crash when pictures are opened in a new tab [@ nsDOMImplementation::CreateDocument]

RESOLVED FIXED

Status

()

Core
General
--
critical
RESOLVED FIXED
12 years ago
7 years ago

People

(Reporter: Peter6, Unassigned)

Tracking

({crash, regression})

Trunk
x86
Windows XP
crash, regression
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

(Reporter)

Description

12 years ago
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070105 Minefield/3.0a2pre ID:2007010514 [cairo]

repro:
open URL
middleclick on 10-20 pictures to open them in a new tab

result:
Incident ID: 28082571
Stack Signature	nsDOMImplementation::CreateDocument 7c646539
Product ID	FirefoxTrunk
Build ID	2007010507
Trigger Time	2007-01-06 01:49:46.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0017582b)
URL visited	http://babeswithbooks.blogspot.com/
User Comments	crash when opening >10 pictures in a new tab
Since Last Crash	22169 sec
Total Uptime	22169 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\base\src\nsdocument.cpp, line 609
Stack Trace 	
nsDOMImplementation::CreateDocument  [mozilla\content\base\src\nsdocument.cpp, line 609]
nsCycleCollectionXPCOMRuntime::Traverse  [mozilla\xpcom\base\nscyclecollector.cpp, line 954]
GraphWalker::NoteXPCOMChild  [mozilla\xpcom\base\nscyclecollector.cpp, line 624]
nsEventListenerManager::FindJSEventListener  [mozilla\content\events\src\nseventlistenermanager.cpp, line 807]
nsCycleCollectionXPCOMRuntime::Traverse  [mozilla\xpcom\base\nscyclecollector.cpp, line 954]

Updated

12 years ago
Blocks: 333078
(Reporter)

Comment 1

12 years ago
This doesn't seem to depend on bug  333078, it even crashes before it landed.

the last build before Cycle collector landed:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104 Minefield/3.0a2pre ID:2007010418 [cairo]

Incident ID: 28083799
Stack Signature	nsDocument::AddStyleSheet 1ca52137
Product ID	FirefoxTrunk
Build ID	2007010404
Trigger Time	2007-01-06 03:08:10.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00175bd0)
URL visited	http://babeswithbooks.blogspot.com/
User Comments	Bug 366127 - last build before cycle collector landed
Since Last Crash	84 sec
Total Uptime	33830 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\base\src\nsdocument.cpp, line 1964
Stack Trace 	
nsDocument::AddStyleSheet  [mozilla\content\base\src\nsdocument.cpp, line 1964]
PrepareAndDispatch  [mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, line 102]
nsXPTCStubBase::Stub83  [mozilla\dist\include\xpcom\xptcstubsdef.inc, line 85]
nsEventListenerManager::CompileEventHandlerInternal  [mozilla\content\events\src\nseventlistenermanager.cpp, line 1168]
PrepareAndDispatch  [mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, line 102]



the first build with cycle collector included
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104 Minefield/3.0a2pre ID:2007010414 [cairo]

Incident ID: 28083703
Stack Signature	nsDocument::SetHeaderData aedf4f54
Product ID	FirefoxTrunk
Build ID	2007010404
Trigger Time	2007-01-06 03:04:02.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001758a9)
URL visited	http://babeswithbooks.blogspot.com/
User Comments	Bug 366127 - first build with cycle collector
Since Last Crash	33746 sec
Total Uptime	33746 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\base\src\nsdocument.cpp, line 1506
Stack Trace 	
nsDocument::SetHeaderData  [mozilla\content\base\src\nsdocument.cpp, line 1506]
nsXPTCStubBase::Stub25  [mozilla\dist\include\xpcom\xptcstubsdef.inc, line 27]
nsXPTCStubBase::Stub124  [mozilla\dist\include\xpcom\xptcstubsdef.inc, line 126]
nsEventListenerManager::CompileEventHandlerInternal  [mozilla\content\events\src\nseventlistenermanager.cpp, line 1147]
nsXPTCStubBase::Stub25  [mozilla\dist\include\xpcom\xptcstubsdef.inc, line 27]

Comment 2

12 years ago
(In reply to comment #1)
> This doesn't seem to depend on bug  333078, it even crashes before it landed.
> 
> the last build before Cycle collector landed:
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104
> Minefield/3.0a2pre ID:2007010418 [cairo]
> Build ID        2007010404
> 
> the first build with cycle collector included
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104
> Minefield/3.0a2pre ID:2007010414 [cairo]
> Build ID        2007010404

I'm confused, what's up with the build ids?
No longer blocks: 333078

Comment 3

12 years ago
Btw, no crash here with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070104 Minefield/3.0a2pre ID:2007010404 [cairo].
I believe this has the same underlying cause as bug 366063.
Depends on: 366063
(Reporter)

Comment 5

12 years ago
(In reply to comment #3)
> Btw, no crash here with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
> rv:1.9a2pre) Gecko/20070104 Minefield/3.0a2pre ID:2007010404 [cairo].
> 
Yeah, my bad, I picked the wrong next build in my list.
It's definitly bug 333078

Updated

12 years ago
Severity: major → critical
(Reporter)

Comment 6

12 years ago
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070106 Minefield/3.0a2pre ID:2007010614 [cairo]

The crash went away after Graydon checked in 

Bug 333078, Temporary band-aid for nsImageDocument cycle collection crashers.
at 2007-01-06 14:09
Fixed again -- more correctly -- with subsequent patch in 366063. Please reopen if you are still seeing it.
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
(Assignee)

Updated

7 years ago
Crash Signature: [@ nsDOMImplementation::CreateDocument]
You need to log in before you can comment on or make changes to this bug.