
I didn't get a crash on any of those sites with Adblock Plus 0.5.9 enabled. 
However, the 20050812 build crashes constantly with SessionSaver 0.2.1.028
enabled.  This only started happening with today's build. After disabling
SessionSaver, the crashes go away. 

The other extensions I have installed and enabled are IEview 1.2.4, OpenBook
1.2.0, Download Manager Tweak 0.7, Remove It Permanently 1.0.4, De-ImageShack
0.5.3, downTHEMall! 0.9, Thumbs 0.5, bugMeNot 0.6.2, Download Embedded 0.1,
GreaseMonkey 0.5, undoclosetab 20041125.4.1

Currently the build works with all these extensions enabled, as long as
SessionSaver is disabled.
Been using a newer build for a little bit now. Tested all the sites mentioned
here and no problems for me. I do not have sessionsave or mediaplayerconnectivity.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050812
Firefox/1.0+ ID:2005081216
OS: Windows 2000 → All
Hardware: PC → All
OS: All → Windows 2000
Hardware: All → PC
Not absolutely sure it's related, but I've crashed several times during the last
couple of days (using recent nightlies) on nsWindowSH::GetProperty. This happens
not when I load a site, but when I try to select something from a menu.

I'm on OS X (last crash was with the 2005-08-13 branch nightly). Track back ID
is TB8358282Q. Here's the top of the stack (from the Apple crash reporter):

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   org.mozilla.firefox 	0x0021a6a4
nsWindowSH::GetProperty(nsIXPConnectWrappedNative*, JSContext*, JSObject*, long,
long*, int*) + 348
1   org.mozilla.firefox 	0x004437bc XPCCallContext::SetReturnValueWasSet(int) + 1996
2   libmozjs.dylib      	0x06041064 js_GetProperty + 1000
3   libmozjs.dylib      	0x06033710 js_Interpret + 26576
4   libmozjs.dylib      	0x0602bfc4 js_Invoke + 1836
5   libmozjs.dylib      	0x0602c1d0 js_InternalInvoke + 184
6   libmozjs.dylib      	0x0600715c JS_CallFunctionValue + 44
7   org.mozilla.firefox 	0x0023af28 nsJSContext::CallEventHandler(JSObject*,
JSObject*, unsigned, long*, long*) + 284
8   org.mozilla.firefox 	0x00571774 nsJSEventListener::HandleEvent(nsIDOMEvent*)
+ 948
9   org.mozilla.firefox 	0x001c8d00
nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEvent*,
nsIDOMEventTarget*, unsigned, unsigned) + 576
10  org.mozilla.firefox 	0x001c9034
nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**,
nsIDOMEventTarget*, unsigned, nsEventStatus*) + 736
11  org.mozilla.firefox 	0x001fd4fc nsXULElement::HandleDOMEvent(nsPresContext*,
nsEvent*, nsIDOMEvent**, unsigned, nsEventStatus*) + 2336
12  org.mozilla.firefox 	0x0030846c nsMenuX::OnCreate() + 312

Looking at the talkback data there are no crashes since the 08/11 build which
match the stack signiture of comment 0 so this may be fixed. However there is a
large talkback backlog so this should be left open for a few days to see if any
new incidents appear.
New ones with the testcase of Bug 304429:

TB8383977Z
TB8383972E
TB8383962G
bug 304726 has the same/similar crash as mentioned in comment 14. Are these related?
This has a major topcrasher and a regression:
http://talkback-public.mozilla.org/reports/firefox/FFTrunk/FFTrunk-topcrashers.html

Also see bug 304590 for possible dupness.
Keywords: topcrash+
Flags: blocking1.8b4? → blocking1.8b4+
(In reply to comment #18)
> This has a major topcrasher and a regression:
>
http://talkback-public.mozilla.org/reports/firefox/FFTrunk/FFTrunk-topcrashers.html

Jay, the topcrash data shows no crashes since the 08 11 06 build, am I reading
the data correctly? If so this looks like it was fixed by one of the splitwindow
followup patches.
Yes, I noticed that too.  I just wanted to wait a couple of days to make sure no
other crashes came in (we have a big backlog of incidents right now).  But I
think it is safe to say this went away and bug 304590 is the new location of the
crash (if some patch did indeed "fix" this one).  

If we can find a patch the actually "fixed" this, we can mark it fixed,
otherwise, I usually mark topcrashers that "disappear" as WFM.

Reassinging to jst since he would probably be the best person to ask about any
recent checkins that might have fixed this.
Assignee: general → jst
I don't see any crashes at nsWindowSH::SetProperty or nsWindowSH::GetProperty
(bug 304590) since Aug 16 on trunk or branch.  Marking WFM.

I used the "topcrashers by build" tables at
http://talkback-public.mozilla.org/reports/firefox/.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → WORKSFORME
Flags: blocking1.8b4+
Crash Signature: [@ nsWindowSH::SetProperty]
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.