Closed Bug 41335 Opened 24 years ago Closed 24 years ago

Crash while closing a browser window

Categories

(Core :: XPConnect, defect, P3)

Product:
Core
Component:
XPConnect
Platform:
x86
All
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: ppandit, Assigned: jband_mozilla)

References

Details

(Keywords: crash) 

Using a debug Windows NT build from 5/30

Not sure what is going on. I was loading and testing some webpages that contain 
mailnews API calls through XPConnect. I closed one of the browser windows that 
contained a test that was already done and passed - application crashed with the 
error:

Unhandled exception in XPC3250.DLL 0xC0000005 Access Violation

Code breaks at
if(mFinalizeListener)
    {
        if(mObj)
            mFinalizeListener->AboutToRelease(mObj);
        NS_RELEASE(mFinalizeListener);
    }
    NS_IF_RELEASE(mObj);        <=================
    NS_IF_RELEASE(mClass);
    NS_IF_RELEASE(mScope);
}

Here is the trace:
nsXPCWrappedNative::~nsXPCWrappedNative() line 390 + 24 bytes
nsXPCWrappedNative::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXPCWrappedNative::Release(nsXPCWrappedNative * const 0x08681df0) line 71 + 31 
bytes
nsXPCWrappedNative::JSObjectFinalized(JSContext * 0x085e0600, JSObject * 
0x06fced78) line 96
WrappedNative_Finalize(JSContext * 0x085e0600, JSObject * 0x06fced78) line 691
js_FinalizeObject(JSContext * 0x085e0600, JSObject * 0x06fced78) line 1489 + 114 
bytes
js_GC(JSContext * 0x085e0600) line 1035 + 11 bytes
js_ForceGC(JSContext * 0x085e0600) line 770 + 9 bytes
JS_GC(JSContext * 0x085e0600) line 1154 + 9 bytes
nsJSContext::GC(nsJSContext * const 0x085e1110) line 1067 + 13 bytes
GlobalWindowImpl::SetNewDocument(GlobalWindowImpl * const 0x085e1170, 
nsIDOMDocument * 0x00000000) line 280
DocumentViewerImpl::~DocumentViewerImpl() line 406
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x085e2f30) line 344 + 
154 bytes
nsCOMPtr<nsIContentViewer>::assign_assuming_AddRef(nsIContentViewer * 
0x00000000) line 449
nsCOMPtr<nsIContentViewer>::assign_with_AddRef(nsISupports * 0x00000000) line 
820
nsCOMPtr<nsIContentViewer>::operator=(nsIContentViewer * 0x00000000) line 559
nsDocShell::Destroy(nsDocShell * const 0x086004c4) line 1318
nsWebShell::Destroy(nsWebShell * const 0x086004c4) line 1585
nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame() line 448
nsHTMLFrameInnerFrame::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsFrame::Destroy(nsFrame * const 0x070325f4, nsIPresContext * 0x089bfa40) line 
425 + 34 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x089bfa40) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x07069960, nsIPresContext * 
0x089bfa40) line 98
nsFrameList::DestroyFrames(nsIPresContext * 0x089bfa40) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x07069654, nsIPresContext * 
0x089bfa40) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x07069654, nsIPresContext * 0x089bfa40) 
line 834 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x089bfa40) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x06f64ae4, nsIPresContext * 
0x089bfa40) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x06f64ae4, nsIPresContext * 0x089bfa40) 
line 834 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x089bfa40) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x06f64750, nsIPresContext * 
0x089bfa40) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x06f64750, nsIPresContext * 0x089bfa40) 
line 834 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x089bfa40) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x06f646c4, nsIPresContext * 
0x089bfa40) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x06f646c4, nsIPresContext * 0x089bfa40) 
line 834 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x089bfa40) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x05af97e8, nsIPresContext * 
0x089bfa40) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x05af97e8, nsIPresContext * 0x089bfa40) 
line 834 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x089bfa40) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x05af975c, nsIPresContext * 
0x089bfa40) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x05af975c, nsIPresContext * 0x089bfa40) 
line 834 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x089bfa40) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x05af9720, nsIPresContext * 
0x089bfa40) line 98
ViewportFrame::Destroy(ViewportFrame * const 0x05af9720, nsIPresContext * 
0x089bfa40) line 144
FrameManager::~FrameManager() line 355
FrameManager::`scalar deleting destructor'(unsigned int 1) + 15 bytes
FrameManager::Release(FrameManager * const 0x089bd1c0) line 340 + 157 bytes
PresShell::~PresShell() line 1046 + 36 bytes
PresShell::`scalar deleting destructor'() + 15 bytes
PresShell::Release(PresShell * const 0x089bda20) line 960 + 158 bytes
nsCOMPtr<nsIPresShell>::~nsCOMPtr<nsIPresShell>() line 467
DocumentViewerImpl::~DocumentViewerImpl() line 435 + 97 bytes
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x089acb10) line 344 + 
154 bytes
nsCOMPtr<nsIContentViewer>::assign_assuming_AddRef(nsIContentViewer * 
0x00000000) line 449
nsCOMPtr<nsIContentViewer>::assign_with_AddRef(nsISupports * 0x00000000) line 
820
nsCOMPtr<nsIContentViewer>::operator=(nsIContentViewer * 0x00000000) line 559
nsDocShell::Destroy(nsDocShell * const 0x087ef2b4) line 1318
nsWebShell::Destroy(nsWebShell * const 0x087ef2b4) line 1585
nsXULWindow::Destroy(nsXULWindow * const 0x087eaf04) line 424
nsWebShellWindow::Destroy(nsWebShellWindow * const 0x087eaf04) line 1736
nsWebShellWindow::Close(nsWebShellWindow * const 0x087eaf64) line 363
nsWebShellWindow::HandleEvent(nsGUIEvent * 0x0012f634) line 442
nsWindow::DispatchEvent(nsWindow * const 0x087ebe94, nsGUIEvent * 0x0012f634, 
nsEventStatus & nsEventStatus_eIgnore) line 560 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f634) line 581
nsWindow::DispatchStandardEvent(unsigned int 101) line 601 + 15 bytes
nsWindow::ProcessMessage(unsigned int 16, unsigned int 0, long 0, long * 
0x0012f954) line 2631
nsWindow::WindowProc(HWND__ * 0x03470376, unsigned int 16, unsigned int 0, long 
0) line 829 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
USER32! 77e718d2()
nsWindow::DefaultWindowProc(HWND__ * 0x03470376, unsigned int 274, unsigned int 
61536, long 5047315) line 856
USER32! 77e727fe()
USER32! 77e72889()
nsWindow::WindowProc(HWND__ * 0x03470376, unsigned int 274, unsigned int 61536, 
long 5047315) line 836 + 31 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
USER32! 77e718d2()
nsWindow::DefaultWindowProc(HWND__ * 0x03470376, unsigned int 161, unsigned int 
20, long 5047315) line 856
USER32! 77e727fe()
USER32! 77e72889()
nsWindow::WindowProc(HWND__ * 0x03470376, unsigned int 161, unsigned int 20, 
long 5047315) line 836 + 31 bytes
USER32! 77e71820()
NS_InitHTMLEmbedElementClass(nsIScriptContext *, void * *)
Severity: normal → major
Keywords: crash
*** Bug 41458 has been marked as a duplicate of this bug. ***
Testcase from bug 41458 (same stack trace, crashed 2 out of 4 times for me):

Open up two browser windows (A and B).  On one of them (B), open a search window
"find in this page").  Select winbow B, and close it.  Mozilla crashes
without any sort of warning messages.
Severity: major → critical
OS: Windows NT → All
The above testcase is a regression between 2000050208 and 2000050513.
cc alecf@netscape.com (see below).

The behaviour of the above testcase has changed:
2000060508 	crashes. (You seem to have to enter something into the
            	"Find in This Page" dialog before closing window B)
2000060808-M17 	doesn't crash any more. Window B closes, but its dialog
		"Find in This Page" stays open. However, you can exit cleanly.
2000060908-M17	shows the same behaviour, but additionally prints tons of 		
		messages: 
			Gdk-Message: Got event for unknown window: 0x4c0094a

I guess that the reason why it doesn't crash anymore is alecf's checkin to
nsGlobalWindow.cpp on 6/6 1:07, see bug 41608 "how to destroy named roots when
we have no context" or
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=alecf%25netscape.com&whotype=match&sortby=Date&hours=2&date=explicit&mindate=6%2F6+1%3A06&maxdate=6%2F6+1%3A09&cvsroot=%2Fcvsroot

Alec, can you confirm this? Then this bug probably could be marked fixed.

If so, we probably should file a new bug about the "Find in This Page" not being
closed together with its corresponding browser window (or find one that already
covers this).
yes, this should be fixed now.
The other problems you're seeing having nothing to do with this crash :)
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
I am not a seeing a crash anymore.

Marking as verified.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.