Closed Bug 346233 Opened 18 years ago Closed 18 years ago

hang [@ nsRange::PopRanges]

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
1.8 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: sayrer, Assigned: sicking)

References

(
URL
)

Details

(4 keywords, Whiteboard: required by 27382 (321299))

Attachments

(2 files)

Partial backout
45.97 KB, patch
sicking
: review+
sicking
: superreview+
mtschrep
: approval1.8.1+
Details | Diff | Splinter Review
Patch to fix
866 bytes, patch
mrbkap
: review+
brendan
: superreview+
dveditz
: approval1.8.0.7+
beltzner
: approval1.8.1+
Details | Diff | Splinter Review
nsRange.cpp gets locked up with a couple of assertions: ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 838 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED(res)', file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 Break: at file /Users/sayrer/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 etc, etc
Unfortunately, I can't reproduce this, and I had several pages open at the time. I do see recent nsRange checkins, so maybe this will ring a bell.
This could be my recent changes simply because I touched range code, but I would need steps to reproduce to be able to tell.
Confirming on Windows. To reproduce you just need to use a 1.8 branch build (Note: I can't reproduce on trunk) for browsing (I used mostly bugzilla, google, and gmail) for some time, less than an hour. Note, bug 346308 comment 3 (which is a dupe, I believe) has a regression range: http://tinderbox.mozilla.org/bonsai/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=MOZILLA_1_8_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-07-27+09%3A57%3A26&maxdate=2006-07-28+02%3A57%3A21&cvsroot=%2Fcvsroot Stack: nsRange::PopRanges(aDestNode=0x055cb574, aOffset=0x00000000, aSourceNode=0x07ce0a68) Line 801 nsRange::OwnerChildRemoved(aParentNode=0x055cb558, aOffset=0x00000000, aRemovedNode=0x07ce0a68) Line 2165 doRemoveChildAt(aIndex=0x00000000, aNotify=0x00000001, aKid=0x07ce0a68, aParent=0x055cb558, aDocument=0x050074b8, aChildArray={...}) Line 3032 nsGenericElement::RemoveChildAt(aIndex=0x00000000, aNotify=0x00000001) Line 2907 nsGenericElement::RemoveChild(aOldChild=0x07ce0a8c, aReturn=0x0012e1f0) Line 3656 nsHTMLDivElement::RemoveChild(aOldChild=0x07ce0a8c, aReturn=0x0012e1f0) Line 59 nsRange::DeleteContents() Line 1538 nsGenericHTMLElement::SetInnerHTML(aInnerHTML={...}) Line 934 nsGenericHTMLElementTearoff::SetInnerHTML(aInnerHTML={...}) Line 214 XPTC_InvokeByIndex(that=0x00000009, methodIndex=0x00000001, paramCount=0x0012e41c, params=0x7c910f46) Line 102 XPCWrappedNative::CallMethod(ccx={...}, mode=0x00000009) Line 2161 XPCWrappedNative::CallMethod(ccx={...}, mode=CALL_SETTER) Line 2161 XPCWrappedNative::SetAttribute(ccx={...}) Line 1972 XPC_WN_GetterSetter(cx=0x04309c40, obj=0x05b32680, argc=0x00000001, argv=0x07c61598, vp=0x0012e70c) Line 1474 js_Invoke(cx=0x04309c40, argc=0x00000001, flags=0x00000002) Line 1350 js_InternalInvoke(cx=0x04309c40, obj=0x05b32680, fval=0x04ea3c28, flags=0x00000000, argc=0x00000001, argv=0x0012f32c, rval=0x0012f32c) Line 1448 js_InternalGetOrSet(cx=0x04309c40, obj=0x05b32680, id=0x036a29c8, fval=0x04ea3c28, mode=JSACC_WRITE, argc=0x00000001, argv=0x0012f32c, rval=0x0012f32c) Line 1508 js_SetProperty(cx=0x04309c40, obj=0x05b32680, id=0x036a29c8, vp=0x0012f32c) Line 3386 js_Interpret(cx=0x04309c40, pc=0x04e920c1, result=0x0012f480) Line 3834 js_Invoke(cx=0x04309c40, argc=0x00000000, flags=0x00000002) Line 1369 nsXPCWrappedJSClass::CallMethod(wrapper=0x059a68e8, methodIndex=0x0003, info=0x03865a68, nativeParams=0x0012f7f0) Line 1415 nsXPCWrappedJS::CallMethod(methodIndex=0x0003, info=0x03865a68, params=0x0012f7f0) Line 468 PrepareAndDispatch(self=0x059a68e8, methodIndex=0x00000003, args=0x0012f8b8, stackBytesToPop=0x0012f8a8) Line 117 SharedStub() Line 147 nsXMLHttpRequest::ChangeState(aState=0x059a68e8, aBroadcast=0x00000000, aClearEventListeners=0x059a68e8) Line 1903 nsXMLHttpRequest::ChangeState(aState=0x00000010, aBroadcast=0x00000001, aClearEventListeners=0x00000001) Line 1903 nsXMLHttpRequest::RequestCompleted() Line 1431 nsXMLHttpRequest::OnStopRequest(request=0x07a5ac88, ctxt=0x00000000, status=0x00000000) Line 1372 nsHTTPCompressConv::OnStopRequest(request=0x07a5ac88, aContext=0x00000000, aStatus=0x00000000) Line 