345151 - Crash [@ DocumentViewerImpl::Destroy() @ lin 1497] with deleted nsISHEntry vtable

Status: RESOLVED DUPLICATE of bug 314549

(Core :: DOM: Navigation, defect)

Description

[Bob Clary [:bc] (inactive)]

TB21108501M

Steps to reproduce:

Install Spider 
<http://bclary.com/projects/spider/spider/spider.xpi> in Firefox 2 (Windows or Linux)

Start Spider from the command line

./firefox -chrome "chrome://spider/content"

Copy <http://test.bclary.com/bin/buildinfo.html> into URL field
Set Depth to 0
Uncheck Restrict URLS, Respect robots.txt
Click Run
Crash

-		shEntry	0x039522f8	nsISHEntry *
-		nsIHistoryEntry	{...}	nsIHistoryEntry
-		nsISupports	{...}	nsISupports
+		__vfptr	0xdddddddd	*
		itemIndex	1	int
		savePresentation	1	int
+		item	{mRawPtr=0x00000000 }	nsCOMPtr<nsIDocShellTreeItem>
+		this	0x03832ff8 {mRefCnt={...} _mOwningThread={...} mContainer={...} ...}	DocumentViewerImpl * const

    while (NS_SUCCEEDED(shEntry->ChildShellAt(itemIndex++,
=>                                              getter_AddRefs(item))) && item) {
      DetachContainerRecurse(nsCOMPtr<nsIDocShell>(do_QueryInterface(item)));
    }

>	gklayout.dll!DocumentViewerImpl::Destroy()  Line 1497 + 0x34 bytes	C++
 	gklayout.dll!DocumentViewerImpl::Show()  Line 1837	C++
 	gklayout.dll!nsPresContext::EnsureVisible(int aUnsuppressFocus=0)  Line 1311	C++
 	gklayout.dll!PresShell::UnsuppressAndInvalidate()  Line 5034 + 0xd bytes	C++
 	gklayout.dll!PresShell::UnsuppressPainting()  Line 5083	C++
 	gklayout.dll!DocumentViewerImpl::LoadComplete(unsigned int aStatus=0)  Line 1050	C++
 	docshell.dll!nsDocShell::EndPageLoad(nsIWebProgress * aProgress=0x0390bb54, nsIChannel * aChannel=0x03be6ff8, unsigned int aStatus=0)  Line 4791	C++
 	docshell.dll!nsWebShell::EndPageLoad(nsIWebProgress * aProgress=0x0390bb54, nsIChannel * channel=0x03be6ff8, unsigned int aStatus=0)  Line 663	C++
 	docshell.dll!nsDocShell::OnStateChange(nsIWebProgress * aProgress=0x0390bb54, nsIRequest * aRequest=0x03be6ff8, unsigned int aStateFlags=131088, unsigned int aStatus=0)  Line 4706	C++
 	docshell.dll!nsDocLoader::FireOnStateChange(nsIWebProgress * aProgress=0x0390bb54, nsIRequest * aRequest=0x03be6ff8, int aStateFlags=131088, unsigned int aStatus=0)  Line 1211	C++
 	docshell.dll!nsDocLoader::doStopDocumentLoad(nsIRequest * request=0x03be6ff8, unsigned int aStatus=0)  Line 844	C++
 	docshell.dll!nsDocLoader::DocLoaderIsEmpty()  Line 741	C++
 	docshell.dll!nsDocLoader::OnStopRequest(nsIRequest * aRequest=, nsISupports * aCtxt=, unsigned int aStatus=)  Line 665	C++
 	necko.dll!nsLoadGroup::RemoveRequest(nsIRequest * request=0x0327a1a8, nsISupports * ctxt=0x00000000, unsigned int aStatus=0)  Line 732 + 0x2c bytes	C++
 	gklayout.dll!PresShell::RemoveDummyLayoutRequest()  Line 7125 + 0x2a bytes	C++
 	gklayout.dll!DummyLayoutRequestEvent::HandleEvent()  Line 7025	C++
 	gklayout.dll!HandleDummyLayoutRequestPLEvent(PLEvent * aEvent=0x03d5fdb0)  Line 7034	C++
 	xpcom_core.dll!PL_HandleEvent(PLEvent * self=0x03d5fdb0)  Line 688 + 0xa bytes	C
 	xpcom_core.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x00b47b48)  Line 623 + 0x9 bytes	C
 	xpcom_core.dll!nsEventQueueImpl::ProcessPendingEvents()  Line 417 + 0xc bytes	C++
 	gkwidget.dll!nsWindow::DispatchPendingEvents()  Line 4370	C++
 	gkwidget.dll!nsWindow::ProcessMessage(unsigned int msg=512, unsigned int wParam=0, long lParam=17170469, long * aRetValue=0x0012fa8c)  Line 4775	C++
 	gkwidget.dll!nsWindow::WindowProc(HWND__ * hWnd=0x001c0290, unsigned int msg=512, unsigned int wParam=0, long lParam=17170469)  Line 1538 + 0x1b bytes	C++

Comment 1

[Bob Clary [:bc] (inactive)]

Upping severity to blocker since this does block any of my automated testing for the js test library etc.

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

is this the same as bug 314549 comment 28 and following?

Comment 3

[Bob Clary [:bc] (inactive)]

certainly looks like it.

*** This bug has been marked as a duplicate of 314549 ***