Closed Bug 402175 Opened 18 years ago Closed 17 years ago

crash [@ nsPlaintextEditor::CanPaste] [@ nsCOMPtr_base::~nsCOMPtr_base()]

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: tonymec, Unassigned)

Details

(Keywords: crash, Whiteboard: [trunk and 1.8 Branch])

Crash Data

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a9pre) Gecko/2007110102 SeaMonkey/2.0a1pre Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a9pre) Gecko/2007110102 SeaMonkey/2.0a1pre I clicked right in a textarea in the browser, and SeaMonkey crashed. Reproducible: Couldn't Reproduce Actual Results: crash Expected Results: no crash Additional info: I don't know whether or how this bug is related to Tb2 bug 365120
Keywords: crash
Version: unspecified → Trunk
Oh, I forgot: the Breakpad report is at http://crash-stats.mozilla.com/report/index/17659991-8910-11dc-b54a-001a4bd43e5c?date=2007-11-02-06 Here's tye stack of the crashing thread: 0 nsCOMPtr_base::~nsCOMPtr_base() nsCOMPtr.cpp:81 1 nsPlaintextEditor::CanPaste(int, int*) mozilla/editor/libeditor/text/nsPlaintextDataTransfer.cpp:542 2 nsPasteCommand::IsCommandEnabled(char const*, nsISupports*, int*) mozilla/editor/libeditor/base/nsEditorCommands.cpp:404 3 nsControllerCommandTable::IsCommandEnabled(char const*, nsISupports*, int*) mozilla/embedding/components/commandhandler/src/nsControllerCommandTable.cpp:138 4 nsBaseCommandController::IsCommandEnabled(char const*, int*) mozilla/embedding/components/commandhandler/src/nsBaseCommandController.cpp:138 5 NS_GetXPTCallStub_P 6 XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2326 7 XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1467 8 js_Invoke mozilla/js/src/jsinterp.c:1386 9 js_Interpret mozilla/js/src/jsinterp.c:4146 10 js_Invoke mozilla/js/src/jsinterp.c:1406 11 js_InvokeConstructor mozilla/js/src/jsinterp.c:1952 12 js_Interpret mozilla/js/src/jsinterp.c:3517 13 js_Invoke mozilla/js/src/jsinterp.c:1406 14 js_InternalInvoke mozilla/js/src/jsinterp.c:1462 15 JS_CallFunctionValue mozilla/js/src/jsapi.c:4877 16 nsJSContext::CallEventHandler(nsISupports*, void*, void*, nsIArray*, nsIVariant**) mozilla/dom/src/base/nsJSEnvironment.cpp:1916 17 nsJSEventListener::HandleEvent(nsIDOMEvent*) mozilla/dom/src/events/nsJSEventListener.cpp:230 18 nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsISupports*, unsigned int) mozilla/content/events/src/nsEventListenerManager.cpp:1097 19 nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsISupports*, unsigned int, nsEventStatus*) mozilla/content/events/src/nsEventListenerManager.cpp:1211 20 nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int) mozilla/content/events/src/nsEventDispatcher.cpp:206 21 nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*) mozilla/content/events/src/nsEventDispatcher.cpp:264 22 nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) mozilla/content/events/src/nsEventDispatcher.cpp:479 23 nsXULPopupManager::FirePopupShowingEvent(nsIContent*, nsIContent*, nsPresContext*, nsPopupType, int, int) mozilla/layout/xul/base/src/nsXULPopupManager.cpp:832 24 nsXULPopupManager::ShowPopupAtScreen(nsIContent*, int, int, int) mozilla/layout/xul/base/src/nsXULPopupManager.cpp:397 25 nsXULPopupListener::LaunchPopup(nsIDOMEvent*, nsIContent*) mozilla/content/xul/content/src/nsXULPopupListener.cpp:483 26 nsXULPopupListener::PreLaunchPopup(nsIDOMEvent*) mozilla/content/xul/content/src/nsXULPopupListener.cpp:242 27 nsXULPopupListener::ContextMenu(nsIDOMEvent*) mozilla/content/xul/content/src/nsXULPopupListener.cpp:125 28 nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsISupports*, unsigned int, nsEventStatus*) mozilla/content/events/src/nsEventListenerManager.cpp:184 29 nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int) mozilla/content/events/src/nsEventDispatcher.cpp:206 30 nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*) mozilla/content/events/src/nsEventDispatcher.cpp:287 31 nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) mozilla/content/events/src/nsEventDispatcher.cpp:479 32 PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*) mozilla/layout/base/nsPresShell.cpp:5776 33 PresShell::HandlePositionedEvent(nsIView*, nsIFrame*, nsGUIEvent*, nsEventStatus*) mozilla/layout/base/nsPresShell.cpp:5665 34 PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*) mozilla/layout/base/nsPresShell.cpp:5508 35 nsViewManager::HandleEvent(nsView*, nsPoint, nsGUIEvent*, int) mozilla/view/src/nsViewManager.cpp:1296 36 nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) mozilla/view/src/nsViewManager.cpp:1252 37 HandleEvent(nsGUIEvent*) mozilla/view/src/nsView.cpp:168 38 nsCommonWidget::DispatchEvent(nsGUIEvent*, nsEventStatus&) mozilla/widget/src/gtk2/nsCommonWidget.cpp:225 39 nsWindow::OnButtonPressEvent(_GtkWidget*, _GdkEventButton*) mozilla/widget/src/gtk2/nsWindow.cpp:2059 40 button_press_event_cb(_GtkWidget*, _GdkEventButton*) mozilla/widget/src/gtk2/nsWindow.cpp:4411 41 libgtk-x11-2.0.so.0.1000.6@0x1321af 42 libgobject-2.0.so.0.1200.4@0x9c0a 43 libgobject-2.0.so.0.1200.4@0x1ad3c 44 libgobject-2.0.so.0.1200.4@0x1c00e 45 libgobject-2.0.so.0.1200.4@0x1c414 46 libgtk-x11-2.0.so.0.1000.6@0x245b17 47 libgtk-x11-2.0.so.0.1000.6@0x12b652 48 libgtk-x11-2.0.so.0.1000.6@0x12c856 49 libgdk-x11-2.0.so.0.1000.6@0x42029 50 libglib-2.0.so.0.1200.4@0x2dde1 51 libglib-2.0.so.0.1200.4@0x30e1e 52 libglib-2.0.so.0.1200.4@0x31384 53 nsAppShell::ProcessNextNativeEvent(int) mozilla/widget/src/gtk2/nsAppShell.cpp:144 54 nsBaseAppShell::DoProcessNextNativeEvent(int) mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:137 55 nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int) mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:247 56 nsThread::ProcessNextEvent(int, int*) mozilla/xpcom/threads/nsThread.cpp:477 57 NS_ProcessNextEvent_P(nsIThread*, int) nsThreadUtils.cpp:227 58 nsBaseAppShell::Run() mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154 59 nsAppStartup::Run() mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170 60 XRE_main mozilla/toolkit/xre/nsAppRunner.cpp:3142 61 main mozilla/suite/app/nsSuiteApp.cpp:99 62 libc-2.5.so@0x1602b
Today I got crash bp-91daea02-db56-11dc-b03e-001a4bd43ef6 in build "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b4pre) Gecko/2008021402 SeaMonkey/2.0a1pre" while holding the right mouse button (again) in that same textarea (at http://www.spamcop.net/ the way the page displays to logged-in users). There are similarities and differences in the stack, but the top frame is again nsCOMPtr_base::~nsCOMPtr_base(). In the meantime I've been using that same webpage & textarea quite often with no problem: I use it to report my spam, several tens of times per day. Triagers (and other -moz-hackers), if you think copying the new stack into this bug before the crash report servers "forget" it, go ahead. :-)
er, I meant, if you think _it is worth_ copying...
See also http://crash-stats.mozilla.com/report/list?range_unit=months&query_search=signature&query_type=contains&signature=nsCOMPtr_base%3A%3A%7EnsCOMPtr_base%28%29&query=nsCOMPtr_base&range_value=3 (in 3 months, nsCOMPtr_base::~nsCOMPtr_base() crashed 17 times on Linux, 121 times on MacOsX, 18 times on Windows, as tabulated there for trunk builds only.)
Today (well, yesterday, depending on timezone) I got a very similar stack, but in Firefox 2 while starting up: TB44163564W Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.15pre) Gecko/20080420 BonEcho/2.0.0.15pre Build ID: 2008042003
Assignee: general → nobody
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Linux → All
Product: Mozilla Application Suite → Core
QA Contact: general → general
Hardware: PC → All
Whiteboard: [trunk and 1.8 Branch]
URL: http://www.spamcop.net/
Summary: crash [@ nsCOMPtr_base::~nsCOMPtr_base()] right-clicking a textarea → crash [@ nsCOMPtr_base::~nsCOMPtr_base()]
Firefox 2 starting up again: TB45064076Y Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.15pre) Gecko/20080512 BonEcho/2.0.0.15pre Build ID: 2008051205
Firefox 2 startup: TB45791006Q Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.15pre) Gecko/20080531 BonEcho/2.0.0.15pre Build ID: 2008053103
Firefox 2 startup: TB47372013M Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.17pre) Gecko/20080706 BonEcho/2.0.0.17pre Build ID: 2008070603 Soccorro mentions this signature on all four Tier1 platforms (Windows, Linux, Mac-x86, Mac-ppc) until 2008061004, Firefox only unless I missed something (but see comment #0). Talkback sees it on LinuxIntel and MacOSX for Firefox2, Thunderbird2, Thunderbird15 and even "Mozilla17".
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.20pre) Gecko/20081203 BonEcho/2.0.0.20pre - Build ID: 2008120303 at startup again: TB51461062Q
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.21pre) Gecko/20090109 BonEcho/2.0.0.21pre - Build ID: 2009010904 TB52290485K at startup. I wonder what combination of circumstances triggers this crash.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.21pre) Gecko/20090112 BonEcho/2.0.0.21pre - Build ID: 2009011204 TB52373070K at startup. The 5 top frames are identical with those of the Gecko-1.9a9pre stack in comment #1. The rest is similar but not 100% identical.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.21pre) Gecko/20090115 BonEcho/2.0.0.21pre - Build ID: 2009011505 TB52415361W and TB52416035Q (in succession) at startup.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.21pre) Gecko/20090215 BonEcho/2.0.0.21pre - Build ID: 2009021503 TB52984298G at startup
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.21pre) Gecko/20090225 BonEcho/2.0.0.21pre - Build ID: 2009022505 TB53172331E and TB53172703E at startup
- Has this problem been fixed on trunk? If it has, this bug should be resolved FIXED, DUPLICATE or WORKSFORME, or else have its Version set back to Fx2 or to the highest version for which it has not been fixed. - I know Fx2 tinderboxen will be decommissionned sometime soon (but they haven't yet as of this writing, AFAICT). In the meantime, is this crash serious enough to rate a "security/stability upgrade" on the Fx2 branch? If not, the WONTFIX status of this problem for Fx2 should be mentioned somehow, either in the Resolution after setting the Version back to Fx2, or on the Whiteboard if there is no appropriate Keyword.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.21pre) Gecko/2009030103 BonEcho/2.0.0.21pre TB53249657X at startup
(In reply to comment #16) > Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.21pre) Gecko/2009030103 > BonEcho/2.0.0.21pre also TB53249968Y
TB53337711Q in yesterday's Linux-i686 Fx 2.0.0.22pre.
Tony, have you seen this with Firefox 3.5 or newer? If not, let's mark this as WFM. FWIW, yes, you should file separate bugs based on the second stack frame when the first is the nsCOMPtr destructor. It's unlikely to be the nsCOMPtr's fault.
Component: General → Editor
QA Contact: general → editor
Summary: crash [@ nsCOMPtr_base::~nsCOMPtr_base()] → crash [@ nsPlaintextEditor::CanPaste] [@ nsCOMPtr_base::~nsCOMPtr_base()]
(In reply to comment #19) > Tony, have you seen this with Firefox 3.5 or newer? If not, let's mark this as > WFM. I haven't been using Firefox much lately. I haven't seen this recently in SeaMonkey comm-1.9.1.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ nsPlaintextEditor::CanPaste] [@ nsCOMPtr_base::~nsCOMPtr_base()]
You need to log in before you can comment on or make changes to this bug.