Closed Bug 413631 Opened 17 years ago Closed 17 years ago

Crash when walking through tree items in Xulrunner application

Categories

(Core :: XUL, defect, P2)

Product:
Core
Component:
XUL
Platform:
x86
All
Type:
defect

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: tommy2d, Unassigned)

References

Details

(Keywords: crash, regression)

Attachments

(1 file)

Testcase for this bug
9.63 KB, application/zip
Details
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11 We're developing a Xul application that loads lots of javascript from an external source. This javascript creates the layout elements and handles event handling with the remote server. With late b2 and b3 nightly's however, xulrunner crashes a lot when handling especially tree items. I managed to produce a stack trace for such a crash. Reproducible: Sometimes Actual Results: Crash. 038bed95() > xul.dll!nsGenericElement::QueryInterface(const nsID & aIID={...}, void * * aInstancePtr=0x0012a430) Line 3484 + 0x24 bytes C++ xul.dll!nsXULElement::QueryInterface(const nsID & aIID={...}, void * * aInstancePtr=0x0012a430) Line 385 + 0x11 bytes C++ xul.dll!nsQueryInterface::operator()(const nsID & aIID={...}, void * * answer=0x0012a430) Line 47 + 0x19 bytes C++ xul.dll!nsCOMPtr<nsIContent>::assign_from_qi(nsQueryInterface qi={...}, const nsID & aIID={...}) Line 1275 + 0xf bytes C++ xul.dll!nsCOMPtr<nsIContent>::nsCOMPtr<nsIContent>(nsQueryInterface qi={...}) Line 646 C++ xul.dll!nsXULDocument::AttributeChanged(nsIDocument * aDocument=0x035a9878, nsIContent * aElement=0x0486a490, int aNameSpaceID=0, nsIAtom * aAttribute=0x02a69374, int aModType=2, unsigned int aStateMask=0) Line 957 C++ xul.dll!nsNodeUtils::AttributeChanged(nsIContent * aContent=0x0486a490, int aNameSpaceID=0, nsIAtom * aAttribute=0x02a69374, int aModType=2, unsigned int aStateMask=0) Line 109 + 0xf2 bytes C++ xul.dll!nsGenericElement::SetAttrAndNotify(int aNamespaceID=0, nsIAtom * aName=0x02a69374, nsIAtom * aPrefix=0x00000000, const nsAString_internal & aOldValue={...}, nsAttrValue & aParsedValue={...}, int aModification=0, int aFireMutation=0, int aNotify=1) Line 3710 + 0x1d bytes C++ xul.dll!nsGenericElement::SetAttr(int aNamespaceID=0, nsIAtom * aName=0x02a69374, nsIAtom * aPrefix=0x00000000, const nsAString_internal & aValue={...}, int aNotify=1) Line 3641 + 0x34 bytes C++ xul.dll!nsGenericElement::SetAttr(int aNameSpaceID=0, nsIAtom * aName=0x02a69374, const nsAString_internal & aValue={...}, int aNotify=1) Line 397 C++ xul.dll!nsGenericElement::SetAttribute(const nsAString_internal & aName={...}, const nsAString_internal & aValue={...}) Line 1533 + 0x19 bytes C++ xul.dll!nsXULElement::SetAttribute(const nsAString_internal & name={...}, const nsAString_internal & value={...}) Line 612 + 0x14 bytes C++ xul.dll!NS_InvokeByIndex_P(nsISupports * that=0x0000001e, unsigned int methodIndex=2, unsigned int paramCount=1223788, nsXPTCVariant * params=0x0012ad30) Line 102 C++ xul.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=30) Line 2342 + 0x1d bytes C++ xul.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=CALL_METHOD) Line 2342 + 0x1d bytes C++ xul.dll!XPC_WN_CallMethod(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, unsigned int argc=2, long * argv=0x04a929e4, long * vp=0x0012af3c) Line 1480 + 0xe bytes C++ js3250.dll!js_Invoke(JSContext * cx=0x0369e510, unsigned int argc=2, long * vp=0x04a929dc, unsigned int flags=0) Line 1023 + 0x20 bytes C js3250.dll!js_Interpret(JSContext * cx=0x0369e510, unsigned char * pc=0x0386d31f, long * result=0x0012b600) Line 3863 + 0x16 bytes C js3250.dll!js_Invoke(JSContext * cx=0x0369e510, unsigned int argc=1, long * vp=0x04a929b0, unsigned int flags=2) Line 1040 + 0x13 