34350 - test9 crashes in pagecycler

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

DESCRIPTION:  Test9 crashes in the pagecycler.  The cause of the problem seems
to be that the mDocShell of an nsDSWebProgressListener is not a valid pointer
(probably null).  Could the problem be around:
http://lxr.mozilla.org/seamonkey/source/uriloader/base/nsURILoader.cpp#688
where perhaps void nsDSWebProgressListener::DocShell(nsDocShell* aDocShell)
needs to be called?

STEPS TO REPRODUCE:
 * add resource:///res/samples/test9.html to the beginning of
dist/bin/bloaturls.txt
 * in dist/bin, run ./mozilla -P <profile name> -f bloaturls.txt

ACTUAL RESULTS:
 * crash:
Program received signal SIGSEGV, Segmentation fault.
0x402d281e in ?? ()
   from /home/david/mozilla/src/mozilla/dist/bin/libdocshell.so

#0  0x402d281e in nsDSWebProgressListener::OnStatusChange (this=0x868a190,
    aChannel=0x0, aProgressStatusFlags=0) at nsDSWebProgressListener.cpp:93
#1  0x40d3168d in nsDocLoaderImpl::FireOnEndDocumentLoad (this=0x863eed8,
    aLoadInitiator=0x863eed8, aDocChannel=0x8646ce8, aStatus=0)
    at nsDocLoader.cpp:622
#2  0x40d31213 in nsDocLoaderImpl::DocLoaderIsEmpty (this=0x863eed8, aStatus=0)
    at nsDocLoader.cpp:512
#3  0x40d31088 in nsDocLoaderImpl::OnStopRequest (this=0x863eed8,
    aChannel=0x8646ce8, aCtxt=0x0, aStatus=0, aMsg=0x0) at nsDocLoader.cpp:457
#4  0x40c79322 in nsLoadGroup::RemoveChannel (this=0x863ef40,
    channel=0x8646ce8, ctxt=0x0, status=0, errorMsg=0x0) at nsLoadGroup.cpp:543
#5  0x40ef0cc3 in nsFileChannel::OnStopRequest (this=0x8646ce8,
    transportChannel=0x89e2da0, context=0x0, aStatus=0, aMsg=0x0)
    at nsFileChannel.cpp:567
#6  0x40c60f9f in nsOnStopRequestEvent::HandleEvent (this=0x86446f8)
    at nsAsyncStreamListener.cpp:285
#7  0x40c60677 in nsStreamListenerEvent::HandlePLEvent (aEvent=0x8651520)
    at nsAsyncStreamListener.cpp:97
#8  0x40195ade in PL_HandleEvent (self=0x8651520) at plevent.c:563
#9  0x4019598c in PL_ProcessPendingEvents (self=0x813b1d8) at plevent.c:508
#10 0x40197630 in nsEventQueueImpl::ProcessPendingEvents (this=0x813b100)
    at nsEventQueue.cpp:316
#11 0x406e9094 in event_processor_callback (data=0x813b100, source=9,
    condition=GDK_INPUT_READ) at nsAppShell.cpp:143
#12 0x406e8cdf in our_gdk_io_invoke (source=0x81f3f68, condition=G_IO_IN,
    data=0x81d8138) at nsAppShell.cpp:56
#13 0x408a652a in g_io_unix_dispatch ()
#14 0x408a7be6 in g_main_dispatch ()
#15 0x408a81a1 in g_main_iterate ()
#16 0x408a8341 in g_main_run ()
#17 0x407cd859 in gtk_main ()
etc...

EXPECTED RESULTS:
 * no crash

DOES NOT WORK CORRECTLY ON:
 * Linux, mozilla, 2000-04-03, pull during tree closure

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

(Note that test9 uses frames.)

Comment 2

[Scott MacGregor]

Over to travis.

Comment 3

[travis]

mscott has a patch to fix this. r=travis

Comment 4

[Scott MacGregor]

fix checked in.

Comment 5

[leger]

Adding crash keyword

Comment 6

[Tom Everingham]

verified:
Linux 2000042609