33309 - CRASH - Access Violation in RDFDOMDS.DLL

Status: VERIFIED DUPLICATE of bug 18530

(SeaMonkey :: General, defect, P3)

Description

[Bernd Mielke]

Steps to reproduce:
Start Domviewer
Select first three checkboxes.
Select Load
Select Refresh
Select Load
Select Refresh
Crash.
Here we are:
with these values in nsHashTable.h
in function nsISupportsKey

-	mKey	0x02d9dc50
-	__vfptr	0xdddddddd
	[0]	CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
	[1]	CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
	[2]	CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
-	this	0x035b3ca0
-	nsHashKey	{...}
-	__vfptr	0x03a8e1b0 const  nsISupportsKey::`vftable'
	[0]	0x03a8113b nsISupportsKey::`scalar deleting destructor'(unsigned int)
	[1]	0x03a81677 nsISupportsKey::HashValue(void)
	[2]	0x03a81073 nsISupportsKey::Equals(class nsHashKey const *)
	[3]	0x03a817ad nsISupportsKey::Clone(void)
-	mKey	0x02d9dc50
-	__vfptr	0xdddddddd
	[0]	CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
	[1]	CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden
	[2]	CXX0030: Fehler: Ausdruck kann nicht ausgewertet werden

stack trace

nsISupportsKey::~nsISupportsKey() line 125 + 24 bytes
nsISupportsKey::`scalar deleting destructor'(unsigned int 1) + 15 bytes
_hashFreeEntry(void * 0x00000000, PLHashEntry * 0x035b3c60, unsigned int 1) line
65 + 33 bytes
PL_HashTableRawRemove(PLHashTable * 0x0352a080, PLHashEntry * * 0x0095dfc8,
PLHashEntry * 0x035b3c60) line 286 + 22 bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x0352a080, int (PLHashEntry *, int,
void *)* 0x100141f0 _hashEnumerateRemove(PLHashEntry *, int, void *), void *
0x00000000) line 388 + 17 bytes
nsHashtable::Reset(int (nsHashKey *, void *, void *)* 0x00000000, void *
0x00000000) line 246 + 18 bytes
nsHashtable::Reset() line 234
nsSupportsHashtable::Reset() line 435
nsRDFDOMDataSource::SetWindow(nsRDFDOMDataSource * const 0x0352a0d4,
nsIDOMWindow * 0x03883684) line 1209
XPTC_InvokeByIndex(nsISupports * 0x0352a0d4, unsigned int 5, unsigned int 1,
nsXPTCVariant * 0x0095e29c) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x034ca910,
nsXPCWrappedNative * 0x035bad50, const XPCNativeMemberDescriptor * 0x035bae7c,
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 1, long *
0x00c420f0, long * 0x0095e440) line 898 + 43 bytes
WrappedNative_CallMethod(JSContext * 0x034ca910, JSObject * 0x02dbdd20, unsigned
int 1, long * 0x00c420f0, long * 0x0095e440) line 200 + 34 bytes
js_Invoke(JSContext * 0x034ca910, unsigned int 1, unsigned int 0) line 679 + 26
bytes
js_Interpret(JSContext * 0x034ca910, long * 0x0095ed64) line 2457 + 15 bytes
js_Invoke(JSContext * 0x034ca910, unsigned int 1, unsigned int 2) line 695 + 13
bytes
js_InternalInvoke(JSContext * 0x034ca910, JSObject * 0x02dbd838, long 47962176,
unsigned int 0, unsigned int 1, long * 0x0095eef0, long * 0x0095ee9c) line 768 +
19 bytes
JS_CallFunctionValue(JSContext * 0x034ca910, JSObject * 0x02dbd838, long
47962176, unsigned int 1, long * 0x0095eef0, long * 0x0095ee9c) line 2791 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x034cb350, void * 0x02dbd838,
void * 0x02dbd840, unsigned int 1, void * 0x0095eef0, int * 0x0095eeec) line 550
+ 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x034f7ee4) line 128 + 57 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0351d620,
nsIDOMEvent * 0x034f7ee4, unsigned int 4, unsigned int 7) line 703 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x039b0a90, nsEvent *
0x0095f424, nsIDOMEvent * * 0x0095f3ec, unsigned int 7, nsEventStatus *
0x0095f744) line 843 + 29 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0351d770, nsIPresContext *
0x039b0a90, nsEvent * 0x0095f424, nsIDOMEvent * * 0x0095f3ec, unsigned int 1,
nsEventStatus * 0x0095f744) line 3193
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const
0x035b7830, nsIPresContext * 0x039b0a90, nsMouseEvent * 0x0095f838,
nsEventStatus * 0x0095f744) line 1587 + 42 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x035b7830,
nsIPresContext * 0x039b0a90, nsGUIEvent * 0x0095f838, nsIFrame * 0x02d9b660,
nsEventStatus * 0x0095f744, nsIView * 0x039fcdf0) line 757 + 24 bytes
PresShell::HandleEvent(PresShell * const 0x039fc884, nsIView * 0x039fcdf0,
nsGUIEvent * 0x0095f838, nsEventStatus * 0x0095f744, int & 1) line 3218 + 43 bytes
nsView::HandleEvent(nsView * const 0x039fcdf0, nsGUIEvent * 0x0095f838, unsigned
int 28, nsEventStatus * 0x0095f744, int & 1) line 811
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x039fcf30, nsGUIEvent *
0x0095f838, nsEventStatus * 0x0095f744) line 1314
HandleEvent(nsGUIEvent * 0x0095f838) line 69
nsWindow::DispatchEvent(nsWindow * const 0x039fccc4, nsGUIEvent * 0x0095f838,
nsEventStatus & nsEventStatus_eIgnore) line 498 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0095f838) line 519
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3069 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3276
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 3014702, long *
0x0095fb00) line 2273 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x0000092c, unsigned int 514, unsigned int 0, long
3014702) line 676 + 27 bytes
KERNEL32! bff7363b()
KERNEL32! bff94407()
00958b82()