135 nsStreamListenerTee::OnStopRequest(request=0x07a5ac88, context=0x00000000, status=0x00000000) Line 66 nsHttpChannel::OnStopRequest(request=0x07b80c60, ctxt=0x00000000, status=0x00000000) Line 4121 nsInputStreamPump::OnStateStop() Line 564 nsInputStreamPump::OnInputStreamReady(stream=0x07b80a40) Line 400 nsInputStreamReadyEvent::EventHandler(plevent=0x0542aeec) Line 121 PL_HandleEvent(self=0x0542aeec) Line 688 theRange appears to be dead: mRefCnt {655364} nsAutoRefCnt _mOwningThread {mThread=0x05dd00dd } nsAutoOwningThread mBeforeGenContent 0xf8 '&#1096;' unsigned char mAfterGenContent 0xc2 '&#1042;' unsigned char mIsPositioned 0x3d '=' unsigned char mIsDetached 0x07 '?' unsigned char mStartOffset 0x05a5cd60 int mEndOffset 0xdddddddd int mStartParent {0xdddddddd} nsCOMPtr<nsIDOMNode> mEndParent {0xdddddddd} nsCOMPtr<nsIDOMNode> theRange->mStartParent {0xdddddddd} nsCOMPtr<nsIDOMNode> It never gets removed from the list. I believe I can reproduce this in less than an hour, and I have it in the debugger right now (will have to close soon), so if you need more info, ask here or ping me on IRC.
Severity: normal → critical
Flags: blocking1.8.1?
Keywords: hang
OS: Mac OS X 10.3 → All
Hardware: Macintosh → All
Summary: nsRange hang → hang [@ nsRange::PopRanges]
I just hit this too, while using blogger.com to edit / publish posts (in case that helps.) Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060728 BonEcho/2.0b1 ###!!! ASSERTION: range and content disagree over range ownership: 'NS_SUCCEEDED (res)', file c:/builds/bonecho/mozilla/content/base/src/nsRange.cpp, line 799 ###!!! ASSERTION: nsRange::ContentOwnsUs: 'Not Reached', file c:/builds/bonecho/ mozilla/content/base/src/nsRange.cpp, line 838
[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1b1) Gecko/20060730 SeaMonkey/1.1a] (nightly) (W98SE) Since a few nightlies, I'm getting some random hangs (with noticeable CPU activity) in SeaMonkey v1.1a. I guess/hope this is the same bug !?
Keywords: regression
crashed ffx while doing some wiki edits this morning. Attaching a shark trace. Looks like a deadlocked semaphore is in there somewhere. see: http://antennasoft.net/pub/firefox_freeze_trace.zip
Flags: blocking1.8.1? → blocking1.8.1+
There's no deadlocked semaphore, just an endless loop because the ranges list gets corrupted. See comment 3. At least this is what I saw each time I looked at the hang in the debugger.
My guess is that this has to do with bug 321299, since it definitely touches this codepath (changing DocumentFragment which is used for innerHTML). Blake, do you think you'll be able to take a look at this?
Assignee: traversal-range → mrbkap
It would be great with a small testcase here, rather than "go to gmail and wait for an hour"
Assignee: mrbkap → bugmail
*** Bug 346695 has been marked as a duplicate of this bug. ***
Seeing it on Camino trunk builds, and a report in the Camino forum puts it on the branch as well. The Slashdot site will give you a few seconds of the spinning beach ball, then a couple Unresponsive Script pop-ups. Clicking Stop Script twice will eventually allow the site to load. There was no output to the Console log while any of this was happening.
Perhaps this is related to a hang I have always, TB21596236W. Stack from talkback-public.mozilla.org: nsGenericDOMDataNode::GetRangeList() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 1041] nsRange::OwnerChildRemoved() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsRange.cpp, line 848] doRemoveChildAt() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 3025] nsGenericElement::RemoveChildAt() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 842] nsGenericElement::RemoveChild() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 3656] nsRange::DeleteContents() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsRange.cpp, line 1539] nsGenericHTMLElement::SetInnerHTML() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 848] nsGenericHTMLElementTearoff::SetInnerHTML() XPTC_InvokeByIndex() XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2160] XPC_WN_GetterSetter() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1475] js_Invoke() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsinterp.c, line 