bytes C js3250.dll!js_InternalInvoke(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, long fval=81605824, unsigned int flags=0, unsigned int argc=1, long * argv=0x0012bbf4, long * rval=0x0012bbf4) Line 1096 + 0x18 bytes C js3250.dll!js_InternalGetOrSet(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, long id=67779716, long fval=81605824, JSAccessMode mode=JSACC_WRITE, unsigned int argc=1, long * argv=0x0012bbf4, long * rval=0x0012bbf4) Line 1159 + 0x1f bytes C js3250.dll!js_SetProperty(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, long id=67779716, long * vp=0x0012bbf4) Line 3751 + 0x32 bytes C js3250.dll!js_Interpret(JSContext * cx=0x0369e510, unsigned char * pc=0x0387014f, long * result=0x0012bd14) Line 3591 + 0x147 bytes C js3250.dll!js_Invoke(JSContext * cx=0x0369e510, unsigned int argc=1, long * vp=0x04a92980, unsigned int flags=2) Line 1040 + 0x13 bytes C js3250.dll!js_InternalInvoke(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, long fval=81605760, unsigned int flags=0, unsigned int argc=1, long * argv=0x0012c308, long * rval=0x0012c308) Line 1096 + 0x18 bytes C js3250.dll!js_InternalGetOrSet(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, long id=67779764, long fval=81605760, JSAccessMode mode=JSACC_WRITE, unsigned int argc=1, long * argv=0x0012c308, long * rval=0x0012c308) Line 1159 + 0x1f bytes C js3250.dll!js_SetProperty(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, long id=67779764, long * vp=0x0012c308) Line 3751 + 0x32 bytes C js3250.dll!js_Interpret(JSContext * cx=0x0369e510, unsigned char * pc=0x038669d4, long * result=0x0012c428) Line 3591 + 0x147 bytes C js3250.dll!js_Invoke(JSContext * cx=0x0369e510, unsigned int argc=0, long * vp=0x04a928c0, unsigned int flags=2) Line 1040 + 0x13 bytes C js3250.dll!js_InternalInvoke(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, long fval=104606240, unsigned int flags=0, unsigned int argc=0, long * argv=0x00000000, long * rval=0x0012c4d4) Line 1096 + 0x18 bytes C js3250.dll!JS_CallFunctionValue(JSContext * cx=0x0369e510, JSObject * obj=0x065d1320, long fval=104606240, unsigned int argc=0, long * argv=0x00000000, long * rval=0x0012c4d4) Line 4927 + 0x1f bytes C xul.dll!nsXBLProtoImplAnonymousMethod::Execute(nsIContent * aBoundElement=0x0486a490) Line 351 + 0x1a bytes C++ xul.dll!nsXBLPrototypeBinding::BindingAttached(nsIContent * aBoundElement=0x0486a490) Line 501 + 0x12 bytes C++ xul.dll!nsXBLBinding::ExecuteAttachedHandler() Line 957 C++ xul.dll!nsBindingManager::ProcessAttachedQueue(unsigned int aSkipSize=0) Line 1000 C++ xul.dll!nsBindingManager::EndOutermostUpdate() Line 1515 C++ xul.dll!nsDocument::EndUpdate(unsigned int aUpdateType=1) Line 2711 C++ xul.dll!mozAutoDocUpdate::~mozAutoDocUpdate() Line 1038 C++ xul.dll!nsGenericElement::doInsertChildAt(nsIContent * aKid=0x054a45f0, unsigned int aIndex=0, int aNotify=1, nsIContent * aParent=0x03986788, nsIDocument * aDocument=0x035a9878, nsAttrAndChildArray & aChildArray={...}) Line 2715 + 0x12 bytes C++ xul.dll!nsGenericElement::InsertChildAt(nsIContent * aKid=0x054a45f0, unsigned int aIndex=0, int aNotify=1) Line 2634 + 0x25 bytes C++ xul.dll!nsXULElement::InsertChildAt(nsIContent * aKid=0x054a45f0, unsigned int aIndex=0, int aNotify=1) Line 1676 C++ xul.dll!nsGenericElement::doReplaceOrInsertBefore(int aReplace=0, nsIDOMNode * aNewChild=0x054a4610, nsIDOMNode * aRefChild=0x00000000, nsIContent * aParent=0x03986788, nsIDocument * aDocument=0x035a9878, nsIDOMNode * * aReturn=0x0012c9f4) Line 3341 + 0x1c bytes C++ xul.dll!nsGenericElement::InsertBefore(nsIDOMNode * aNewChild=0x054a4610, nsIDOMNode * aRefChild=0x00000000, nsIDOMNode * * aReturn=0x0012c9f4) Line 2927 + 0x20 bytes C++ xul.dll!nsXULElement::InsertBefore(nsIDOMNode * newChild=0x054a4610, nsIDOMNode * refChild=0x00000000, nsIDOMNode * * _retval=0x0012c9f4) Line 609 + 0x18 bytes C++ xul.dll!nsGenericElement::AppendChild(nsIDOMNode * aNewChild=0x054a4610, nsIDOMNode * * aReturn=0x0012c9f4) Line 509 C++ xul.dll!nsXULElement::AppendChild(nsIDOMNode * newChild=0x054a4610, nsIDOMNode * * _retval=0x0012c9f4) Line 609 + 0x14 bytes C++ xul.dll!NS_InvokeByIndex_P(nsISupports * that=0x00000012, unsigned int methodIndex=2, unsigned int paramCount=1231332, nsXPTCVariant * params=0x1021bb21) Line 102 C++ xul.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=18) Line 2342 + 0x1d bytes C++ xul.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=CALL_METHOD) Line 2342 + 0x1d bytes C++ xul.dll!XPC_WN_CallMethod(JSContext * cx=0x0369e510, JSObject * obj=0x04d315e0, unsigned int argc=1, long * argv=0x04a928b4, long * vp=0x0012ccb4) Line 1480 + 0xe bytes C++ js3250.dll!js_Invoke(JSContext * cx=0x0369e510, unsigned int argc=1, long * vp=0x04a928ac, unsigned int flags=0) Line 1023 + 0x20 bytes C js3250.dll!js_Interpret(JSContext * cx=0x0369e510, unsigned char * pc=0x039328da, long * result=0x0012d378) Line 3863 + 0x16 bytes C js3250.dll!js_Invoke(JSContext * cx=0x0369e510, unsigned int argc=1, long * vp=0x04a91f88, unsigned int flags=2) Line 1040 + 0x13 bytes C xul.dll!nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS * wrapper=0x04501478, unsigned short methodIndex=3, const XPTMethodDescriptor * info=0x033711a0, nsXPTCMiniVariant * nativeParams=0x0012d698) Line 1443 + 0x1b bytes C++ xul.dll!nsXPCWrappedJS::CallMethod(unsigned short methodIndex=3, const XPTMethodDescriptor * info=0x033711a0, nsXPTCMiniVariant * params=0x0012d698) Line 568 C++ xul.dll!PrepareAndDispatch(nsXPTCStubBase * self=0x045014f0, unsigned int methodIndex=3, unsigned int * args=0x0012d758, unsigned int * stackBytesToPop=0x0012d748) Line 114 + 0x21 bytes C++ xul.dll!SharedStub() Line 142 C++ xul.dll!nsEventListenerManager::HandleEventSubType(nsListenerStruct * aListenerStruct=0x045014f0, nsIDOMEventListener * aListener=0x046d97d0, nsIDOMEvent * aDOMEvent=0x04524300, nsISupports * aCurrentTarget=0x003610a0, unsigned int aPhaseFlags=15) Line 1081 + 0x12 bytes C++ xul.dll!nsEventListenerManager::HandleEventSubType(nsListenerStruct * aListenerStruct=0x04524378, nsIDOMEventListener * aListener=0x045014f0, nsIDOMEvent * aDOMEvent=0x046d97d0, nsISupports * aCurrentTarget=0x046636b8, unsigned int aPhaseFlags=6) Line 1081 + 0x12 bytes C++ xul.dll!nsEventListenerManager::HandleEvent(nsPresContext * aPresContext=0x02b080f8, nsEvent * aEvent=0x0012da14, nsIDOMEvent * * aDOMEvent=0x0012d968, nsISupports * aCurrentTarget=0x046636b8, unsigned int aFlags=6, nsEventStatus * aEventStatus=0x0012d96c) Line 1189 C++ xul.dll!nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor & aVisitor={...}, unsigned int aFlags=6) Line 207 C++ xul.dll!nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor & aVisitor={...}, unsigned int aFlags=6, nsDispatchingCallback * aCallback=0x00000000) Line 266 C++ xul.dll!nsEventDispatcher::Dispatch(nsISupports * aTarget=0x046636b8, nsPresContext * aPresContext=0x02b080f8, nsEvent * aEvent=0x0012da14, nsIDOMEvent * aDOMEvent=0x00000000, nsEventStatus * aEventStatus=0x0012da10, nsDispatchingCallback * aCallback=0x00000000) Line 479 + 0x12 bytes C++ xul.dll!nsTreeSelection::FireOnSelectHandler() Line 839 + 0x23 bytes C++ xul.dll!nsTreeSelection::Select(int aIndex=4) Line 390 C++ xul.dll!NS_InvokeByIndex_P(nsISupports * that=0x00000008, unsigned int methodIndex=1, unsigned int paramCount=1236008, nsXPTCVariant * params=0x0012dcec) Line 102 C++ xul.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=8) Line 2342 + 0x1d bytes C++ xul.