[trunk] Crash on close after going from secure site to URL [@ nsContentUtils::CanCallerAccess 388fade1]

VERIFIED FIXED

Status

()

--
critical
VERIFIED FIXED
13 years ago
8 years ago

People

(Reporter: ria.klaassen, Unassigned)

Tracking

({crash, regression})

Trunk
x86
Windows XP
crash, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Comment 1

13 years ago
Oh well, maybe it has nothing to do with secure sites after all.
Maybe it's only the fatal combination of bugzilla and http://fta.firetrust.com/signup.cgi
As long as there is one bugzilla bug site in the browser session, followed by visiting http://fta.firetrust.com/signup.cgi it crashes.
Even when there are 10 other sites between those two, Firefox crashes on close.
(Reporter)

Comment 2

13 years ago
Created attachment 210502 [details]
Result Leak test

Firefox is seriously ill. See log.
The crash depends also on other (sanitize) settings, but I don't think it is still interesting to mention them.
(Reporter)

Comment 3

13 years ago
Incident ID: 14663776
Stack Signature	nsContentUtils::CanCallerAccess 388fade1
Product ID	FirefoxTrunk
Build ID	2006020206
Trigger Time	2006-02-02 09:07:44.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00131ee5)
URL visited	
User Comments	
Since Last Crash	25 sec
Total Uptime	3717 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentUtils.cpp, line 667
Stack Trace 	
nsContentUtils::CanCallerAccess  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentUtils.cpp, line 667]
nsRange::SelectNodeContents  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsRange.cpp, line 1110]
nsPlaintextEditor::GetAndInitDocEncoder  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 1207]
nsPlaintextEditor::OutputToString  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 1245]
nsTextControlFrame::GetValue  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 2986]
nsTextControlFrame::PreDestroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 1346]
nsTextControlFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 1428]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsTableFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 312]
nsTableOuterFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 79]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsTableFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 312]
nsTableOuterFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 79]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineBox.cpp, line 325]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
CanvasFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 218]
nsFrameList::DestroyFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 138]
nsHTMLScrollFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 166]
ViewportFrame::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 58]
DocumentViewerImpl::Destroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 1551]
nsSHistory::EvictGlobalContentViewer  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/shistory/src/nsSHistory.cpp, line 925]
nsSHistory::EvictAllContentViewers  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/docshell/shistory/src/nsSHistory.cpp, line 947]
nsObserverService::NotifyObservers  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/ds/nsObserverService.cpp, line 241]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
EventHandler  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/xpcom/proxy/src/nsProxyEvent.cpp, line 561]
0x778b0c24
0x00200064
0x5d39f633
(Reporter)

Updated

13 years ago
Summary: [trunk] Crash on close after going from secure site to URL → [trunk] Crash on close after going from secure site to URL [@ nsContentUtils::CanCallerAccess 388fade1]
-> shistory, I'm told
Assignee: darin → nobody
Component: Networking → History: Session
QA Contact: benc → history.session
(Reporter)

Comment 5

13 years ago
(In reply to comment #4)
thanks :)
This is probably fixed by Brendan's checkin just now (for bug 325269). Please retest in tonight's or tomorrow's builds?

If not, the right fix will follow bug 316414
Blocks: 325269
Depends on: 316414
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060202 Firefox/1.6a1 ID:2006020213

I can't reproduce this anymore since Brendan's patch for bug 325269 landed
FIXED, then -- we know what fixed it, and it's not a dup.  It's really the bug I was fixing with my "Arghhhhhhhhhhhhhh" followup patch ;-).

/be
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED
(Reporter)

Updated

13 years ago
Status: RESOLVED → VERIFIED

Updated

10 years ago
Component: History: Session → Document Navigation
QA Contact: history.session → docshell
(Assignee)

Updated

8 years ago
Crash Signature: [@ nsContentUtils::CanCallerAccess 388fade1]
You need to log in before you can comment on or make changes to this bug.