1350] js_InternalInvoke() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsinterp.c, line 1449] js_InternalGetOrSet() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsinterp.c, line 1508] js_SetProperty() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsobj.c, line 3501] js_Interpret() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsinterp.c, line 3626] js_Execute() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsinterp.c, line 1599] JS_EvaluateUCScriptForPrincipals() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsapi.c, line 4331] nsJSContext::EvaluateString() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 146] nsScriptLoader::EvaluateScript() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsScriptLoader.cpp, line 848] nsScriptLoader::ProcessRequest() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsScriptLoader.cpp, line 674] nsScriptLoader::DoProcessScriptElement() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsScriptLoader.cpp, line 1056] nsScriptLoader::ProcessScriptElement() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsScriptLoader.cpp, line 358] nsHTMLScriptElement::MaybeProcessScript() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 660] nsHTMLScriptElement::BindToTree() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 453] nsGenericElement::AppendChildTo() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2868] HTMLContentSink::ProcessSCRIPTTag() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 956] HTMLContentSink::AddLeaf() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 3040] CNavDTD::AddLeaf() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 3576] CNavDTD::HandleScriptToken() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 2179] CNavDTD::OpenContainer() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 3229] CNavDTD::HandleDefaultStartToken() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 1281] CNavDTD::HandleStartToken() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 1668] CNavDTD::HandleToken() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 955] CNavDTD::BuildModel() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 457] nsParser::BuildModel() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/nsParser.cpp, line 842] nsParser::ResumeParse() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/nsParser.cpp, line 2007] nsParser::ContinueInterruptedParsing() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/nsParser.cpp, line 1482] nsParser::ContinueParsing() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/parser/htmlparser/src/nsParser.cpp, line 1458] CSSLoaderImpl::SheetComplete() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/style/nsCSSLoader.cpp, line 848] CSSLoaderImpl::SheetComplete() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/style/nsCSSLoader.cpp, line 1476] CSSLoaderImpl::ParseSheet() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/style/nsCSSLoader.cpp, line 1391] SheetLoadData::OnStreamComplete() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/style/nsCSSLoader.cpp, line 811] nsUnicharStreamLoader::OnStopRequest() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/netwerk/base/src/nsUnicharStreamLoader.cpp, line 178] nsHTTPCompressConv::OnStopRequest() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/netwerk/streamconv/converters/nsHTTPCompressConv.cpp, line 135] nsHttpChannel::OnStopRequest() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp, line 1149] nsInputStreamPump::OnStateStop() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 1149] nsInputStreamPump::OnInputStreamReady() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 400] nsInputStreamReadyEvent::EventHandler() PL_HandleEvent() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/threads/plevent.c, line 689] PL_ProcessPendingEvents() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/threads/plevent.c, line 623] nsEventQueueImpl::ProcessPendingEvents() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/threads/nsEventQueue.cpp, line 421] event_processor_callback() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 67] libglib-2.0.so.0 + 0x4d7df (0xb78fb7df) libglib-2.0.so.0 + 0x24e2c (0xb78d2e2c) libglib-2.0.so.0 + 0x28176 (0xb78d6176) libglib-2.0.so.0 + 0x28537 (0xb78d6537) libgtk-x11-2.0.so.0 + 0x12c4e1 (0xb7b9d4e1) nsAppShell::Run() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141] nsAppStartup::Run() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152] XRE_main() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2440] main() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 62] libc.so.6 + 0x14ea8 (0xb73c8ea8)
