344396 - domi crashes inspecting something [@ nsBindingManager::GetContentListFor]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[timeless]

#0  0x00cc6402 in __kernel_vsyscall ()
#1  0x00892f16 in __nanosleep_nocancel () from /lib/libc.so.6
#2  0x00892d3b in sleep () from /lib/libc.so.6
#3  0x08061826 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:133
#4  0x08062ab8 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:210
#5  <signal handler called>
#6  0x02d1ea35 in nsBindingManager::GetContentListFor (this=0xb5d0e120, aContent=0x0, aResult=0xbff1f898) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/xbl/src/nsBindingManager.cpp:495
#7  0x015c1293 in inDeepTreeWalker::PushNode (this=0x8c07a28, aNode=0x8895ae4) at /home/doron/mozbuilds/firefox-1.8/mozilla/extensions/inspector/base/src/inDeepTreeWalker.cpp:280
#8  0x015c1397 in inDeepTreeWalker::Init (this=0x8c07a28, aRoot=0x8895ae4, aWhatToShow=4294967295) at /home/doron/mozbuilds/firefox-1.8/mozilla/extensions/inspector/base/src/inDeepTreeWalker.cpp:123
#9  0x00bc44b9 in XPTC_InvokeByIndex () from obj-debug/dist/bin/libxpcom_core.so
#10 0x00e873ba in XPCWrappedNative::CallMethod (ccx=@0xbff1fba8, mode=XPCWrappedNative::CALL_METHOD) at /home/doron/mozbuilds/firefox-1.8/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2160
#11 0x00e9287c in XPC_WN_CallMethod (cx=0x8663b20, obj=0x8bbf068, argc=2, argv=0x8c5ef38, vp=0xbff1fcd0) at /home/doron/mozbuilds/firefox-1.8/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1450
#12 0x009e2e1e in js_Invoke (cx=0x8663b20, argc=2, flags=0) at /home/doron/mozbuilds/firefox-1.8/mozilla/js/src/jsinterp.c:1349
#13 0x009d8fb2 in js_Interpret (cx=0x8663b20, pc=0x8bf764e ":", result=0xbff1ffec) at /home/doron/mozbuilds/firefox-1.8/mozilla/js/src/jsinterp.c:4083
#14 0x009e2ea8 in js_Invoke (cx=0x8663b20, argc=1, flags=2) at /home/doron/mozbuilds/firefox-1.8/mozilla/js/src/jsinterp.c:1368
#15 0x00e820ec in nsXPCWrappedJSClass::CallMethod (this=0x86dbeb8, wrapper=0x8a280f8, methodIndex=3, info=0x85f5d30, nativeParams=0xbff20368) at /home/doron/mozbuilds/firefox-1.8/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1415
#16 0x00e7c097 in nsXPCWrappedJS::CallMethod (this=0x8a280f8, methodIndex=3, info=0x85f5d30, params=0xbff20368) at /home/doron/mozbuilds/firefox-1.8/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:467
#17 0x00bc5272 in PrepareAndDispatch (methodIndex=Variable "methodIndex" is not available.
) at /home/doron/mozbuilds/firefox-1.8/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:100
#18 0x02c470e3 in nsEventListenerManager::HandleEventSubType (this=0xb5d32290, aListenerStruct=0x8b64448, aListener=0x8a280f8, aDOMEvent=0x8c07b08, aCurrentTarget=0xb5d15eb0, aSubType=1, aPhaseFlags=4) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/events/src/nsEventListenerManager.cpp:1655
#19 0x02c4797e in nsEventListenerManager::HandleEvent (this=0xb5d32290, aPresContext=0xb5d263f8, aEvent=0xbff214e8, aDOMEvent=0xbff210c8, aCurrentTarget=0xb5d15eb0, aFlags=4, aEventStatus=0xbff21324) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/events/src/nsEventListenerManager.cpp:1759
#20 0x02d39082 in nsXULDocument::HandleDOMEvent (this=0xb5d15e00, aPresContext=0xb5d263f8, aEvent=0xbff214e8, aDOMEvent=0xbff210c8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/xul/document/src/nsXULDocument.cpp:1234
#21 0x02d27a04 in nsXULElement::HandleDOMEvent (this=0xb5dc4020, aPresContext=0xb5d263f8, aEvent=0xbff214e8, aDOMEvent=0xbff210c8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/xul/content/src/nsXULElement.cpp:2201
#22 0x02d279ba in nsXULElement::HandleDOMEvent (this=0x870e5d8, aPresContext=0xb5d263f8, aEvent=0xbff214e8, aDOMEvent=0xbff210c8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/xul/content/src/nsXULElement.cpp:2196
