304590 - Crash [@ nsWindowSH::GetProperty] when loading a page with many frames

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Gérard Talbot]

This spins off bug 296639.

Actual results when loading specified URL: application crash!

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050813
Firefox/1.0+

Talkback incident id: TB8352469M

Notes: 
- I don't crash with Seamonkey 1.0a rv:1.9a1 build 2005081305
- I also crashed with another Deer Park 1.8b4 build: see TB8324208G

Comment 1

[Gérard Talbot]

Incident ID: 8352469

Trigger reason: Access violation

Source File, Line No.	
nsWindowSH::GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp,
line 3866]

Stack:
nsWindowSH::GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp,
line 3866]
XPC_WN_Helper_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 904]
js_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2854]
JS_GetElement 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3019]
XPC_WN_Helper_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 904]
js_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2854]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3307]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1193]
nsXPCWrappedJSClass::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 462]
SharedStub 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1597]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1698]
nsGlobalWindow::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 1241]
nsXULDocument::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1238]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2183]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2180]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2180]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2180]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2180]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2180]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2180]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2180]
nsXULElement::HandleChromeEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2881]
nsGlobalWindow::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 1228]
DocumentViewerImpl::LoadComplete 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsDocumentViewer.cpp,
line 1009]
nsDocShell::EndPageLoad 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 4651]
nsWebShell::EndPageLoad 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/base/nsWebShell.cpp,
line 667]
nsDocShell::OnStateChange 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 4577]
nsDocLoader::FireOnStateChange 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 1210]
nsDocLoader::doStopDocumentLoad 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 844]
nsDocLoader::OnStopRequest 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/uriloader/base/nsDocLoader.cpp,
line 665]
nsLoadGroup::RemoveRequest 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsLoadGroup.cpp,
line 732]
PresShell::RemoveDummyLayoutRequest 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 7101]
DummyLayoutRequestEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 7001]
0x778b0c24
nsHTMLInputElement::GetReadOnly 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 564]
0x85f8458b

Comment 2

[Gérard Talbot]

*** Bug 304591 has been marked as a duplicate of this bug. ***

Comment 3

[Samuel Sidler (old account; do not CC)]

Not sure if this is FF only or even if frames have to be involved, but bug
304726 has a similar crash. Could this possibly be a core bug and/or related to
bug 304420?

Comment 4

[Gérard Talbot]

> Not sure if this is FF only or even if frames have to be involved, but bug
> 304726 has a similar crash. Could this possibly be a core bug and/or related to
> bug 304420?

I'm not an expert at all regarding crashes and stacktrace. I'm not suggesting or
implying that bug 304420 is not related somehow/somewhat to this bug. But I know
that this bug's stack signature is
nsWindowSH::GetProperty 
while bug 304420 stack signature is
nsWindowSH::SetProperty

Can someone else confirm that loading the provided URL in a recent Firefox trunk
build (1.9a1) crashes? How about Camino users?

Dave Townsend (Mossop) and Samuel Sidler: you can resolve this bug as a
duplicate of whatever bug you want... The only thing that really matters to me
is that Firefox 1.8+ can load the provided URL in this bugfile and then render
the page accordingly without crashing. That provided URL is not any url: it's a
webpage (with entirely valid markup code) part of a test suite (admittedly
draft) at W3C!

I still crash with today's Firefox trunk build (1.9a1):
TB8397701X

Comment 5

[Samuel Sidler (old account; do not CC)]

This is not just FF, updating summary.

Comment 6

[Samuel Sidler (old account; do not CC)]

*** Bug 304726 has been marked as a duplicate of this bug. ***

Comment 7

[Jay Patel [:jay]]

This is a major topcrasher and needs to be looked at ASAP.  Not sure if it made
it onto the branch, but if it did, this should be a blocker.  It is the #1
crasher and appears to be a regression starting on 8/12:
http://talkback-public.mozilla.org/reports/firefox/FFTrunk/FFTrunk-topcrashers.html

This is also very similar (if not a dup in some way) to bug 304420.

Comment 8

[Jay Patel [:jay]]

Reassigning to jst since his checkin from Thur. 8/11 seems to be closest to the
spot of the crash:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/dom/src/base/nsDOMClassInfo.cpp&mark=3866&rev=#3866

Comment 9

[Gérard Talbot]

>  Not sure if it made
> it onto the branch, but if it did, this should be a blocker.

It did make the branch as far as I know. I first reported the crashes in bug
296639 comment #38. You can examined attachment 192615 [details].

Comment 10

[Gérard Talbot]

"
Getting consistent crashing on framed pages here. Talkback data: TB8321002G,
TB8320989E, TB8320960G, TB8320951E, TB8320942Z

Posted by: Ben Basson at August 12, 2005 02:06 PM
"
Coming from
http://weblogs.mozillazine.org/qa/archives/2005/08/need_some_help_1.html

Comment 11

[Gérard Talbot]

> >  Not sure if it made
> > it onto the branch, but if it did, this should be a blocker.
> 
> It did make the branch as far as I know. 

Oops... sorry. I don't know/am not sure if it did make the 1.8 branch. Sorry.

Comment 12

[Mitch]

Attachment: Crash from todays SeaMonkey CVS

Comment 13

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

*** Bug 304772 has been marked as a duplicate of this bug. ***

Comment 14

[Cameron Kaiser [:spectre]]

(In reply to comment #4)
> Can someone else confirm that loading the provided URL in a recent Firefox trunk
> build (1.9a1) crashes? How about Camino users?

Yes, it does affect Camino 0.9a2+ (2005081308) also, in case this wasn't clear.

Comment 15

[Alexey N. Solofnenko]

*I think*, I am crashing here because of AdblockPlus.

Comment 16

[OstGote!]

*** Bug 304614 has been marked as a duplicate of this bug. ***

Comment 17

[Stefan [:stefanh]]

*** Bug 304821 has been marked as a duplicate of this bug. ***

Comment 18

[Jesse Ruderman]

Fixed by jst in bug 296639:
https://bugzilla.mozilla.org/show_bug.cgi?id=296639#c39 patch
https://bugzilla.mozilla.org/show_bug.cgi?id=296639#c48 checkin

Comment 19

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050816
Firefox/1.0+ ID:2005081613

confirmed fixed

Comment 20

[Jay Patel [:jay]]

Marking fixed.  I will verify this per latest Talkback data in the next few days.

Comment 21

[Benoît]

Could this crash be the same one as I am experiencing when clicking the Adblock
label in the lower right at certain sites?

TB8464456W, TB8464415H, TB8464323Y, TB8463932X

Comment 22

[timeless]

those incident ids are all stale

Comment 23

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051003 
Firefox/1.4.1

verified fixed