351247 - crash involving undoing close tab with session restore [@ nsGlobalWindow::GetScrollInfo]

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[Adam Guthrie]

Martijn pointed this crash out to me from a Talkback report. Rough steps to reproduce are:

1. Load http://www.xanga.com/shakey80 in a tab and reload until the Google ads appear at the top.
2. Close the tab.
3. History > Recently Closed Tabs > shakey80's xanga site.

The stack looks something like:

Incident ID: 21881577
Stack Signature	nsGlobalWindow::GetScrollInfo() 632da085
Product ID	Firefox2
Build ID	2006071020
Trigger Time	2006-08-07 16:29:13.0
Platform	LinuxIntel
Operating System	Linux 2.4.21-27.0.4.EL
Module	firefox-bin + (003fda99)
URL visited	
User Comments	Closing a tab
Since Last Crash	37 sec
Total Uptime	80 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.	/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 178
Stack Trace 	
nsGlobalWindow::GetScrollInfo()  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 178]
nsGlobalWindow::ScrollTo()  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 3914]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)()  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2159]
XPC_WN_CallMethod()  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1450]
js_Invoke()  [mozilla/js/src/jsinterp.c, line 1349]
js_Interpret()  [mozilla/js/src/jsinterp.c, line 4086]
js_Invoke()  [mozilla/js/src/jsinterp.c, line 1368]
js_InternalInvoke()  [mozilla/js/src/jsinterp.c, line 1448]
...

Session restore code is calling scrollTo on a "window" here: http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/browser/components/sessionstore/src/nsSessionStore.js&rev=1.46&mark=1450#1444.

Not all of these crashes involve session restore, though. Another stack for example:
Incident ID: 21825501
Stack Signature	nsGlobalWindow::GetScrollInfo c1cc3c15
Product ID	Firefox2
Build ID	2006071020
Trigger Time	2006-08-06 00:34:06.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0019cf96)
URL visited	computerstefreak.de
User Comments	
Since Last Crash	627 sec
Total Uptime	627 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 7081
Stack Trace 	
nsGlobalWindow::GetScrollInfo  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 7081]
nsGlobalWindow::GetScrollXY  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 2932]
nsGlobalWindow::GetScrollX  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 2960]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2160]
XPC_WN_GetterSetter  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1482]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1349]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1447]
...

Comment 1

[Adam Guthrie]

Attachment: stack trace from a 1.8 build

The stack is a little different in a debug build. It looks like we're failing to get the view manager from the pres shell.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Branch only? It seems to work for me on trunk.

Care to find the trunk bug that fixed this? :-)

Comment 3

[Martijn Wargers (dead)]

Well, the steps to reproduce don't work on trunk, but I remember I did manage to crash somehow with this same stacktrace on trunk, in a more or less related way.

Comment 4

[Martijn Wargers (dead)]

Marking worksforme, 1.8 branch isn't maintained anymore and this bug was hard to reproduce anyway.