367198 - Crash in nsBindingManager::NodeWillBeDestroyed

Status: RESOLVED INCOMPLETE

(Core :: DOM: Core & HTML, defect)

Description

[Stuart Parmenter]

nsCOMPtr<nsIMutationObserver>::assign_with_AddRef(rawPtr=0x05cfce60) Line 1235	C++
 	nsCOMPtr<nsIMutationObserver>::operator=(rhs=0x05cfce60) Line 714	C++
>	nsBindingManager::NodeWillBeDestroyed(aNode=0x058f60f8) Line 1422	C++
 	nsNodeUtils::LastRelease(aNode=0x058f60f8, aDelete=0) Line 191	C++
 	nsDocument::LastRelease() Line 881	C++
 	nsDocument::Release() Line 937	C++
 	nsHTMLDocument::Release() Line 344	C++
 	nsCycleCollectionXPCOMRuntime::Unroot(nodes={...}) Line 1016	C++
 	nsCycleCollector::CollectWhite() Line 918	C++
 	nsCycleCollector::Collect() Line 1637	C++
 	nsCycleCollector_collect() Line 1710	C++
 	nsJSContext::LoadEnd() Line 3203	C++
 	DocumentViewerImpl::LoadComplete(aStatus=0) Line 1118	C++
 	nsDocShell::EndPageLoad(aProgress=0x0484a70c, aChannel=0x05e04868, aStatus=0) Line 4741	C++

iter was 3

I was on http://www.dpreview.com/reviews/canona640/page6.asp and hit the next button towards the bottom when the crash occurred.

Comment 1

[Jesse Ruderman on Windows]

Jonas, can you figure out what went wrong based on the stack?  If not, please mark the bug as INCO.

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

No, it's been too long. And this was from very early days of cycle collector, so I wouldn't be surprised if this has been fixed.