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=CALL_METHOD) Line 2342 + 0x1d bytes C++ xul.dll!XPC_WN_CallMethod(JSContext * cx=0x0369e510, JSObject * obj=0x039a3d60, unsigned int argc=1, long * argv=0x04a91f6c, long * vp=0x0012def8) Line 1480 + 0xe bytes C++ js3250.dll!js_Invoke(JSContext * cx=0x0369e510, unsigned int argc=1, long * vp=0x04a91f64, unsigned int flags=0) Line 1023 + 0x20 bytes C js3250.dll!js_Interpret(JSContext * cx=0x0369e510, unsigned char * pc=0x038a78df, long * result=0x0012e5bc) Line 3863 + 0x16 bytes C js3250.dll!js_Invoke(JSContext * cx=0x0369e510, unsigned int argc=1, long * vp=0x04a91f24, unsigned int flags=2) Line 1040 + 0x13 bytes C js3250.dll!js_InternalInvoke(JSContext * cx=0x0369e510, JSObject * obj=0x04cf21e0, long fval=84810272, unsigned int flags=0, unsigned int argc=1, long * argv=0x04a91f20, long * rval=0x0012e6d4) Line 1096 + 0x18 bytes C js3250.dll!JS_CallFunctionValue(JSContext * cx=0x0369e510, JSObject * obj=0x04cf21e0, long fval=84810272, unsigned int argc=1, long * argv=0x04a91f20, long * rval=0x0012e6d4) Line 4927 + 0x1f bytes C xul.dll!nsJSContext::CallEventHandler(nsISupports * aTarget=0x04663b28, void * aScope=0x039a0040, void * aHandler=0x050e1a20, nsIArray * aargv=0x05744d70, nsIVariant * * arv=0x0012e8a0) Line 1963 + 0x24 bytes C++ xul.dll!nsJSEventListener::HandleEvent(nsIDOMEvent * aEvent=0x049c4398) Line 235 + 0x67 bytes C++ xul.dll!nsXBLPrototypeHandler::ExecuteHandler(nsPIDOMEventTarget * aTarget=0x04663b28, nsIDOMEvent * aEvent=0x049c4398) Line 368 C++ xul.dll!nsXBLEventHandler::HandleEvent(nsIDOMEvent * aEvent=0x049c4398) Line 88 C++ xul.dll!nsEventListenerManager::HandleEventSubType(nsListenerStruct * aListenerStruct=0x048a8690, nsIDOMEventListener * aListener=0x048a7ef8, nsIDOMEvent * aDOMEvent=0x049c4398, nsISupports * aCurrentTarget=0x04663b28, unsigned int aPhaseFlags=6) Line 1081 + 0x12 bytes C++ xul.dll!nsEventListenerManager::HandleEvent(nsPresContext * aPresContext=0x02b080f8, nsEvent * aEvent=0x0012f204, nsIDOMEvent * * aDOMEvent=0x0012edc8, nsISupports * aCurrentTarget=0x04663b28, unsigned int aFlags=6, nsEventStatus * aEventStatus=0x0012edcc) Line 1189 C++ xul.dll!nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor & aVisitor={...}, unsigned int aFlags=6) Line 207 C++ xul.dll!nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor & aVisitor={...}, unsigned int aFlags=6, nsDispatchingCallback * aCallback=0x0012ee7c) Line 266 C++ xul.dll!nsEventDispatcher::Dispatch(nsISupports * aTarget=0x04663b28, nsPresContext * aPresContext=0x02b080f8, nsEvent * aEvent=0x0012f204, nsIDOMEvent * aDOMEvent=0x00000000, nsEventStatus * aEventStatus=0x0012efa8, nsDispatchingCallback * aCallback=0x0012ee7c) Line 479 + 0x12 bytes C++ xul.dll!PresShell::HandleEventInternal(nsEvent * aEvent=0x0012f204, nsIView * aView=0x02b13d00, nsEventStatus * aStatus=0x0012efa8) Line 5822 + 0x29 bytes C++ xul.dll!PresShell::HandlePositionedEvent(nsIView * aView=0x02b13d00, nsIFrame * aTargetFrame=0x047f5628, nsGUIEvent * aEvent=0x0012f204, nsEventStatus * aEventStatus=0x0012efa8) Line 5710 + 0x14 bytes C++ xul.dll!PresShell::HandleEvent(nsIView * aView=0x02b13d00, nsGUIEvent * aEvent=0x0012f204, nsEventStatus * aEventStatus=0x0012efa8) Line 5553 + 0x1e bytes C++ xul.dll!nsViewManager::HandleEvent(nsView * aView=0x02b13d00, nsPoint aPoint={...}, nsGUIEvent * aEvent=0x0012f204, int aCaptured=0) Line 1298 C++ xul.dll!nsViewManager::DispatchEvent(nsGUIEvent * aEvent=0x0012f204, nsEventStatus * aStatus=0x0012f0e8) Line 1251 + 0x22 bytes C++ xul.dll!HandleEvent(nsGUIEvent * aEvent=0x0012f204) Line 171 C++ xul.dll!nsWindow::DispatchEvent(nsGUIEvent * event=0x0012f204, nsEventStatus & aStatus=nsEventStatus_eIgnore) Line 1054 + 0xc bytes C++ xul.dll!nsWindow::DispatchWindowEvent(nsGUIEvent * event=0x0012f204) Line 1075 C++ xul.dll!nsWindow::DispatchMouseEvent(unsigned int aEventType=302, unsigned int wParam=1, long lParam=5243049, int aIsContextMenuKey=0, short aButton=0) Line 5969 + 0x1a bytes C++ xul.dll!ChildWindow::DispatchMouseEvent(unsigned int aEventType=302, unsigned int wParam=1, long lParam=5243049, int aIsContextMenuKey=0, short aButton=0) Line 6151 C++ xul.dll!nsWindow::ProcessMessage(unsigned int msg=513, unsigned int wParam=1, long lParam=5243049, long * aRetValue=0x0012f6bc) Line 4423 + 0x24 bytes C++ xul.dll!nsWindow::WindowProc(HWND__ * hWnd=0x000804fc, unsigned int msg=513, unsigned int wParam=1, long lParam=5243049) Line 1271 + 0x1d bytes C++ user32.dll!7e398734() [Frames below may be incorrect and/or missing, no symbols loaded for user32.dll] user32.dll!7e398816() user32.dll!7e3989cd() user32.dll!7e399402() user32.dll!7e398a10() xul.dll!nsAppShell::ProcessNextNativeEvent(int mayWait=1) Line 149 C++ xul.dll!nsBaseAppShell::DoProcessNextNativeEvent(int mayWait=1) Line 137 + 0x11 bytes C++ xul.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr=0x0239f690, int mayWait=1, unsigned int recursionDepth=0) Line 247 + 0xf bytes C++ xul.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f8b4) Line 500 C++ xul.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x0239f690, int mayWait=1) Line 227 + 0x16 bytes C++ xul.dll!nsBaseAppShell::Run() Line 154 + 0xb bytes C++ xul.dll!nsAppStartup::Run() Line 181 + 0x1c bytes C++ xul.dll!XRE_main(int argc=1, char * * argv=0x0239b8fc, const nsXREAppData * aAppData=0x0239e410) Line 3172 + 0x25 bytes C++ xulrunner.exe!main(int argc=1, char * * argv=0x0239b8fc) Line 446 + 0x17 bytes C++ xulrunner.exe!__tmainCRTStartup() Line 597 + 0x19 bytes C xulrunner.exe!mainCRTStartup() Line 414 C kernel32.dll!7c816fd7() xul.dll!nsCOMPtr<nsIEditorDocShell>::operator->() Line 870 C++ xul.dll!CanTrustView(nsISupports * aValue=0x8bfc4d89) Line 188 + 0x8 bytes C++ 51ec8b55()
I'm sorry to spam my own bug post but we discovered that the actual crashing (which became really annoying in the b2 & b3 nightly builds) was caused by the RemoveChild javascript function. I'm not sure if I have to make a new bug report now. A test case should be underway but it's hard to simulate our specific working environment. All I know now is that it seems to happen most often with complex DOM-tree constructions. Replacing all removeChild() calls with a function that hides them keeps our application from crashing but causes a major increase of memory usage (duh).
Severity: normal → critical
Component: General → XBL
Product: Firefox → Core
QA Contact: general → xbl
Here's a summary, Death first xul.dll!nsXULDocument::AttributeChanged xul.dll!nsXULElement::SetAttribute XBL-JS xul.dll!nsXBLBinding::ExecuteAttachedHandler xul.dll!nsXULElement::AppendChild your-chrome/component-JS xul.dll!nsEventListenerManager::HandleEvent xul.dll!nsTreeSelection::FireOnSelectHandler xul.dll!nsTreeSelection::Select(int aIndex=4) Line 390 C++ XBL-JS xul.dll!nsXBLEventHandler::HandleEvent xul.dll!PresShell::HandleEvent OSEventHandling Hrm, that's interesting. there's no sign of a removeChild in the call stack. It probably basically means the object's refcount went to 0 but xbl still knew about it :). Don't suppose you'd be willing to make it crash in 1.9? :)
Keywords: crash
Version: unspecified → 1.8 Branch
Need some way to reproduce to do something here...
Keywords: qawanted
OS: Windows XP → All
Version: 1.8 Branch → Trunk
