37076 - Crashes on Back Button at nsHTMLInputElement::~nsHTMLInputElement 34afee55

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P1)

Description

[Shiva Thirumazhusai]

One of the top crash submitted by QFA.It seems the crash happens in cleanup 
code.

User Comment :-

Popular sites in which the back button are clicked :-

-leaving cnn.com causes crash
-going back from sharkyextreme.com/games to sharkyextreme.com
-leaving www.cnn.com for developer.netscape.com ...
-www.arstechnica.com

Other Causes :
 -exiting .exe
 -Crasjing Exit Win 32 Navigator via File-->Quit
 -did a search on foobar in the search panel and clicked on one
 -closed browser while it was loading yahoo mail
 -On a slow connection if you close the Netscape Activation window before it 
finishes drawing the Browser Crashes..


Stack Trace :-

ncident ID 9090138 
nsHTMLInputElement::~nsHTMLInputElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp, 
line 213] 
nsHTMLInputElement::`scalar deleting destructor' 
nsHTMLInputElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp, 
line 258] 
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2863] 
nsHTMLTableRowElement::~nsHTMLTableRowElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, 
line 257] 
nsHTMLTableRowElement::`scalar deleting destructor' 
nsHTMLTableRowElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, 
line 261] 
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2863] 
nsHTMLTableSectionElement::~nsHTMLTableSectionElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c
pp, line 121] 
nsHTMLTableSectionElement::`scalar deleting destructor' 
nsHTMLTableSectionElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c
pp, line 125] 
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2863] 
nsHTMLTableElement::~nsHTMLTableElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, 
line 363] 
nsHTMLTableElement::`scalar deleting destructor' 
nsHTMLTableElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, 
line 367] 
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2863] 
nsHTMLTableRowElement::~nsHTMLTableRowElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, 
line 257] 
nsHTMLTableRowElement::`scalar deleting destructor' 
nsHTMLTableRowElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, 
line 261] 
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2863] 
nsHTMLTableSectionElement::~nsHTMLTableSectionElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c
pp, line 121] 
nsHTMLTableSectionElement::`scalar deleting destructor' 
nsHTMLTableSectionElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c
pp, line 125] 
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2863] 
nsHTMLTableElement::~nsHTMLTableElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, 
line 363] 
nsHTMLTableElement::`scalar deleting destructor' 
nsHTMLTableElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, 
line 367] 
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2863] 
nsBodyInner::~nsBodyInner 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLBodyElement.cpp, line 
157] 
nsHTMLBodyElement::`scalar deleting destructor' 
nsHTMLTableColGroupElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableColGroupElement.
cpp, line 115] 
nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2863] 
nsHTMLHtmlElement::`scalar deleting destructor' 
nsHTMLMenuElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLMenuElement.cpp, line 
109] 
nsDocument::~nsDocument 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 674] 
nsHTMLDocument::~nsHTMLDocument 
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 
274] 
nsDocument::Release [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, 
line 803] 
nsXMLDocument::Release 
[d:\builds\seamonkey\mozilla\layout\xml\document\src\nsXMLDocument.cpp, line 
194] 
nsCOMPtr_base::~nsCOMPtr_base 
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 50] 
DocumentViewerImpl::~DocumentViewerImpl 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocumentViewer.cpp, line 398] 


Code Around this area:-

 20               nsHTMLInputElement::~nsHTMLInputElement()
 207               {
 208 karnaze  1.5    if (nsnull != mForm) {
 209                   // prevent mForm from decrementing its ref count on us
 210                   mForm->RemoveElement(this, PR_FALSE); 
 211                   NS_RELEASE(mForm);
 212                 }
 213 kipp     1.1  }

Comment 1

[Shiva Thirumazhusai]

Adding topcrash keyword

Comment 2

[Shiva Thirumazhusai]

This crash also happens a lot while closing Netscape 6.

Comment 3

[Kathleen :Brade]

is this the same crash as #36451?

Comment 4

[troy]

Buster, I think input elements is you

Comment 5

[buster]

It looks like aChild in nsFormControlList::RemoveElementFromTable() has already 
been deleted before this call.  On top of that on the stack, mForm in 
nsHTMLInputElement::~nsHTMLInputElement() has already been deleted.  So, maybe 
this is a ref counting bug on mForm?  

Reassigning to Rod. I can't take all the fun...

Comment 6

[troy]

Cc'ing Nisheeth. Buster's description sounds a lot like the problem that 
Nisheeth was looking at

Comment 7

[Nisheeth Ranjan]

Re-assigning this to Eric Pollmann.  He has code in his tree that cleans up the 
circular references between a form and its form controls.

Comment 8

[Eric Pollmann]

Accepting.  This is also being tracked as bug 36639.  Keeping this open for a 
test case.

Comment 9

[Eric Pollmann]

Nisheeth, your fix for this crash earlier seems to have stuck, can't reproduce 
this in today's builds.

Comment 10

[leger]

Adding crash keyword

Comment 11

[Chris Petersen]

Works for me in the July 11th build.

Comment 12

[Shiva Thirumazhusai]

Moving all the Works For Me bugs to talkback user account for future reference.

Comment 13

[Shiva Thirumazhusai]

We are gathering all the Resolved and WFM bugs which are happened to be topcrash 
bugs and assigning it to talkback. I am marking all of them as RESOLVED WFM.

Comment 14

[Jay Patel [:jay]]

v.wfm...haven't seen this crash anywhere in Talkback data recently.