#23 0x02d279ba in nsXULElement::HandleDOMEvent (this=0x8750430, aPresContext=0xb5d263f8, aEvent=0xbff214e8, aDOMEvent=0xbff210c8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/xul/content/src/nsXULElement.cpp:2196
#24 0x02d279ba in nsXULElement::HandleDOMEvent (this=0x88d86f8, aPresContext=0xb5d263f8, aEvent=0xbff214e8, aDOMEvent=0xbff210c8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/xul/content/src/nsXULElement.cpp:2196
#25 0x02d279ba in nsXULElement::HandleDOMEvent (this=0x8895ac8, aPresContext=0xb5d263f8, aEvent=0xbff214e8, aDOMEvent=0xbff210c8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8/mozilla/content/xul/content/src/nsXULElement.cpp:2196
#26 0x029e9bf9 in PresShell::HandleEventInternal (this=0xb5d04770, aEvent=0xbff214e8, aView=0xb5d299f0, aFlags=1, aStatus=0xbff21324) at /home/doron/mozbuilds/firefox-1.8/mozilla/layout/base/nsPresShell.cpp:6379
#27 0x029eb150 in PresShell::HandleEvent (this=0xb5d04770, aView=0xb5d299f0, aEvent=0xbff214e8, aEventStatus=0xbff21324, aForceHandle=1, aHandled=@0xbff2131c) at /home/doron/mozbuilds/firefox-1.8/mozilla/layout/base/nsPresShell.cpp:6215
#28 0x02d5a518 in nsViewManager::HandleEvent (this=0xb5d29970, aView=0xb5d299f0, aEvent=0xbff214e8, aCaptured=0) at /home/doron/mozbuilds/firefox-1.8/mozilla/view/src/nsViewManager.cpp:2557
#29 0x02d5d5bc in nsViewManager::DispatchEvent (this=0xb5d29970, aEvent=0xbff214e8, aStatus=0xbff21450) at /home/doron/mozbuilds/firefox-1.8/mozilla/view/src/nsViewManager.cpp:2246
#30 0x02d51561 in HandleEvent (aEvent=0xbff214e8) at /home/doron/mozbuilds/firefox-1.8/mozilla/view/src/nsView.cpp:171
#31 0x07a19966 in nsCommonWidget::DispatchEvent (this=0xb5d26720, aEvent=0xbff214e8, aStatus=@0xbff21538) at /home/doron/mozbuilds/firefox-1.8/mozilla/widget/src/gtk2/nsCommonWidget.cpp:219
#32 0x07a105c8 in nsWindow::OnButtonPressEvent (this=0xb5d26720, aWidget=0x8574210, aEvent=0xb5d02378) at /home/doron/mozbuilds/firefox-1.8/mozilla/widget/src/gtk2/nsWindow.cpp:1645
#33 0x07a1077d in button_press_event_cb (widget=0x8574210, event=0xb5d02378) at /home/doron/mozbuilds/firefox-1.8/mozilla/widget/src/gtk2/nsWindow.cpp:3804
#34 0x0041a58e in gtk_marshal_BOOLEAN__VOID () from /usr/lib/libgtk-x11-2.0.so.0
#35 0x0027af8b in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#36 0x0028be3d in g_signal_override_class_closure () from /usr/lib/libgobject-2.0.so.0
#37 0x0028d10f in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#38 0x0028d509 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#39 0x00505858 in gtk_widget_get_default_style () from /usr/lib/libgtk-x11-2.0.so.0
#40 0x00413f63 in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#41 0x004151b7 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#42 0x001fa85a in gdk_add_client_message_filter () from /usr/lib/libgdk-x11-2.0.so.0
#43 0x0064515d in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#44 0x006483ef in g_main_context_check () from /usr/lib/libglib-2.0.so.0
#45 0x00648799 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#46 0x00415634 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#47 0x07a1767a in nsAppShell::Run (this=0x8587b80) at /home/doron/mozbuilds/firefox-1.8/mozilla/widget/src/gtk2/nsAppShell.cpp:139
#48 0x00c22ca3 in nsAppStartup::Run (this=0x8587b38) at /home/doron/mozbuilds/firefox-1.8/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:151
#49 0x0805135e in XRE_main (argc=2, argv=0xbff21f24, aAppData=0x8067a40) at /home/doron/mozbuilds/firefox-1.8/mozilla/toolkit/xre/nsAppRunner.cpp:2376
#50 0x0804b3a3 in main (argc=Cannot access memory at address 0x0
) at /home/doron/mozbuilds/firefox-1.8/mozilla/browser/app/nsBrowserApp.cpp:61