(In reply to comment #11) > The Slashdot site will give you a few seconds of the > spinning beach ball, then a couple Unresponsive Script pop-ups. Wouldn't this be more like bug 346801 ?
Attached patch Partial backout — — Splinter Review
This backs out the XPConnect-facing portions of the patch from bug 321299. This leaves only the backport of bug 27382 in the tree. If backing this patch out fixes this hang, then it's to blame, otherwise, we can look more carefully at the remaining changes.
Attachment #231828 - Flags: superreview?(bugmail)
Attachment #231828 - Flags: review?(bugmail)
Attachment #231828 - Flags: approval1.8.1?
Comment on attachment 231828 [details] [diff] [review] Partial backout a=schrep for drivers
Attachment #231828 - Flags: approval1.8.1? → approval1.8.1+
Comment on attachment 231828 [details] [diff] [review] Partial backout r/sr=me for this backout.
Attachment #231828 - Flags: superreview?(bugmail)
Attachment #231828 - Flags: superreview+
Attachment #231828 - Flags: review?(bugmail)
Attachment #231828 - Flags: review+
I just checked the partial backout into the branch.
Attached patch Patch to fix — — Splinter Review
The problem is that we're using the same bit to indicate "is in document" and "could have ranges", so when we're removing a node from the document we remove the flag indicating that we have a range.
Comment on attachment 231844 [details] [diff] [review] Patch to fix Pre-emptive sr=me. /be
Attachment #231844 - Flags: superreview+
Comment on attachment 231844 [details] [diff] [review] Patch to fix a=beltzner, thanks for getting to the bottom of this, y'all.
Attachment #231844 - Flags: approval1.8.1+
Blake, I think this clears you for reapplying your partial backout.
Checked in. Thanks goes out to blake that asked the right questions to get me on the right track.
Status: NEW → RESOLVED
Closed: 18 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
I backed out my backout at 17:45.
*** Bug 346308 has been marked as a duplicate of this bug. ***
No longer blocks: 346308
Well, I can still experience the joy of this bug on the following site : http://www.geoportail.fr/. I load a map for the first time; nothing happens for about a minute; the famous message "a script on this page ..." shows up; I stop the script, I reload the page and ... it works. So this site might be a good test case for the bug ...
Well, I can still experience the joy of this bug on the following site : http://www.geoportail.fr/. I load a map for the first time; nothing happens for about a minute; the famous message "a script on this page ..." shows up; I stop the script, I reload the page and ... it works. So this site might be a good test case for the bug ...
I forgot to mention: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1b1) Gecko/20060804 BonEcho/2.0b1 - Build ID: 2006080409
I filled bug #347501
*** Bug 346755 has been marked as a duplicate of this bug. ***
Whiteboard: required by 27382 (321299)
Flags: blocking1.8.0.7?
which of these patches (both?) do we want for 1.8.0.7?
Flags: blocking1.8.0.7? → blocking1.8.0.7+
Comment on attachment 231844 [details] [diff] [review] Patch to fix We want this patch for 1.8.0.7.
Attachment #231844 - Flags: approval1.8.0.7?
Comment on attachment 231844 [details] [diff] [review] Patch to fix approved for 1.8.0 branch, a=dveditz for drivers
Attachment #231844 - Flags: approval1.8.0.7? → approval1.8.0.7+
I checked a combined patch into the 1.8.0 branch.
Keywords: fixed1.8.0.7
verified with Fx 2.0b2 builds from 22060821
Status: RESOLVED → VERIFIED
Keywords: fixed1.8.0.7, fixed1.8.1 → verified1.8.0.7, verified1.8.1
Flags: blocking1.8.0.8?
why is this blocking 1.8.0.8? It's it already checked into the MOZILLA_1_8_0_BRANCH?
(In reply to comment #35) > why is this blocking 1.8.0.8? It's it already checked into the > MOZILLA_1_8_0_BRANCH? Unintended change, sorry.
Flags: blocking1.8.0.8?
Component: DOM: Traversal-Range → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: