306580 - Crash when refreshing view source [@ nsDocShell::GetRootSHEntry ]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P1)

Description

[Joe Drew (not getting mail)]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b4) Gecko/20050831 Firefox/1.0+

View source on any page, then press Ctrl+R to refresh. Firefox crashes.

I've submitted a couple of talkback incidents on this, but they're not available
in the public queue yet.

Comment 1

[u63580]

See the same crash on WinXP: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8b4) Gecko/20050831 Firefox/1.0+.  Seemed to be fine in 20050829 build. 
Talkback ID from my crash is TB8899853Z.

Comment 2

[Aaron Slunt]

Confirming Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4)
Gecko/20050831 Firefox/1.0+ ID:2005083104

Talkback ID: TB8900111Z

Comment 3

[Scott MacGregor]

Triage team: this looks like a pretty serious cash regression from something we
took in the last two days. 

Stack Trace:

0x00000000
GetRootSHEntry 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 7744]
nsDocShell::SetHistoryEntry 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 7765]
nsDocShell::InternalLoad 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 6436]
nsDocShell::LoadHistoryEntry 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 7518]
nsDocShell::Reload 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 3119]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2134]

Comment 4

[Scott MacGregor]

The only change I see to nsDocshell over the regression window was for Bug
305129 but that doesn't look related.

Comment 5

[Mike Schroepfer]

Bz - can you take a look?

Comment 6

[Boris Zbarsky [:bzbarsky]]

This was exposed by the fix for bug 305959.  The real problem was presumably
checked in sometime between August 16 (which is when bug 289933 was fixed) and
when bug 305959 was fixed...

Comment 7

[Scott MacGregor]

This crash was introduced by Bug 305959. Backing out that change to jsapi.c
makes the crash go away in Firefox.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Scott, see comment 6.  Bug 305959 just reenabled a codepath that had started
crashing sometime before it was checked in; it did not cause the crash.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Whatever patch caused this landed on trunk in this range: 
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-08-24+07%3A00%3A00&maxdate=2005-08-25+07%3A00%3A00&cvsroot=%2Fcvsroot

Comment 10

[Scott MacGregor]

sorry I didn't see the bugzilla comment on your insight.

This change looked interesting: Bug 305167 which went into the branch and trunk
during the target window. I'll look through the rest of the list too.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Whatever patch caused this went into the branch in this range:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=MOZILLA_1_8_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-08-23+21%3A00%3A00&maxdate=2005-08-24+14%3A10%3A00&cvsroot=%2Fcvsroot

Still narrowing it down further.

Comment 12

[Boris Zbarsky [:bzbarsky]]

This was caused by the fix for bug 300533; verified via local backout.

Comment 13

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

The comment pretty much describes what's going on.

Asking for 1.8b4 approval too -- this is a very safe fix to just prevent an
object from dying while we're working with it.

Comment 14

[Scott MacGregor]

Comment on attachment 194507 [details] [diff] [review]
Fix

this looks like a very straight forward crash fix with little risk.

approving for the 1.8 branch

Comment 15

[Boris Zbarsky [:bzbarsky]]

Fixed trunk and branch.

Comment 16

[Brendan Eich [:brendan]]

Comment on attachment 194507 [details] [diff] [review]
Fix

Nit: blank line around that added paragraph?

/be

Comment 17

[Bob Clary [:bc] (inactive)]

no crash firefox 1.5 rc2 winxp/linux