Closed Bug 304420 Opened 19 years ago Closed 19 years ago

Crash regression [@ nsWindowSH::SetProperty]

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
Windows 2000
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: stevee, Assigned: jst)

References

Details

(Keywords: crash, regression, topcrash+)

Crash Data

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050812 Firefox/1.0+ ID:2005081203 Many crash reports have been filed recently @ nsWindowSH::SetProperty http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsWindowSH%3A%3ASetProperty&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid For me, I will get crashes just by visiting http://news.bbc.co.uk Others report that simply going to http://www.nu.nl or http://www.newscientist.com/home.ns result in a similar crash.
None of the sites crash for me with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050810 Firefox/1.0+ ID:2005081009
I can crash on newscientist.com but only if I have either Adblock or MediaPlayerConnectivity extensions. With both disabled, I don't crash.
Nominating to block, this only appeared in yesterdays builds and there are 37 TB reports so this will become a high topcrash when the topcrash list updates later today.
Flags: blocking1.8b4?
No problems for me. Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050811 Firefox/1.0+ ID:2005081123 Suggests one of these checkins: http://tinderbox.mozilla.org/bonsai/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1123829262
Hmm. If I disable extension MediaPlayerConnectivity 0.40 then the crash seems to go away. INVALID?
(In reply to comment #5) > Hmm. If I disable extension MediaPlayerConnectivity 0.40 then the crash seems to > go away. INVALID? I was about to confirm that, but I just got TB8310215H - definitely without mediaplayerconnectivity.
Incident ID: 8310215 Stack Signature nsWindowSH::SetProperty a0aca8bc Product ID FirefoxTrunk Build ID 2005081106 Trigger Time 2005-08-12 06:49:39.0 Platform Win32 Operating System Windows NT 5.0 build 2195 Module firefox.exe + (0013c9e2) URL visited . User Comments Since Last Crash 6325 sec Total Uptime 13168 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 3922 Stack Trace nsWindowSH::SetProperty [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 3922] XPC_WN_Helper_SetProperty [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 910] js_GetProperty [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2843] JS_GetElement [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3019] XPC_WN_Helper_SetProperty [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 910] js_GetProperty [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2843] js_Interpret [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3307] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1193] js_Interpret [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3464] js_Invoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1193] js_InternalInvoke [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1270] JS_CallFunctionValue [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3919] nsJSContext::GetGlobalObject [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1495] nsGlobalWindow::GetScrollInfo [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6253] WindowStateHolder::QueryInterface [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6492] nsAppStartup::Observe [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 495] main [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61] KERNEL32.DLL + 0x2893d (0x7c59893d)
Assignee: nobody → general
Component: General → DOM
Product: Firefox → Core
QA Contact: general → ian
*** Bug 304429 has been marked as a duplicate of this bug. ***
Mossop has duped me to this bug, but I don't get a crash by simply visiting http://www.nu.nl/ For steps how to reproduce the crash see Bug 304429.
http://news.bbc.co.uk is ok here but http://www.newscientist.com/home.ns crashes only with Adblock+ 0.5.9 enabled (it's enough to disable it in Adblock Preferences) http://www.nu.nl/ sometimes crashes even with Adblock+ disabled in EM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050812 Firefox/1.0+ ID:2005081207
I get a crash everywhere, without any extensions, when using the Continuous Reload Bookmarklet: http://subsimple.com/bookmarklets/collection_navigation.asp This worked well yesterday, also with Adblock enabled. Also reported by someone else on the forum. The name is a tiny bit different: nsWindowSH::GetProperty TB8318586Y TB8318650H
