39889 - Crash on exit

Status: VERIFIED WORKSFORME

(Core :: XUL, defect, P3)

Description

[scottputterman]

About 3 out of 5 times today I've gotten a crash on exit.  I put XPToolkit 
because I see nsBoxFrame and nsGFXScrollFrame towards the top of the stack.:

00000000()
nsContainerFrame::Destroy(nsContainerFrame * const 0x01368dec, nsIPresContext * 
0x0251ed10) line 95
nsBoxFrame::Destroy(nsBoxFrame * const 0x01368dec, nsIPresContext * 0x0251ed10) 
line 831 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x0251ed10) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01368d48, nsIPresContext * 
0x0251ed10) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x01368d48, nsIPresContext * 0x0251ed10) 
line 831 + 13 bytes
nsGfxScrollFrame::Destroy(nsGfxScrollFrame * const 0x01368d48, nsIPresContext * 
0x0251ed10) line 421
nsFrameList::DestroyFrames(nsIPresContext * 0x0251ed10) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01368cd0, nsIPresContext * 
0x0251ed10) line 98
ViewportFrame::Destroy(ViewportFrame * const 0x01368cd0, nsIPresContext * 
0x0251ed10) line 144
FrameManager::~FrameManager() line 354
FrameManager::`scalar deleting destructor'(unsigned int 1) + 15 bytes
FrameManager::Release(FrameManager * const 0x0253be80) line 339 + 157 bytes
PresShell::~PresShell() line 1046 + 36 bytes
PresShell::`scalar deleting destructor'() + 15 bytes
PresShell::Release(PresShell * const 0x0253d930) line 960 + 158 bytes
nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 467
DocumentViewerImpl::~DocumentViewerImpl() line 435 + 97 bytes
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x025208f0) line 344 + 
154 bytes
nsCOMPtr<nsIContentViewer>::assign_assuming_AddRef(nsIContentViewer * 
0x00000000) line 449
nsCOMPtr<nsIContentViewer>::assign_with_AddRef(nsISupports * 0x00000000) line 
820
nsCOMPtr<nsIContentViewer>::operator=(nsIContentViewer * 0x00000000) line 559
nsDocShell::Destroy(nsDocShell * const 0x02a00224) line 1299
nsWebShell::Destroy(nsWebShell * const 0x02a00224) line 1598
nsXULWindow::Destroy(nsXULWindow * const 0x02a070c4) line 424
nsWebShellWindow::Destroy(nsWebShellWindow * const 0x02a070c4) line 1732
nsWebShellWindow::Close(nsWebShellWindow * const 0x02a07124) line 364
nsAppShellService::~nsAppShellService() line 101
nsAppShellService::`scalar deleting destructor'() + 15 bytes
nsAppShellService::Release(nsAppShellService * const 0x015e6e30) line 108 + 133 
bytes
nsXPCWrappedNative::~nsXPCWrappedNative() line 390 + 27 bytes
nsXPCWrappedNative::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXPCWrappedNative::Release(nsXPCWrappedNative * const 0x095ffb10) line 71 + 31 
bytes
nsXPCWrappedNative::JSObjectFinalized(JSContext * 0x03306e90, JSObject * 
0x01315f38) line 96
WrappedNative_Finalize(JSContext * 0x03306e90, JSObject * 0x01315f38) line 691
js_FinalizeObject(JSContext * 0x03306e90, JSObject * 0x01315f38) line 1489 + 114 
bytes
js_GC(JSContext * 0x03306e90) line 1035 + 11 bytes
js_ForceGC(JSContext * 0x03306e90) line 770 + 9 bytes
js_DestroyContext(JSContext * 0x03306e90, int 2) line 205 + 9 bytes
JS_DestroyContext(JSContext * 0x03306e90) line 787 + 11 bytes
mozJSComponentLoader::~mozJSComponentLoader() line 156 + 13 bytes
mozJSComponentLoader::`scalar deleting destructor'(unsigned int 1) + 15 bytes
mozJSComponentLoader::Release(mozJSComponentLoader * const 0x015de2d0) line 163 
+ 154 bytes
_ReleaseElement(nsHashKey * 0x015de200, void * 0x015de2d0, void * 0x00000000) 
line 392 + 18 bytes
_hashEnumerate(PLHashEntry * 0x015def70, int 0, void * 0x0012fe1c) line 99 + 26 
bytes
PL_HashTableEnumerateEntries(PLHashTable * 0x010b6930, int (PLHashEntry *, int, 
void *)* 0x10019730 _hashEnumerate(PLHashEntry *, int, void *), void * 
0x0012fe1c) line 414 + 15 bytes
nsHashtable::Enumerate(int (nsHashKey *, void *, void *)* 0x10019d10 
_ReleaseElement(nsHashKey *, void *, void *), void * 0x00000000) line 237 + 20 
bytes
nsSupportsHashtable::~nsSupportsHashtable() line 399
nsSupportsHashtable::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsComponentManagerImpl::Shutdown() line 321 + 31 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 622 + 11 bytes
main(int 1, char * * 0x010b4f00) line 1193 + 8 bytes
mainCRTStartup() line 338 + 17 bytes

Comment 1

[Bernd Mielke]

There was a similar bug 34411, the stack trace is not absolut identical but
similar. (It was a nsbeta2 bug).

Comment 2

[Peter Trudelle]

reassigning to evaughan for triage.

Comment 3

[leger]

Adding crash keyword

Comment 4

[Andreas Franke (gone)]

Another crash in nsContainerFrame::Destroy is described in bug 31426.

Comment 5

[Eric Vaughan]

I can't seem to make this happen. 

Comment 6

[scottputterman]

I'm reopening.  It just happened again to me with this morning's build.  I'm 
using mailnews but I don't know what it takes to make this happen.

Comment 7

[Eric Vaughan]

targeting

Comment 8

[John Morrison]

putterman : is this still a problem? If not, can we close this out?

In the meantime, mass-moving all evaughan non-nsbeta3+ bugs to 'Future'
milestone (per trudelle)

Comment 9

[scottputterman]

ok.  I'll mark WFM since I havne't seen it recently.  If I start seeing it again 
I'll reopen.

Comment 10

[Keyser Sose]

Works for me:
Platform: PC
OS: Windows 98
Mozilla Build: 2000101214 M18 Trunk Build

Marking as Verified.