Closed Bug 319168 Opened 19 years ago Closed 18 years ago

random crash while download manager download files [@ js_SetClassPrototype ]

Categories

(Core :: DOM: Core & HTML, defect)

1.8 Branch
x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 307317

People

(Reporter: jeanmichel.reghem, Unassigned)

References

()

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

--> crash Talkback ID TB12618303X

Stack Signature	 js_SetClassPrototype 1e10869b
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2005-12-05 04:55:08.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0002f7b1)
URL visited	crash during save file at http://mastuvu.typepad.com/monuments/2005/12/podcasting_the_.html
User Comments	
Since Last Crash	632575 sec
Total Uptime	632575 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 3896
Stack Trace 	
js_SetClassPrototype  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 3896]
js_InitObjectClass  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1799]
InitFunctionAndObjectClasses  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 1131]
JS_ResolveStandardClass  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 1418]
nsWindowSH::NewResolve  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5527]
XPC_WN_Helper_NewResolve  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1063]
js_LookupPropertyWithFlags  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2675]
js_LookupProperty  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2580]
js_GetProperty  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2865]
XPCWrappedNativeScope::SetGlobal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 192]
nsXPConnect::InitClassesWithNewWrappedGlobal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 547]
nsGlobalWindow::SetNewDocument  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1060]
nsGlobalWindow::SetNewDocument  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 809]
DocumentViewerImpl::Init  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 633]
nsDocShell::Embed  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp, line 4554]
nsDocShell::CreateContentViewer  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp, line 5660]
nsDSURIContentListener::DoContent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/docshell/base/nsDSURIContentListener.cpp, line 131]
nsDocumentOpenInfo::TryContentListener  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/uriloader/base/nsURILoader.cpp, line 776]
nsDocumentOpenInfo::DispatchContent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/uriloader/base/nsURILoader.cpp, line 500]
nsDocumentOpenInfo::OnStartRequest  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/uriloader/base/nsURILoader.cpp, line 345]
nsCachedChromeChannel::HandleLoadEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/chrome/src/nsChromeProtocolHandler.cpp, line 396]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsFormControlList::QueryInterface  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLFormElement.cpp, line 1777]
0xf845d908

Reproducible: Couldn't Reproduce

Steps to Reproduce:
--> going to the link http://mastuvu.typepad.com/monuments/2005/12/podcasting_the_.html
--> open link http://www2.175-25.be/podcast_fr_advanced.xml "in a new tab" ("French" link after "Or subscribe in iTunes")
--> dialog box asking with which program download .xml
--> choose save disk
--> open link http://www2.175-25.be/podcast_fr.xml (First "french" link after "Yep, nice new podcasts in")
--> open in new tab
--> same dialog
--> save to disk
--> crash just after the complete downloading
--> 1 hour later, crash ( see TB12620201Z ) ... not yet processed on talkback

--> RSS feed Rumbling edge in Thunderbird giving a link to the futur candidate for TB 1.5 RC2
--> click
--> open in firefox
--> dialog box
--> save as
--> crash after 21%

(tried later --> no crash)
Keywords: crash
Version: unspecified → 1.5 Branch
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051204 Firefox/1.5

WFM. Can't get it to crash here with a branch or trunk build.
i want to blame dom/classinfo, i'm hoping they forgot to protect a newborn somewhere obvious.
Assignee: nobody → general
Component: Download Manager → DOM
Product: Firefox → Core
QA Contact: download.manager → ian
Version: 1.5 Branch → 1.8 Branch
I don't see where...
same circumstances, same top of stack (rest of stack is not the same as mine until nsDOMClassInfo) ...  

(the downloaded file in question installed fine, even though no visual confirmation that download completed - download manager was at 9<something>% when crash occured)

Incident ID: 14281095
Stack Signature	js_SetClassPrototype 42bb8fa3
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2006-01-22 11:31:23.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0002f7b1)
URL visited	
User Comments	very near end of downloading eudora 7.0 from eudora.com s/vseerror
Since Last Crash	1820900 sec
Total Uptime	3200364 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 3896
Stack Trace 	
js_SetClassPrototype  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 3896]
js_InitArrayClass  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsarray.c, line 1808]
nsWindowSH::NewResolve  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5527]
XPC_WN_Helper_NewResolve  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1063]
js_LookupPropertyWithFlags  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2675]
js_FindConstructor  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2070]
GetClassPrototype  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 3802]
js_NewObject  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1950]
js_NewArrayObject  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsarray.c, line 1821]
nsWindowWatcher::AttachArguments  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp, line 1750]
nsWindowWatcher::OpenWindowJS  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp, line 709]
nsWindowWatcher::OpenWindow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp, line 476]
nsAlertsService::ShowAlertNotification  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/alerts/src/nsAlertsService.cpp, line 122]
nsDownload::OnStateChange  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/downloads/src/nsDownloadManager.cpp, line 2146]
nsDownloadProxy::OnStateChange  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/build/../downloads/src\nsDownloadProxy.h, line 163]
nsExternalAppHandler::ExecuteDesiredAction  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/uriloader/exthandler/nsExternalHelperAppService.cpp, line 2068]
nsExternalAppHandler::OnStopRequest  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/uriloader/exthandler/nsExternalHelperAppService.cpp, line 2016]
nsDocumentOpenInfo::OnStopRequest  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/uriloader/base/nsURILoader.cpp, line 390]
nsStreamListenerTee::OnStopRequest  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsStreamListenerTee.cpp, line 65]
*** Bug 325066 has been marked as a duplicate of this bug. ***
*** Bug 323756 has been marked as a duplicate of this bug. ***
(In reply to comment #6)
> *** Bug 325066 has been marked as a duplicate of this bug. ***
> 

325066 is my bug.  In order to help anyone trying to resolve this, the bug also occurrs under MacOS.  In the original bug report, there's an attachment of the Apple Crash Reporter logs covering crashes for almost the last month.
brendan, there's nothing spidermonkey wouldn't like about this stack, right?
js_SetClassPrototype 
js_InitArrayClass 
nsWindowSH::NewResolve 
XPC_WN_Helper_NewResolve 
js_LookupPropertyWithFlags 
js_FindConstructor 
GetClassPrototype 
js_NewObject 
js_NewArrayObject 
Does this not look like bug 307317 (last reviewed patch should fix)?

/be
Whiteboard: DUPEME
i was leaning toward that yes (but for some reason i decided that there must have been a reasonable reason for having the enterlocalrootscope *after* the newobject, shame on me). sold.

*** This bug has been marked as a duplicate of 307317 ***
Status: UNCONFIRMED → RESOLVED
Closed: 18 years ago
Resolution: --- → DUPLICATE
Whiteboard: DUPEME
Summary: random crash while download manager download files [ @ js_SetClassPrototype ] → random crash while download manager download files [@ js_SetClassPrototype ]
Crash Signature: [@ js_SetClassPrototype ]
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.