321197 - crash [@ nsGlobalWindow::ClearAllTimeouts] while closing a window

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, defect, P5)

Description

[timeless]

user-agent: Viewer.exe (gecko from friday).

activity: using the next button in viewer's top 129 sites dialog to go to the next page. i had just started to try to close a popup window (stack frames 13..0c).

last interesting console output:
CSS Error (http://www.imaginegames.com/static.asp :14.154): Error in parsing value for property 'cursor'.  Declaration dropped.
CSS Error (http://www.imaginegames.com/static.asp :15.149): Error in parsing value for property 'cursor'.  Declaration dropped.

nspr output:
0[375118]: nsStorageStream [32c0ec8] Writing mWriteCursor=55501a7 mSegmentEnd=5550a88 count=1813
0[375118]: nsStorageStream [32c0ec8] Wrote mWriteCursor=55501a7 mSegmentEnd=5550a88 numWritten=1813
0[375118]: WARNING: NS_ENSURE_TRUE(mSaveLayoutState || !aState) failed, file r:/mozilla/docshell/shistory/src/nsSHEntry.cpp, line 298
0[375118]: nsStorageStream [32c0ec8] Close mWriteCursor=0 mSegmentEnd=0
0[375118]: xulelemap(34d858c) destroyed
0[375118]: nsCachedChromeChannel[49e1aa0]: destroyed
0[375118]: nsWebShell::Init: this=5bd4650
0[375118]: ###!!! ASSERTION: Not Yet Implemented: 'PR_FALSE', file r:/mozilla/webshell/tests/viewer/nsBrowserWindow.cpp, line 372
0[375118]: ###!!! ASSERTION: nsDOMEvent::DuplicatePrivateData() see bug 254036: 'NotYetImplemented', file r:/mozilla/content/events/src/nsDOMEvent.cpp, line 543
0[375118]: ###!!! ASSERTION: Not Yet Implemented: 'PR_FALSE', file r:/mozilla/webshell/tests/viewer/nsBrowserWindow.cpp, line 372
0[375118]: ###!!! ASSERTION: Not Yet Implemented: 'PR_FALSE', file r:/mozilla/webshell/tests/viewer/nsBrowserWindow.cpp, line 372
(14f4.213c): Unknown exception - code c0000096 (first chance)
0[375118]: ###!!! ASSERTION: nsDOMEvent::DuplicatePrivateData() see bug 254036: 'NotYetImplemented', file r:/mozilla/content/events/src/nsDOMEvent.cpp, line 543
(14f4.213c): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=000014f4 ebx=00000000 ecx=0012e3dc edx=00000000 esi=02128620 edi=0012f810
eip=012958f8 esp=0012ef88 ebp=0012ef9c iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210246
gklayout!nsGlobalWindow::ClearAllTimeouts+0x78:
012958f8 8b08             mov     ecx,[eax]         ds:0023:000014f4=????????

