414730 - Testcase from bug 336739 is crashing [@ nsDOMUIEvent::GetScreenPoint] again

Status: RESOLVED WORKSFORME

(Core :: XUL, defect, P4)

Description

[Martijn Wargers (dead)]

Attachment: backtraces from assertion and the crash

See the url, which crashes current trunk build again after 1 second

I see 2 of these assertions prior to the crash:
###!!! ASSERTION: Null pres shell: 'mShell', file c:\mozilla-build\mozilla\layou
t\base\nsPresContext.h, line 177

The crash itself seems to have this backtrace:
>	gklayout.dll!nsDOMUIEvent::GetScreenPoint()  Line 139 + 0x1d bytes	C++
 	gklayout.dll!nsDOMUIEvent::DuplicatePrivateData()  Line 421	C++
 	gklayout.dll!nsEventDispatcher::Dispatch(nsISupports * aTarget=0x05fa8a78, nsPresContext * aPresContext=0x062fb8d8, nsEvent * aEvent=0x0012e888, nsIDOMEvent * aDOMEvent=0x00000000, nsEventStatus * aEventStatus=0x0012e884, nsDispatchingCallback * aCallback=0x00000000)  Line 504	C++
 	gklayout.dll!nsXULPopupManager::FirePopupShowingEvent(nsIContent * aPopup=0x05fa8a78, nsIContent * aMenu=0x00000000, nsPresContext * aPresContext=0x062fb8d8, nsPopupType aPopupType=ePopupTypeMenu, int aIsContextMenu=0, int aSelectFirstItem=0)  Line 902 + 0x19 bytes	C++
 	gklayout.dll!nsXULPopupManager::ShowPopupWithAnchorAlign(nsIContent * aPopup=0x05fa8a78, nsIContent * aAnchorContent=0x00000000, nsAString_internal & aAnchor={...}, nsAString_internal & aAlign={...}, int aXPos=0, int aYPos=0, int aIsContextMenu=0)  Line 455	C++
 	gklayout.dll!nsPopupBoxObject::ShowPopup(nsIDOMElement * aAnchorElement=0x00000000, nsIDOMElement * aPopupElement=0x05fa8a98, int aXPos=0, int aYPos=0, const unsigned short * aPopupType=0x00000000, const unsigned short * aAnchorAlignment=0x00000000, const unsigned short * aPopupAlignment=0x00000000)  Line 117	C++
 	xpcom_core.dll!NS_InvokeByIndex_P(nsISupports * that=0x00000001, unsigned int methodIndex=1239896, unsigned int paramCount=54776888, nsXPTCVariant * params=0x05f5e068)  Line 102	C++
 	js3250.dll!JS_SuspendRequest(JSContext * cx=0x04c4586c)  Line 966 + 0x9 bytes	C
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2346 + 0x21 bytes	C++
 	xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x05f5e068, JSObject * obj=0x06d70940, unsigned int argc=7, long * argv=0x05fd510c, long * vp=0x0012efac)  Line 1472 + 0xe bytes	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x05f5e068, unsigned int argc=7, long * vp=0x05fd5104, unsigned int flags=0)  Line 1020 + 0x20 bytes	C
 	js3250.dll!js_Interpret(JSContext * cx=0x05f5e068, unsigned char * pc=0x04b14136, long * result=0x0012f624)  Line 3849 + 0x16 bytes	C
 	js3250.dll!js_Invoke(JSContext * cx=0x05f5e068, unsigned int argc=1, long * vp=0x05fd5030, unsigned int flags=2)  Line 1037 + 0x13 bytes	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x05f5e068, JSObject * obj=0x06d732a0, long fval=114769472, unsigned int flags=0, unsigned int argc=1, long * argv=0x05f72f98, long * rval=0x0012f73c)  Line 1093 + 0x18 bytes	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x05f5e068, JSObject * obj=0x06d732a0, long fval=114769472, unsigned int argc=1, long * argv=0x05f72f98, long * rval=0x0012f73c)  Line 4939 + 0x1f bytes	C
 	gklayout.dll!nsJSContext::CallEventHandler(nsISupports * aTarget=0x05ffb060, void * aScope=0x06d732a0, void * aHandler=0x06d73e40, nsIArray * aargv=0x05fa88dc, nsIVariant * * arv=0x0012f7f4)  Line 1942 + 0x24 bytes	C++
 	gklayout.dll!nsGlobalWindow::RunTimeout(nsTimeout * aTimeout=0x05fa8920)  Line 7425 + 0xab bytes	C++
 	gklayout.dll!nsGlobalWindow::TimerCallback(nsITimer * aTimer=0x05fa8990, void * aClosure=0x05fa8920)  Line 7759	C++
 	xpcom_core.dll!nsTimerImpl::Fire()  Line 400 + 0xe bytes	C++
 	xpcom_core.dll!nsTimerEvent::Run()  Line 490	C++
etc...

I can look for a regression range if needed.

Mozilla crash reports (not up yet):
http://crash-stats.mozilla.com/report/index/57978285-ced5-11dc-9ae8-001a4bd43e5c
http://crash-stats.mozilla.com/report/index/e5a6c7e6-ced6-11dc-ac9e-001a4bd43ed6

Comment 1

[Martijn Wargers (dead)]

From http://crash-stats.mozilla.com/report/index/57978285-ced5-11dc-9ae8-001a4bd43e5c I get:
0  	KiFastSystemCallRet  	
1 	NtWaitForSingleObject 	
2 	WaitForSingleObjectEx 	
3 	WaitForSingleObject 	
4 	google_breakpad::ExceptionHandler::WriteMinidumpOnHandlerThread(_EXCEPTION_POINTERS*, MDRawAssertionInfo*) 	mozilla/toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:409
5 	google_breakpad::ExceptionHandler::HandlePureVirtualCall() 	mozilla/toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:378
6 	msvcr80.dll@0x3a7be 	
7 	nsDOMUIEvent::DuplicatePrivateData() 	mozilla/content/events/src/nsDOMUIEvent.cpp:420
8 	nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) 	mozilla/content/events/src/nsEventDispatcher.cpp:502
9 	nsXULPopupManager::FirePopupShowingEvent(nsIContent*, nsIContent*, nsPresContext*, nsPopupType, int, int) 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:902
10 	nsXULPopupManager::ShowPopupWithAnchorAlign(nsIContent*, nsIContent*, nsAString_internal&, nsAString_internal&, int, int, int) 	mozilla/layout/xul/base/src/nsXULPopupManager.cpp:454
11 	nsPopupBoxObject::ShowPopup(nsIDOMElement*, nsIDOMElement*, int, int, unsigned short const*, unsigned short const*, unsigned short const*) 	mozilla/layout/xul/base/src/nsPopupBoxObject.cpp:116
12 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
13 	PR_Unlock 	mozilla/nsprpub/pr/src/threads/combined/prulock.c:355
14 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2346

The other one doesn't give anything.
It seems like an infinite recursion crash.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Doesn't crash on linux.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: guess fix

Martijn, could you test the patch?

Comment 4

[Martijn Wargers (dead)]

(In reply to comment #3)
> Martijn, could you test the patch?

I tested the patch, unfortunately, it doesn't seem to fix the crash.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Any chance that someone who can reproduce this could debug this a bit.

Comment 6

[Kadir Topal [:atopal]]

This crashed on me until a few weeks ago, not so with the new nightlies. Now I have to look out for another crasher bug to see the crash reporter ;) I guess this is WFM.