39307 - Crashes on browser exit at nsGenericElement::SetDocument

Status: VERIFIED DUPLICATE of bug 38941

(Core :: Layout, defect, P3)

Description

[Shiva Thirumazhusai]

Stack Trace :-

nsGenericElement::SetDocument 
[d:\builds\seamonkey\mozilla\layout\base\src\nsGenericElement.cpp, line 966] 
nsGenericHTMLElement::SetDocument 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 912] 
nsHTMLMenuElement::SetDocument 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLMenuElement.cpp, line 
69] 
nsDocument::SetScriptGlobalObject 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1543] 
DocumentViewerImpl::~DocumentViewerImpl 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocumentViewer.cpp, line 407] 
DocumentViewerImpl::`scalar deleting destructor' 
DocumentViewerImpl::Release 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocumentViewer.cpp, line 348] 
nsCOMPtr_base::assign_with_AddRef 
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 59] 
nsWebShell::Destroy [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, 
line 1600] 
nsXULWindow::Destroy 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 416] 
nsWebShell::Destroy [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, 
line 1600] 
nsXULWindow::Destroy 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 416] 
nsWebShellWindow::Destroy 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp, line 1731] 
nsWebShellWindow::Close 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp, line 366] 
nsAppShellService::~nsAppShellService 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 100] 
nsAppShellService::`scalar deleting destructor' 
nsAppShellService::Release 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 109] 
DeleteEntry [d:\builds\seamonkey\mozilla\xpcom\components\nsServiceManager.cpp, 
line 212] 
_hashEnumerateRemove [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 
240] 
PL_HashTableEnumerateEntries [plhash.c, line 414] 
nsHashtable::Reset [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 
257] 

Code Around the crash :-

955                void
 956                nsGenericElement::SetDocumentInChildrenOf(nsIContent* 
aContent, 
 957                                                          nsIDocument* 
aDocument)
 958                {
 959                  PRInt32 i, n;
 960                  aContent->ChildCount(n);
 961                  for (i = 0; i < n; i++) {
 962                    nsIContent* child;
 963                    aContent->ChildAt(i, child);
 964 vidur    3.1       if (nsnull != child) {
 965                      child->SetDocument(aDocument, PR_TRUE);
 966                      NS_RELEASE(child);
 967                    }
 968                  }
 969                }
 970

Comment 1

[Asa Dotzler [:asa]]

updating component and owner.  jst and mjudge most recently touched 

Comment 2

[Shiva Thirumazhusai]

Adding keywords crash, topcrash.

Comment 3

[harishd]

*** This bug has been marked as a duplicate of 38941 ***

Comment 4

[Chris Petersen]

Marking verified dup of 38941.