41610 - mozilla crashed while browsing

Status: VERIFIED WORKSFORME

(Core :: Networking, defect, P3)

Description

[Raghu Sakleshpur]

I'm using the latest mozilla M16 build on solaris intel platform.

The debug message on the terminal window was:

###!!! ASSERTION: Foreground URLs are active.: 'mForegroundCount == 0', file
nsLoadGroup.cpp, line 239
###!!! Break: at file nsLoadGroup.cpp, line 239
Block(td)(0)@8baa560: WARNING: max-element-size:2370,240 desired:9615,210
maxSize:9615,1073741824
->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Write Clipboard to memory
Document: Done (4.307 secs)
->>>>>>>>>>>>>> Write Clipboard to memory
Entry at index 0 is www.sun.com
Entry at index 1 is www.mynetscape.com
Entry at index 2 is file:/home/raghu
Entry at index 3 is file:/home/raghu/.Bugtraqrc
Entry at index 4 is mynetscape.com
Entry at index 5 is bedfordfalls
->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Write Clipboard to memory
Assertion failure: root_points_to_gcArenaPool, at jsgc.c:745
Abort - core dumped

The stack trace from core is:

(gdb) where
#0  0xdf2c719d in __sigprocmask () from /lib/libthread.so.1
#1  0xdf2be561 in _resetsig () from /lib/libthread.so.1
#2  0xdf2bdede in _sigon () from /lib/libthread.so.1
#3  0xdf2bc0a4 in _lmutex_unlock () from /lib/libthread.so.1
#4  0xdf2c038b in _thrp_kill () from /lib/libthread.so.1
#5  0xdf2c02a4 in thr_kill () from /lib/libthread.so.1
#6  0xdf318f53 in raise () from /lib/libc.so.1
#7  0xdf309300 in abort () from /lib/libc.so.1
#8  0xdf9607a3 in JS_Assert () at jsutil.c:174
#9  0xdf92f045 in gc_root_marker (he=0x89e0120, i=115, arg=0x80db408) at
jsgc.c:745
#10 0xdf930285 in JS_HashTableEnumerateEntries (ht=0x80b0050, f=0xdf92ef90
<gc_root_marker>, 
    arg=0x80db408) at jshash.c:364
#11 0xdf92f3e1 in js_GC (cx=0x8cd04d8) at jsgc.c:912
#12 0xdf92f0d7 in js_ForceGC (cx=0x8cd04d8) at jsgc.c:770
#13 0xdf913334 in JS_GC (cx=0x8cd04d8) at jsapi.c:1152
#14 0xdf4dc517 in nsJSContext::GC (this=0x8cd04a0) at nsJSEnvironment.cpp:1067
#15 0xdf4eaef5 in GlobalWindowImpl::SetNewDocument (this=<incomplete type>,
aDocument=0x0)
    at nsGlobalWindow.cpp:279
#16 0xdd3182e7 in DocumentViewerImpl::~DocumentViewerImpl (this=0x95c23d0,
__in_chrg=3)
    at nsDocumentViewer.cpp:403
#17 0xdd317eef in DocumentViewerImpl::Release (this=0x95c23d0) at
nsDocumentViewer.cpp:344
#18 0xdf872ed8 in nsCOMPtr<nsIContentViewer>::assign_assuming_AddRef
(this=0x8e2f928, newPtr=0x0)
    at ../../dist/include/nsCOMPtr.h:448
#19 0xdf872f31 in nsCOMPtr<nsIContentViewer>::assign_with_AddRef
(this=0x8e2f928, rawPtr=0x0)
    at ../../dist/include/nsCOMPtr.h:819
#20 0xdf874e3d in nsCOMPtr<nsIContentViewer>::operator= (this=0x8e2f928,
rhs=0x0)
    at ../../dist/include/nsCOMPtr.h:558
#21 0xdf800b78 in nsDocShell::SetupNewViewer (this=0x8e2f8a0,
aNewViewer=0x8b49380)
    at nsDocShell.cpp:2296
#22 0xdf861784 in nsWebShell::SetupNewViewer (this=0x8e2f8a0, aViewer=0x8b49380)
    at nsWebShell.cpp:559
---Type <return> to continue, or q <return> to quit--- 
#23 0xdf7ff979 in nsDocShell::CreateContentViewer (this=0x8e2f8a0, 
    aContentType=0x8046e70 "text/html", aOpenedChannel=0x8baaaf8, 
    aContentHandler=<incomplete type>) at nsDocShell.cpp:2188
#24 0xdf809bc6 in nsDSURIContentListener::DoContent (this=0x8aab418, 
    aContentType=0x8046e70 "text/html", aCommand=0, aWindowTarget=0xdfb2f4c4 "", 
    aOpenedChannel=0x8baaaf8, aContentHandler=0x8046eb0,
aAbortProcess=0x8046eb4)
    at nsDSURIContentListener.cpp:100
#25 0xddd0254c in nsDocumentOpenInfo::DispatchContent (this=0x8df8e20,
aChannel=0x8baaaf8, 
    aCtxt=0x0) at nsURILoader.cpp:326
#26 0xddd01be4 in nsDocumentOpenInfo::OnStartRequest (this=0x8df8e20,
aChannel=0x8baaaf8, 
    aCtxt=0x0) at nsURILoader.cpp:175
#27 0xdde9d5f0 in nsHTTPFinalListener::OnStartRequest (this=0x8e4d048,
aChannel=0x8baaaf8, 
    aContext=0x0) at nsHTTPResponseListener.cpp:1145
#28 0xdde6aad9 in InterceptStreamListener::OnStartRequest (this=0x965c098,
channel=0x8baaaf8, 
    ctxt=0x0) at nsCachedNetData.cpp:1139
#29 0xdde9d069 in nsHTTPServerListener::FinishedResponseHeaders (this=0x830bb28)
    at nsHTTPResponseListener.cpp:1071
#30 0xdde9acd8 in nsHTTPServerListener::OnDataAvailable (this=0x830bb28,
channel=0x8eecf9c, 
    context=0x8baaaf8, i_pStream=0x9682814, i_SourceOffset=0, i_Length=0)
    at nsHTTPResponseListener.cpp:405
#31 0xdde2db47 in nsOnDataAvailableEvent::HandleEvent (this=0x95dee20)
    at nsAsyncStreamListener.cpp:406
#32 0xdde2cbda in nsStreamListenerEvent::HandlePLEvent (aEvent=0x97aea00)
    at nsAsyncStreamListener.cpp:97
#33 0xdfa57dab in PL_HandleEvent (self=0x97aea00) at plevent.c:575
#34 0xdfa57c95 in PL_ProcessPendingEvents (self=0x8131380) at plevent.c:520
#35 0xdfa59918 in nsEventQueueImpl::ProcessPendingEvents (this=0x8103230) at
nsEventQueue.cpp:316
#36 0xde2ec176 in event_processor_callback (data=0x8103230, source=6,
condition=GDK_INPUT_READ)
    at nsAppShell.cpp:143
#37 0xde2ebd71 in our_gdk_io_invoke (source=0x8221ea0, condition=G_IO_IN,
data=0x81a0050)
    at nsAppShell.cpp:56
---Type <return> to continue, or q <return> to quit---
#38 0xde133eee in g_io_unix_dispatch () from
/usr/local/java/mozilla/i386/lib/libglib-1.2.so.0
#39 0xde1353f5 in g_main_dispatch () from
/usr/local/java/mozilla/i386/lib/libglib-1.2.so.0
#40 0xde1359c3 in g_main_iterate () from
/usr/local/java/mozilla/i386/lib/libglib-1.2.so.0
#41 0xde135b41 in g_main_run () from
/usr/local/java/mozilla/i386/lib/libglib-1.2.so.0
#42 0xde210617 in gtk_main () from
/usr/local/java/mozilla/i386/lib/libgtk-1.2.so.0
#43 0xde2ec8ca in nsAppShell::Run (this=0x813f870) at nsAppShell.cpp:313
#44 0xdf10991d in nsAppShellService::Run (this=0x81032b0) at
nsAppShellService.cpp:371
#45 0x805de1c in main1 (argc=1, argv=0x8047708, nativeApp=0x0) at
nsAppRunner.cpp:904
#46 0x805e602 in main (argc=1, argv=0x8047708) at nsAppRunner.cpp:1188
(gdb)

