402495 - Firefox crashes on Back button after form submit [@ nsGlobalWindow::GetScrollInfo]

Status: RESOLVED DUPLICATE of bug 384937

(Core :: Layout, defect)

Description

[Sean B. Durkin]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9

On the worldtimeserver web-site, if you convert a time and then press the back button, FireFox will crash.

Reproducible: Always

Steps to Reproduce:
1. Go to "http://www.worldtimeserver.com/convert_time_in_AU-NSW.aspx"
2. Enter any values, or leave as default.
3. Press the "Submit" button.
4. Wait for the next page to load ("http://www.worldtimeserver.com/time_converter.aspx?f=AU-NSW"), then press the browser Back button.

Actual Results:  
FireFox invariably crashes.

Expected Results:  
FireFox should reload the previous page ("http://www.worldtimeserver.com/convert_time_in_AU-NSW.aspx").
It should NOT crash.

Possibly related bugs are:

 https://bugzilla.mozilla.org/show_bug.cgi?id=311893
 https://bugzilla.mozilla.org/show_bug.cgi?id=393432

As a user, it is impossible for me to know if this is the same bug as one of those; a related bug; or a completely unrelated bug in the same general area of functionality (the Back button).

Comment 1

[Ria Klaassen (not reading all bugmail)]

I can reproduce the problem on 2.0.0.9 branch but not on trunk (Windows XP):
TB37751663Y

Comment 2

[Ria Klaassen (not reading all bugmail)]

Incident ID: 37751663
Stack Signature	nsGlobalWindow::GetScrollInfo 822bfee9
Product ID	Firefox2
Build ID	2007102514
Trigger Time	2007-11-05 11:56:28.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0022a9d9)
URL visited	
User Comments	
Since Last Crash	1851 sec
Total Uptime	1851 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 7263
Stack Trace 	
nsGlobalWindow::GetScrollInfo  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 7263]
nsGlobalWindow::ScrollTo  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 4025]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1375]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3946]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1394]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1469]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4351]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]
nsJSEventListener::HandleEvent  [mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsGlobalWindow::HandleDOMEvent  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 1733]
DocumentViewerImpl::LoadComplete  [mozilla/layout/base/nsDocumentViewer.cpp, line 1014]
nsDocShell::EndPageLoad  [mozilla/docshell/base/nsDocShell.cpp, line 4822]
nsWebShell::EndPageLoad  [mozilla/docshell/base/nsWebShell.cpp, line 673]
nsDocShell::OnStateChange  [mozilla/docshell/base/nsDocShell.cpp, line 4737]
nsDocLoader::FireOnStateChange  [mozilla/uriloader/base/nsDocLoader.cpp, line 1210]
nsDocLoader::doStopDocumentLoad  [mozilla/uriloader/base/nsDocLoader.cpp, line 844]
nsDocLoader::OnStopRequest  [mozilla/uriloader/base/nsDocLoader.cpp, line 665]
nsLoadGroup::RemoveRequest  [mozilla/netwerk/base/src/nsLoadGroup.cpp, line 732]
PresShell::RemoveDummyLayoutRequest  [mozilla/layout/base/nsPresShell.cpp, line 7311]
PresShell::Destroy  [mozilla/layout/base/nsPresShell.cpp, line 2056]
DocumentViewerImpl::Hide  [mozilla/layout/base/nsDocumentViewer.cpp, line 2036]
nsDocShell::SetVisibility  [mozilla/docshell/base/nsDocShell.cpp, line 3809]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsFrameList::DestroyFrames  [mozilla/layout/generic/nsFrameList.cpp, line 138]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsBlockFrame::DoRemoveFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 5807]
nsBlockFrame::RemoveFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 5598]
nsFrameManager::RemoveFrame  [mozilla/layout/base/nsFrameManager.cpp, line 717]
nsCSSFrameConstructor::ContentRemoved  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10149]
nsCSSFrameConstructor::ReinsertContent  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9681]
nsCSSFrameConstructor::ContentAppended  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 8926]
PresShell::ContentAppended  [mozilla/layout/base/nsPresShell.cpp, line 5599]
nsDocument::ContentAppended  [mozilla/content/base/src/nsDocument.cpp, line 2455]
nsHTMLDocument::ContentAppended  [mozilla/content/html/document/src/nsHTMLDocument.cpp, line 1196]
doInsertChildAt  [mozilla/content/base/src/nsGenericElement.cpp, line 2845]
nsGenericElement::InsertChildAt  [mozilla/content/base/src/nsGenericElement.cpp, line 2787]
nsGenericElement::InsertBefore  [mozilla/content/base/src/nsGenericElement.cpp, line 3073]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1375]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3946]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1394]
js_InvokeConstructor  [mozilla/js/src/jsinterp.c, line 1947]
js_Interpret  [mozilla/js/src/jsinterp.c, line 5200]
js_Execute  [mozilla/js/src/jsinterp.c, line 1634]
JS_EvaluateUCScriptForPrincipals  [mozilla/js/src/jsapi.c, line 4296]
nsJSContext::EvaluateString  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1100]
nsScriptLoader::EvaluateScript  [mozilla/content/base/src/nsScriptLoader.cpp, line 813]
nsScriptLoader::ProcessRequest  [mozilla/content/base/src/nsScriptLoader.cpp, line 711]
nsScriptLoader::DoProcessScriptElement  [mozilla/content/base/src/nsScriptLoader.cpp, line 644]
nsScriptLoader::ProcessScriptElement  [mozilla/content/base/src/nsScriptLoader.cpp, line 396]
nsHTMLScriptElement::MaybeProcessScript  [mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 663]
nsHTMLScriptElement::BindToTree  [mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 456]
nsGenericElement::AppendChildTo  [mozilla/content/base/src/nsGenericElement.cpp, line 2876]

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Attachment: stack

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Not a recent regression, I can reproduce with the Firefox 2.0 release. Doesn't seem to be a problem on the branch.

Comment 5

[Boris Zbarsky [:bzbarsky]]

> Doesn't seem to be a problem on the branch.

You mean on trunk?

Comment 6

[:Gavin Sharp [email: [e-mail]]]

Yes, I meant trunk.

Comment 7

[Boris Zbarsky [:bzbarsky]]

The issue is the sync onload from under PresShell::Destroy.  I'm pretty sure we have bugs that already cover that (firing onload async when removing the dummy layout request).  That's what we do on trunk, basically.

Comment 8

[Boris Zbarsky [:bzbarsky]]

As in, I seem to recall another branch bug with this exact same issue (onload firing when removing the dummy layout request), and maybe even a patch....

Comment 9

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #8)
> As in, I seem to recall another branch bug with this exact same issue (onload
> firing when removing the dummy layout request), and maybe even a patch....

Bug 346014, perhaps?

Comment 10

[Boris Zbarsky [:bzbarsky]]

No, bug 384937.

Comment 11

[Daniel Veditz [:dveditz]]

Not blocking. We'll look at the patch in bug 384937 which will fix this one if it's really a dupe.