Comment 1

[timeless]

Attachment: this should fix it

Comment 2

[Doron Rosenberg (IBM)]

To clear up: I was inspecting chrome (switch DOMI to inspect the firefox window), clicking on the "find node to inspect" toolbarbutton and clicking on anything in the chrome.

Note that I didn't see this in a optimized ftp build, only debug cvs build.

Comment 3

[Doron Rosenberg (IBM)]

one more thing - there are several talkback incidents with that stack and DOMI in the description, so it isn't just something I am seeing :)

Comment 4

[Alex Vincent [:WeirdAl]]

I'm going to run this patch locally for a moment, with a couple added NS_ASSERTIONs for content.  I want to know why aNode didn't QI to nsIContent; there are only a few node types (mainly documents and attributes) that wouldn't.

Comment 5

[Alex Vincent [:WeirdAl]]

Okay, yeah, inDeepTreeWalker is (correctly) setting its root to the XUL document root node.  As a result, when we QI to nsIContent for it, we do get null back.

So the assertions I added locally aren't needed or desirable, and the patch is fundamentally correct to my eyes.

Comment 6

[Alex Vincent [:WeirdAl]]

This needs to have its JavaDoc updated, though:
http://lxr.mozilla.org/seamonkey/source/extensions/inspector/resources/content/viewers/dom/dom.js#681

Comment 7

[Johnny Stenback (:jst)]

Comment on attachment 228983 [details] [diff] [review]
this should fix it

r+sr=jst

Comment 8

[Doron Rosenberg (IBM)]

cc: shaver since he wanted to

Comment 9

[Doron Rosenberg (IBM)]

One more thing - after I clobbered my build, it no longer happens.  Shaver said to nominate this as a blocking, so doing that as well.

As http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsBindingManager%3A%3AGetContentListFor&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid&rlimit=500 shows, I am not the only one seeing this.

Comment 10

[timeless]

Comment on attachment 228983 [details] [diff] [review]
this should fix it

mozilla/layout/inspector/src/inDOMUtils.cpp 	1.37
mozilla/layout/inspector/src/inDeepTreeWalker.cpp 	1.16

Comment 11

[Benjamin Smedberg]

Can we have a branch patch (or nomination)?

Comment 12

[Mike Schroepfer]

Comment on attachment 228983 [details] [diff] [review]
this should fix it

a=schrep for drives for crash fix in DOMi