Comment 1

[leger]

Adding crash keyword.

Comment 2

[Gervase Markham [:gerv]]

[e-mail] - are you still seeing this problem with recent builds of 
Mozilla?

Gerv

Comment 3

[Bernd Mielke]

No, I dont see it anymoore. The behavior vanished  a few days ago.

Comment 4

[Blake Ross]

actually, the correct fix for this is wfm since (afaik) no one checked in to 
fix this.  reopening, resolving as WFM, and verifying (per reporter's comments 
and my testing) in a process that is sure to make alec hate me forever...

Comment 5

[Blake Ross]

step 2 of "make alec hate me forever"

Comment 6

[Blake Ross]

ack!  alec hates me even longer now, i accidentally marked it fixed again :\

Comment 7

[Blake Ross]

i HAVE used bugzilla before.  really, i have!

Comment 8

[Blake Ross]

...and vrfy wfm on just-pulled build on win98

Comment 9

[Bernd Mielke]

Blake I am puzzled how it could wfyou especially if you look at bug 22425.

Comment 10

[Blake Ross]

um, obviously the steps given in bug 22425 don't crash for me.

Comment 11

[Bernd Mielke]

Bugs don't go away: talkbackID:  TB19459036E. WinNT 2000102004.

Comment 12

[Asa Dotzler [:asa]]

   nsISupportsKey::~nsISupportsKey   [..\..\..\dist\include\nsHashtable.h, line 187]
     nsISupportsKey::`scalar deleting destructor'
     _hashFreeEntry [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 170]
     PL_HashTableRawRemove [plhash.c, line 317]
     PL_HashTableEnumerateEntries [plhash.c, line 435]
     nsHashtable::Reset [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp,
line 389]
     _pl_SetupNativeNotifier
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 709]
<../images/spacer.gif>

Over to XPCOM

Comment 13

[Alec Flett]

There is no bug in the nsISupportsKey, and ray should not have to deal with this 
anyway

this is just a result of the array having a stray pointer - there must be an 
extra Release() in there somewhere

Comment 14

[Alec Flett]

Moving DOM viewer bugs to future. I do not expect to get to these bugs any time
soon, so feel free to work on them.

Comment 15

[Alec Flett]

*** This bug has been marked as a duplicate of 18530 ***

Comment 16

[Azrael AOD]

Verifying  as a duplicate of 18530
'DOM viewer crashes apprunner...

Comment 17

[Hixie (not reading bugmail)]

Obsolete DOM Viewer bugs -> Browser-General; DOM Viewer component is going away.