I changed the version to thrunk since that's what we use. I can also say we tested all day with a version that hides elements instead of removing them and we didn't experience a single crash of the runtime so it most certainly had something to do with RemoveChild(). Also, we're working on a testcase but since it's a relatively complex project it's hard to produce something thats not bloated and crashes as often as our project does... So far we can get it to crash sometimes with this error, but just after having added/deleted hundreds of nodes. In our project this happens far easier. Maybe it has something to do with the complexity of the DOM tree in our project compared to the flat layout of a dialog filled will lots of textboxes:-). I will check this tomorrow when I reach the office.
Also, replacing instead of removing child items results in the same crash. The same goes for cleaning up unused nodes in a garbage collecter manner using a timer.
Tom, if you have a non-minimal testcase that you can make public, go ahead and attach it to the bug. It's not as good as a minimal testcase, but better than nothing!
Attached file Testcase for this bug —
This is the first testcase for this bug. It doesn't seem to crash as often as our full application does but it essentially works in the same manner. You don't need to interact with the testcase. Just wait 30 seconds or so.
Depends on: 414871
Depends on: 414875
Well, I can reproduce the crash... it also trashes the stack in the process, so I can't get much useful out of it. :( The stack in comment 0 implicates broadcast listeners. Not likely to be an XBL issue per se. Requesting blocking, due to the stack-smashing (well, that and the fact that we're making virtual function calls on dead objects).
Status: UNCONFIRMED → NEW
Component: XBL → XP Toolkit/Widgets: XUL
Ever confirmed: true
Flags: blocking1.9?
QA Contact: xbl → xptoolkit.xul
The stack looks similar to Bug 395671
OK, so according to my debugging, when this problem occurs a deleted element is observing the value attribute of another element. The only element that's actually setting a value observer is the menulist, which means this is a regression from bug 395496. Note that to trigger this bug you have to remove the menulist from the document in such a way that its destructor doesn't fire, but keep a reference to its selectedItem so that you can change its value later.
Actually you don't of course need a reference to the selectedItem - just keep creating elements and setting attributes on them and hope one of them is created at the same memory address as the selectedItem.
Blocks: 395496
Keywords: qawanted
Depends on: 395671
Keywords: regression
Note: I wasn't using a build with the fix for bug 414747 which should fix this.
Depends on: 414747
Flags: blocking1.9? → blocking1.9+
Priority: -- → P3
Should block since it's hitting a real application. But is it fixed now?
Flags: blocking1.9+
Priority: P3 → P2
Flags: tracking1.9+
I tried loading the testcase in a browser window, and it ran fine for 5 minutes and fine under valgrind for 10 minutes. I didn't look to see if the warnings about reentering frame construction were anything other than the usual ones, though.
It also doesn't crash for me: * with attachment 301391 [details] [diff] [review] from bug 414747 locally reverted * with that *and* running the testcase with -chrome
so could someone confirm it is 100% xulrunner only then? I will test our entire app on ff3(nightly) within a few hours to see if it crashes or not.
Yeah, sorry to post so late. The bug seems to be gone as of the b4 builds. It's extreme stable and way faster than earlier builds.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
What I also meant to say: the bug is not only fixed in FF, it is also fixed in Xulrunner.
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: