39641 - crash when leaving this site

Status: VERIFIED FIXED

(SeaMonkey :: General, defect, P3)

Description

[Judson Valeski]

visit the url, then visit another one. boom. here's some stack. We're trying to 
release a bad nsITimer pointer.

nsCOMPtr<nsITimer>::~nsCOMPtr<nsITimer>() line 466 + 13 bytes
nsDocShell::CancelRefreshURITimers(nsDocShell * const 0x02ef4ecc) line 2031 + 15 
bytes
nsDocShell::InternalLoad(nsDocShell * const 0x02ef4ea0, nsIURI * 0x034a0050, 
nsIURI * 0x00000000, const char * 0x00000000, nsIInputStream * 0x00000000, 
nsDocShell::loadType loadNormal) line 2287
nsDocShell::LoadURI(nsDocShell * const 0x02ef4ea0, nsIURI * 0x034a0050, 
nsIDocShellLoadInfo * 0x00000000) line 213 + 42 bytes
nsDocShell::LoadURI(nsDocShell * const 0x02ef4eac, const unsigned short * 
0x034a01c0) line 1054 + 27 bytes
nsBrowserInstance::LoadUrl(nsBrowserInstance * const 0x02ef9b10, const unsigned 
short * 0x034a01c0) line 487 + 27 bytes
XPTC_InvokeByIndex(nsISupports * 0x02ef9b10, unsigned int 9, unsigned int 1, 
nsXPTCVariant * 0x0012dc88) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x023d9bb0, 
nsXPCWrappedNative * 0x02f23940, const XPCNativeMemberDescriptor * 0x02f23b8c, 
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 1, long * 
0x00ec0c40, long * 0x0012de38) line 914 + 43 bytes
WrappedNative_CallMethod(JSContext * 0x023d9bb0, JSObject * 0x015734b0, unsigned 
int 1, long * 0x00ec0c40, long * 0x0012de38) line 200 + 34 bytes
js_Invoke(JSContext * 0x023d9bb0, unsigned int 1, unsigned int 0) line 686 + 23 
bytes
js_Interpret(JSContext * 0x023d9bb0, long * 0x0012e76c) line 2485 + 15 bytes
js_Invoke(JSContext * 0x023d9bb0, unsigned int 1, unsigned int 2) line 702 + 13 
bytes
js_InternalInvoke(JSContext * 0x023d9bb0, JSObject * 0x00f3de10, long 22247392, 
unsigned int 0, unsigned int 1, long * 0x0012e904, long * 0x0012e8a4) line 775 + 
19 bytes
JS_CallFunctionValue(JSContext * 0x023d9bb0, JSObject * 0x00f3de10, long 
22247392, unsigned int 1, long * 0x0012e904, long * 0x0012e8a4) line 2783 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x023d89d0, void * 0x00f3de10, 
void * 0x015377e0, unsigned int 1, void * 0x0012e904, int * 0x0012e900, int 0) 
line 788 + 33 bytes

Comment 1

[Frank Tang]

pavlov- you land the timer code last night. Can you look at it quickly to see it 
is yours or not. Thanks

Comment 2

[Simon Fraser [no longer active]]

More timer refcount foo. Have a fix.

Comment 3

[Simon Fraser [no longer active]]

Fix checked in.

Comment 4

[racham]

*** Bug 39650 has been marked as a duplicate of this bug. ***

Comment 5

[Kevin Hecht]

*** Bug 39664 has been marked as a duplicate of this bug. ***

Comment 6

[Asa Dotzler [:asa]]

Sorry for the spam.  New QA Contact for Browser General.  Thanks for your help
Joseph (good luck with the new job) and welcome aboard Doron Rosenberg

Comment 7

[Doron Rosenberg (IBM)]

verified