325613 - [trunk] Crash on close after going from secure site to URL [@ nsContentUtils::CanCallerAccess 388fade1]

Status: VERIFIED FIXED

Description

[Ria Klaassen (not reading all bugmail)]

Steps to reproduce:

1. Go to https://bugzilla.mozilla.org/show_bug.cgi?id=325596
2. Go to http://fta.firetrust.com/signup.cgi
3. Close Firefox

Regression between 1.9a1_2006020115 and 1.9a1_2006020206.
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-02-01+14%3A00%3A00&maxdate=2006-02-02+06%3A00%3A00&cvsroot=%2Fcvsroot

TB14663753K  TB14663776M  TB14663830Z

Comment 1

[Ria Klaassen (not reading all bugmail)]

Oh well, maybe it has nothing to do with secure sites after all.
Maybe it's only the fatal combination of bugzilla and http://fta.firetrust.com/signup.cgi
As long as there is one bugzilla bug site in the browser session, followed by visiting http://fta.firetrust.com/signup.cgi it crashes.
Even when there are 10 other sites between those two, Firefox crashes on close.

Comment 2

[Ria Klaassen (not reading all bugmail)]

Created attachment 210502 [details]
Result Leak test

Firefox is seriously ill. See log.
The crash depends also on other (sanitize) settings, but I don't think it is still interesting to mention them.

Comment 3

[Ria Klaassen (not reading all bugmail)]

Incident ID: 14663776
Stack Signature	nsContentUtils::CanCallerAccess 388fade1
Product ID	FirefoxTrunk
Build ID	2006020206
Trigger Time	2006-02-02 09:07:44.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00131ee5)
URL visited	
User Comments	
Since Last Crash	25 sec
Total Uptime	3717 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentUtils.cpp, line 667
Stack Trace 	
nsContentUtils::CanCallerAccess  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentUtils.cpp, line 667]
nsRange::SelectNodeContents  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsRange.cpp, line 1110]
nsPlaintextEditor::GetAndInitDocEncoder  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 1207]
nsPlaintextEditor::OutputToString  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 1245]
nsTextControlFrame::GetValue  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 2986]
nsTextControlFrame::PreDestroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 1346]
nsTextControlFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 1428]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsTableFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 312]
nsTableOuterFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 79]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsTableFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 312]
nsTableOuterFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 79]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
CanvasFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 218]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsHTMLScrollFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 166]
ViewportFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 58]
DocumentViewerImpl::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 1551]
nsSHistory::EvictGlobalContentViewer  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/shistory/src/nsSHistory.cpp, line 925]
nsSHistory::EvictAllContentViewers  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/shistory/src/nsSHistory.cpp, line 947]
nsObserverService::NotifyObservers  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/ds/nsObserverService.cpp, line 241]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
EventHandler  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/proxy/src/nsProxyEvent.cpp, line 561]
0x778b0c24
0x00200064
0x5d39f633

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

-> shistory, I'm told

Comment 5

[Ria Klaassen (not reading all bugmail)]

(In reply to comment #4)
thanks :)

Comment 6

[Boris Zbarsky [:bzbarsky, bz on IRC]]

This is probably fixed by Brendan's checkin just now (for bug 325269). Please retest in tonight's or tomorrow's builds?

If not, the right fix will follow bug 316414

Comment 7

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060202 Firefox/1.6a1 ID:2006020213

I can't reproduce this anymore since Brendan's patch for bug 325269 landed

Comment 8

[Brendan Eich [:brendan]]

FIXED, then -- we know what fixed it, and it's not a dup.  It's really the bug I was fixing with my "Arghhhhhhhhhhhhhh" followup patch ;-).

/be