Closed Bug 325613 Opened 17 years ago Closed 17 years ago

[trunk] Crash on close after going from secure site to URL [@ nsContentUtils::CanCallerAccess 388fade1]

Categories

(Core :: DOM: Navigation, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: ria.klaassen, Unassigned)

References

()

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Oh well, maybe it has nothing to do with secure sites after all.
Maybe it's only the fatal combination of bugzilla and http://fta.firetrust.com/signup.cgi
As long as there is one bugzilla bug site in the browser session, followed by visiting http://fta.firetrust.com/signup.cgi it crashes.
Even when there are 10 other sites between those two, Firefox crashes on close.
Attached file Result Leak test
Firefox is seriously ill. See log.
The crash depends also on other (sanitize) settings, but I don't think it is still interesting to mention them.
Incident ID: 14663776
Stack Signature	nsContentUtils::CanCallerAccess 388fade1
Product ID	FirefoxTrunk
Build ID	2006020206
Trigger Time	2006-02-02 09:07:44.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00131ee5)
URL visited	
User Comments	
Since Last Crash	25 sec
Total Uptime	3717 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentUtils.cpp, line 667
Stack Trace 	
nsContentUtils::CanCallerAccess  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentUtils.cpp, line 667]
nsRange::SelectNodeContents  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsRange.cpp, line 1110]
nsPlaintextEditor::GetAndInitDocEncoder  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 1207]
nsPlaintextEditor::OutputToString  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 1245]
nsTextControlFrame::GetValue  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 2986]
nsTextControlFrame::PreDestroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 1346]
nsTextControlFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 1428]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsTableFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 312]
nsTableOuterFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 79]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsTableFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 312]
nsTableOuterFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 79]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
CanvasFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 218]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsHTMLScrollFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 166]
ViewportFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 58]
DocumentViewerImpl::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 1551]
nsSHistory::EvictGlobalContentViewer  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/shistory/src/nsSHistory.cpp, line 925]
nsSHistory::EvictAllContentViewers  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/shistory/src/nsSHistory.cpp, line 947]
nsObserverService::NotifyObservers  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/ds/nsObserverService.cpp, line 241]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
EventHandler  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/proxy/src/nsProxyEvent.cpp, line 561]
0x778b0c24
0x00200064
0x5d39f633
Summary: [trunk] Crash on close after going from secure site to URL → [trunk] Crash on close after going from secure site to URL [@ nsContentUtils::CanCallerAccess 388fade1]
-> shistory, I'm told
Assignee: darin → nobody
Component: Networking → History: Session
QA Contact: benc → history.session
(In reply to comment #4)
thanks :)
This is probably fixed by Brendan's checkin just now (for bug 325269). Please retest in tonight's or tomorrow's builds?

If not, the right fix will follow bug 316414
Blocks: 325269
Depends on: 316414
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060202 Firefox/1.6a1 ID:2006020213

I can't reproduce this anymore since Brendan's patch for bug 325269 landed
FIXED, then -- we know what fixed it, and it's not a dup.  It's really the bug I was fixing with my "Arghhhhhhhhhhhhhh" followup patch ;-).

/be
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
Component: History: Session → Document Navigation
QA Contact: history.session → docshell
Crash Signature: [@ nsContentUtils::CanCallerAccess 388fade1]
You need to log in before you can comment on or make changes to this bug.