00 gklayout!nsGlobalWindow::ClearAllTimeouts(void)+0x78 (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\dom\src\base\nsglobalwindow.cpp @ 6671]
01 gklayout!nsGlobalWindow::FreeInnerObjects(struct JSContext * cx = 0x03d727e0)+0x3b (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\dom\src\base\nsglobalwindow.cpp @ 452]
02 gklayout!nsGlobalWindow::SetDocShell(class nsIDocShell * aDocShell = 0x00000000)+0xdf (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\dom\src\base\nsglobalwindow.cpp @ 1333]
03 docshell!nsDocShell::Destroy(void)+0x31e (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\docshell\base\nsdocshell.cpp @ 3548]
04 gklayout!nsFrameLoader::Destroy(void)+0xe6 (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\content\base\src\nsframeloader.cpp @ 233]
05 gklayout!nsGenericHTMLFrameElement::UnbindFromTree(int aDeep = 1, int aNullParent = 0)+0x32 (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\content\html\content\src\nsgenerichtmlelement.cpp @ 3459]
06 gklayout!nsGenericElement::UnbindFromTree(int aDeep = 1, int aNullParent = 0)+0x1ac (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\content\base\src\nsgenericelement.cpp @ 2019]
07 gklayout!nsGenericElement::UnbindFromTree(int aDeep = 1, int aNullParent = 1)+0x1ac (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\content\base\src\nsgenericelement.cpp @ 2019]
08 gklayout!nsDocument::Destroy(void)+0x8d (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\content\base\src\nsdocument.cpp @ 5137]
09 gklayout!DocumentViewerImpl::Close(class nsISHEntry * aSHEntry = 0x00000000)+0xd1 (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\layout\base\nsdocumentviewer.cpp @ 1346]
0a docshell!nsDocShell::Destroy(void)+0x270 (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\docshell\base\nsdocshell.cpp @ 3535]
0b viewer!nsBrowserWindow::Destroy(void)+0x4c (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\webshell\tests\viewer\nsbrowserwindow.cpp @ 244]
0c viewer!nsViewerApp::CloseWindow(class nsBrowserWindow * aBrowserWindow = 0x03c3aff0)+0x10 (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\webshell\tests\viewer\nsviewerapp.cpp @ 647]
0d viewer!HandleBrowserEvent(class nsGUIEvent * aEvent = 0x0012f34c)+0x9f (FPO: [Non-Fpo]) (CONV: cdecl) [r:\mozilla\webshell\tests\viewer\nsbrowserwindow.cpp @ 618]
0e gkwidget!nsWindow::DispatchEvent(class nsGUIEvent * event = 0x0012f34c, nsEventStatus * aStatus = 0x0012f330)+0xb5 (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 1163]
0f gkwidget!nsWindow::DispatchWindowEvent(class nsGUIEvent * event = 0x0012f34c)+0x24 (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 1184]
10 gkwidget!nsWindow::DispatchStandardEvent(unsigned int aMsg = 0x65)+0x50 (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 1203]
11 gkwidget!nsWindow::ProcessMessage(unsigned int msg = 0x10, unsigned int wParam = 0, long lParam = 0, long * aRetValue = 0x0012f788)+0x66e (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 4278]
12 gkwidget!nsWindow::WindowProc(struct HWND__ * hWnd = 0x001714f4, unsigned int msg = 0x10, unsigned int wParam = 0, long lParam = 0)+0x131 (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 1352]
13 USER32!InternalCallWinProc+0x28
14 USER32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo])
15 USER32!DispatchClientMessage+0xa3 (FPO: [Non-Fpo])
16 USER32!__fnDWORD+0x24 (FPO: [Non-Fpo])
17 ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0])
18 USER32!NtUserMessageCall+0xc
19 USER32!RealDefWindowProcW+0x47 (FPO: [Non-Fpo])
1a USER32!DefWindowProcW+0x72 (FPO: [Non-Fpo])
1b gkwidget!nsWindow::DefaultWindowProc(struct HWND__ * hWnd = 0x001714f4, unsigned int msg = 0x112, unsigned int wParam = 0xf060, long lParam = 0xd0258)+0x55 (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 1378]
1c USER32!InternalCallWinProc+0x28
1d USER32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo])
1e USER32!CallWindowProcAorW+0x98 (FPO: [Non-Fpo])
1f USER32!CallWindowProcW+0x1b (FPO: [Non-Fpo])
20 gkwidget!nsWindow::WindowProc(struct HWND__ * hWnd = 0x001714f4, unsigned int msg = 0x112, unsigned int wParam = 0xf060, long lParam = 0xd0258)+0x16f (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 1359]
21 USER32!InternalCallWinProc+0x28
22 USER32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo])
23 USER32!DispatchClientMessage+0xa3 (FPO: [Non-Fpo])
24 USER32!__fnDWORD+0x24 (FPO: [Non-Fpo])
25 ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0])
26 USER32!NtUserMessageCall+0xc
27 USER32!RealDefWindowProcW+0x47 (FPO: [Non-Fpo])
28 USER32!DefWindowProcW+0x72 (FPO: [Non-Fpo])
29 gkwidget!nsWindow::DefaultWindowProc(struct HWND__ * hWnd = 0x001714f4, unsigned int msg = 0xa1, unsigned int wParam = 0x14, long lParam = 0xd0258)+0x55 (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 1378]
2a USER32!InternalCallWinProc+0x28
2b USER32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo])
2c USER32!CallWindowProcAorW+0x98 (FPO: [Non-Fpo])
2d USER32!CallWindowProcW+0x1b (FPO: [Non-Fpo])
2e gkwidget!nsWindow::WindowProc(struct HWND__ * hWnd = 0x001714f4, unsigned int msg = 0xa1, unsigned int wParam = 0x14, long lParam = 0xd0258)+0x16f (FPO: [Non-Fpo]) (CONV: stdcall) [r:\mozilla\widget\src\windows\nswindow.cpp @ 1359]
2f USER32!InternalCallWinProc+0x28
30 USER32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo])
31 USER32!DispatchMessageWorker+0x306 (FPO: [Non-Fpo])
32 USER32!DispatchMessageA+0xf (FPO: [Non-Fpo])
33 viewer!nsNativeViewerApp::Run(void)+0xc3 (FPO: [Non-Fpo]) (CONV: thiscall) [r:\mozilla\webshell\tests\viewer\nswinmain.cpp @ 90]
34 viewer!main(int argc = 1, char ** argv = 0x00378fd0)+0x97 (FPO: [Non-Fpo]) (CONV: cdecl) [r:\mozilla\webshell\tests\viewer\nswinmain.cpp @ 159]
35 viewer!mainCRTStartup(void)+0x12c (FPO: [Non-Fpo]) (CONV: cdecl) [f:\vs70builds\3077\vc\crtbld\crt\src\crtexe.c @ 398]
36 kernel32!BaseProcessStart+0x23 (FPO: [Non-Fpo])

crashed line:
      timeout->mTimer->Cancel();

0:000> dv /t /v
0012ef8c class nsGlobalWindow * this = 0x0594efb8
0012ef90 struct nsTimeout * timeout = 0x0012e3d0
0012ef94 struct nsTimeout * next = 0x00000000
0012ef98 class nsIScriptContext * scx = 0x03d2c260


0:000> dt -n this -v mTimeouts
Local var [AddrFlags 90  AddrOff fffffff0  Reg/Val ebp (8)] @ 0x12ef8c Type nsGlobalWindow*
0x0594efb8 class nsGlobalWindow, 261 elements, 0x100 bytes
<snip>
   +0x0e4 mTimeouts : 0x05b5dd88 struct nsTimeout, 25 elements, 0x44 bytes
0:000> dt nsTimeout 0x05b5dd88 
   +0x000 mWindow          : 0x0594efb8 
   +0x004 mExpr            : 0x0395b108 
   +0x008 mFunObj          : (null) 
   +0x00c mTimer           : nsCOMPtr<nsITimer>
   +0x010 mArgv            : (null) 
   +0x014 mArgc            : 0
   +0x016 mCleared         : 0x1 ''
   +0x017 mRunning         : 0x1 ''
   +0x018 mPublicId        : 2
   +0x01c mInterval        : 0
   +0x020 mWhen            : 0x8a77010a
   +0x024 mPrincipal       : nsCOMPtr<nsIPrincipal>
   +0x028 mFileName        : 0x0399ba58  "http://www.imaginegames.com/pu2.asp?pop_cl=1&"
   +0x02c mLineNo          : 0x47
   +0x030 mVersion         : 0x0067b88c  "default"
   +0x034 mFiringDepth     : 1
   +0x038 mNext            : 0x0012e3d0 
   +0x03c mPopupState      : 2 ( openAbused )
   +0x040 mRefCnt          : 2
0:000> dt nsTimeout 0x0012e3d0 
   +0x000 mWindow          : 0x0012e524 
   +0x004 mExpr            : 0x0098007c 
   +0x008 mFunObj          : 0x00000002 
   +0x00c mTimer           : nsCOMPtr<nsITimer>
   +0x010 mArgv            : 0x0000213c  -> ??
   +0x014 mArgc            : 0x9a1d
   +0x016 mCleared         : 0x3e '>'
   +0x017 mRunning         : 0x4 ''
   +0x018 mPublicId        : 0
   +0x01c mInterval        : 0xfee05c80
   +0x020 mWhen            : 0x2021e
   +0x024 mPrincipal       : nsCOMPtr<nsIPrincipal>
   +0x028 mFileName        : (null) 
   +0x02c mLineNo          : 0x1300007
   +0x030 mVersion         : 0x0000000f  ""
   +0x034 mFiringDepth     : 1
   +0x038 mNext            : (null) 
   +0x03c mPopupState      : 0 ( openAllowed )
   +0x040 mRefCnt          : 2
0:000> dt nsTimeout 0x0012e3d0 mTimer.mRawPtr
   +0x00c mTimer         : 
      +0x000 mRawPtr        : 0x000014f4 

frame
09 DocumentViewerImpl::mDocument::mDocumentURI
0x03132bd8 "http://www.imaginegames.com/default.asp"
09 DocumentViewerImpl::mDocument::mDocumentTitle
0x03388e98 "Imaginegames.com"

I have three open windows:
Imaginegames.com - Raptor
Top 129 Sites
Recreational Software Advisory Council (RSACi) - Raptor

(the second one is a viewer special dialog, not a content browser).

ok, after a very very very windy twisty road, the other window's url is (from some path i can't find again
   (gklayout!nsIDOMWindow *)0x00e05b80 
mDocument.mRawPtr.mDocumentURI.mRawPtr.mSpec.mData
0x025ab5c8 "http://www.rsac.org/"

0:000> ?? nsBrowserWindow::gBrowsers
class nsVoidArray * 0x00daeb70
0:000> dt xpcom_core!nsVoidArray 0x00daeb70 mImpl
   +0x000 mImpl : 0x00daeba0 
0:000> dt nsVoidArray::Impl 0x00daeba0 
   +0x000 mBits            : 0x80000008
   +0x004 mCount           : 1
   +0x008 mArray           : [1] 0x00dae9d0 
0:000> dt nsVoidArray::Impl 0x00daeba0 mArray[0]
   +0x008 mArray    : [0] 0x00dae9d0 
0:000> dt xpcom_core!nsISupports 0x00dae9d0 
   +0x000 __VFN_table : 0x00450188 
(voodoo for jump to nsNativeBrowserWindow not known, use a watch window to discover the real type)
0:000> dt nsNativeBrowserWindow 0x00dae9d0 mTitle.mData
   +0x020 mTitle       : 
      +0x004 mData        : 0x03225030  "Recreational Software Advisory Council (RSACi) - Raptor"
0:000> dt nsNativeBrowserWindow 0x00dae9d0 mLocation
   +0x04c mLocation : 0x024b7ffc 
0:000> ?? (nsTextHelper*)(nsITextWidget*)0x024b7ffc
class nsTextHelper * 0x024b7f10
0:000> dt nsTextHelper 0x024b7f10 mText.mData
   +0x0f0 mText       : 
      +0x004 mData       : 0x0511dba8  "http://www.rsac.org/"

i will save a dump just in case anyone thinks there's something to be found from it.

Comment 1

[Martijn Wargers (dead)]

Someone is constantly crashing with this stacktrace:
http://forums.mozillazine.org/viewtopic.php?p=2108836

Comment 2

[Wayne Mery (:wsmwk)]

these stacks vary.  only the last seems a close match to timless' report


nsGlobalWindow::ClearAllTimeouts()
version 11 startup
bp-73503d1d-2a93-499d-bfd8-a769b2120225
0	xul.dll	nsGlobalWindow::ClearAllTimeouts	dom/base/nsGlobalWindow.cpp:9649
1	xul.dll	DocumentViewerImpl::InitInternal	layout/base/nsDocumentViewer.cpp:973
2	xul.dll	DocumentViewerImpl::Init	layout/base/nsDocumentViewer.cpp:716
3	xul.dll	nsDocShell::SetupNewViewer	docshell/base/nsDocShell.cpp:7689
4	xul.dll	nsDocShell::Embed	docshell/base/nsDocShell.cpp:5796
5	xul.dll	nsDocShell::CreateContentViewer	docshell/base/nsDocShell.cpp:7476
6	xul.dll	nsDSURIContentListener::DoContent	docshell/base/nsDSURIContentListener.cpp:147
7	xul.dll	nsDocumentOpenInfo::TryContentListener	uriloader/base/nsURILoader.cpp:709
8	xul.dll	nsDocumentOpenInfo::DispatchContent	uriloader/base/nsURILoader.cpp:406
9	xul.dll	nsDocumentOpenInfo::OnStartRequest	uriloader/base/nsURILoader.cpp:294
10	xul.dll	nsHttpChannel::CallOnStartRequest	netwerk/protocol/http/nsHttpChannel.cpp:766 


bp-8b12cb7c-64c4-4b84-894c-bb18b2120225
version 13
0	xul.dll	nsGlobalWindow::ClearAllTimeouts	
1	xul.dll	nsGlobalWindow::FreeInnerObjects	dom/base/nsGlobalWindow.cpp:1292
2	xul.dll	nsGlobalWindow::SetNewDocument	dom/base/nsGlobalWindow.cpp:2133
3	xul.dll	AppendUTF8toUTF16	xpcom/string/src/nsReadableUtils.cpp:227
4	xul.dll	nsCSSScanner::Close	layout/style/nsCSSScanner.cpp:587
5	xul.dll	NS_IsMainThread_P	obj-firefox/xpcom/build/nsThreadUtils.cpp:138
6	xul.dll	PL_DHashTableOperate	obj-firefox/xpcom/build/pldhash.cpp:625
7	xul.dll	AbortIfOffMainThreadIfCheckFast	xpcom/base/nsCycleCollector.cpp:1343
8	xul.dll	nsGlobalWindow::QueryInterface	dom/base/nsGlobalWindow.cpp:1400
9	xul.dll	nsPresContext::GetDocumentColorPreferences	layout/base/nsPresContext.cpp:676 


bp-fab6fc90-01a7-4a4e-8363-119882120228
version 10
0	xul.dll	nsGlobalWindow::ClearAllTimeouts	
1	xul.dll	nsGlobalWindow::FreeInnerObjects	dom/base/nsGlobalWindow.cpp:1284
2	xul.dll	nsGlobalWindow::SetNewDocument	dom/base/nsGlobalWindow.cpp:2136
3	xul.dll	DocumentViewerImpl::InitInternal	layout/base/nsDocumentViewer.cpp:959
4	xul.dll	DocumentViewerImpl::Init	layout/base/nsDocumentViewer.cpp:702
5	xul.dll	nsDocShell::SetupNewViewer	docshell/base/nsDocShell.cpp:7688
6	xul.dll	nsDocShell::Embed	docshell/base/nsDocShell.cpp:5790
7	xul.dll	nsDocShell::CreateContentViewer	docshell/base/nsDocShell.cpp:7475
8	xul.dll	nsDSURIContentListener::DoContent	docshell/base/nsDSURIContentListener.cpp:147
9	xul.dll	nsDocumentOpenInfo::TryContentListener	uriloader/base/nsURILoader.cpp:709
10	xul.dll	nsDocumentOpenInfo::DispatchContent	uriloader/base/nsURILoader.cpp:406

Comment 3

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.