I didn't get a crash on any of those sites with Adblock Plus 0.5.9 enabled. However, the 20050812 build crashes constantly with SessionSaver 0.2.1.028 enabled. This only started happening with today's build. After disabling SessionSaver, the crashes go away. The other extensions I have installed and enabled are IEview 1.2.4, OpenBook 1.2.0, Download Manager Tweak 0.7, Remove It Permanently 1.0.4, De-ImageShack 0.5.3, downTHEMall! 0.9, Thumbs 0.5, bugMeNot 0.6.2, Download Embedded 0.1, GreaseMonkey 0.5, undoclosetab 20041125.4.1 Currently the build works with all these extensions enabled, as long as SessionSaver is disabled.
Been using a newer build for a little bit now. Tested all the sites mentioned here and no problems for me. I do not have sessionsave or mediaplayerconnectivity. Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050812 Firefox/1.0+ ID:2005081216
OS: Windows 2000 → All
Hardware: PC → All
OS: All → Windows 2000
Hardware: All → PC
Not absolutely sure it's related, but I've crashed several times during the last couple of days (using recent nightlies) on nsWindowSH::GetProperty. This happens not when I load a site, but when I try to select something from a menu. I'm on OS X (last crash was with the 2005-08-13 branch nightly). Track back ID is TB8358282Q. Here's the top of the stack (from the Apple crash reporter): Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000000 Thread 0 Crashed: 0 org.mozilla.firefox 0x0021a6a4 nsWindowSH::GetProperty(nsIXPConnectWrappedNative*, JSContext*, JSObject*, long, long*, int*) + 348 1 org.mozilla.firefox 0x004437bc XPCCallContext::SetReturnValueWasSet(int) + 1996 2 libmozjs.dylib 0x06041064 js_GetProperty + 1000 3 libmozjs.dylib 0x06033710 js_Interpret + 26576 4 libmozjs.dylib 0x0602bfc4 js_Invoke + 1836 5 libmozjs.dylib 0x0602c1d0 js_InternalInvoke + 184 6 libmozjs.dylib 0x0600715c JS_CallFunctionValue + 44 7 org.mozilla.firefox 0x0023af28 nsJSContext::CallEventHandler(JSObject*, JSObject*, unsigned, long*, long*) + 284 8 org.mozilla.firefox 0x00571774 nsJSEventListener::HandleEvent(nsIDOMEvent*) + 948 9 org.mozilla.firefox 0x001c8d00 nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEvent*, nsIDOMEventTarget*, unsigned, unsigned) + 576 10 org.mozilla.firefox 0x001c9034 nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsIDOMEventTarget*, unsigned, nsEventStatus*) + 736 11 org.mozilla.firefox 0x001fd4fc nsXULElement::HandleDOMEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, unsigned, nsEventStatus*) + 2336 12 org.mozilla.firefox 0x0030846c nsMenuX::OnCreate() + 312
Looking at the talkback data there are no crashes since the 08/11 build which match the stack signiture of comment 0 so this may be fixed. However there is a large talkback backlog so this should be left open for a few days to see if any new incidents appear.
New ones with the testcase of Bug 304429: TB8383977Z TB8383972E TB8383962G
bug 304726 has the same/similar crash as mentioned in comment 14. Are these related?
This has a major topcrasher and a regression: http://talkback-public.mozilla.org/reports/firefox/FFTrunk/FFTrunk-topcrashers.html Also see bug 304590 for possible dupness.
Keywords: topcrash+
Flags: blocking1.8b4? → blocking1.8b4+
(In reply to comment #18) > This has a major topcrasher and a regression: > http://talkback-public.mozilla.org/reports/firefox/FFTrunk/FFTrunk-topcrashers.html Jay, the topcrash data shows no crashes since the 08 11 06 build, am I reading the data correctly? If so this looks like it was fixed by one of the splitwindow followup patches.
Yes, I noticed that too. I just wanted to wait a couple of days to make sure no other crashes came in (we have a big backlog of incidents right now). But I think it is safe to say this went away and bug 304590 is the new location of the crash (if some patch did indeed "fix" this one). If we can find a patch the actually "fixed" this, we can mark it fixed, otherwise, I usually mark topcrashers that "disappear" as WFM. Reassinging to jst since he would probably be the best person to ask about any recent checkins that might have fixed this.
Assignee: general → jst
I don't see any crashes at nsWindowSH::SetProperty or nsWindowSH::GetProperty (bug 304590) since Aug 16 on trunk or branch. Marking WFM. I used the "topcrashers by build" tables at http://talkback-public.mozilla.org/reports/firefox/.
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → WORKSFORME
Flags: blocking1.8b4+
Crash Signature: [@ nsWindowSH::SetProperty]
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.