Comment 1

[leger]

Adding crash to keyword field.

Comment 2

[Asa Dotzler [:asa]]

assigning to Network.

Comment 3

[Gagan]

I think this is mscott

Comment 4

[Rob Sanderson]

Also M16, linux i386. While playing with unmodified xpcom/sample/ html file.

-----
Document
file:///home/azaroth/work/client/mozilla/src/mozilla/xpcom/sample/xpconnect-sample.html?
loaded successfully
JavaScript error: 
 line 0: uncaught exception: Access denied to XPConnect service.

WEBSHELL+ = 13
Enabling Quirk StyleSheet
WEBSHELL- = 12
->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Write Clipboard to memory
Assertion failure: root_points_to_gcArenaPool, at jsgc.c:745
-----

Comment 5

[Scott MacGregor]

Do you guys still see this in current builds? 

Comment 6

[timeless]

Per PC/Linux marking All/Linux.

Comment 7

[Alec Flett]

Adding [e-mail] to the list..

dollars to donuts this is the same crash as the account wizard crash.

raghu, two questions:
1) do you run an optimized debug build?
2) did you happen to open the mail account wizard before this crashed? How about
any other modal dialogs?

Comment 8

[Raghu Sakleshpur]

I believe we have debug builds done here.. I'm not sure if it optimized
debug.. 
I do not recollect now what were the sequence of actions that actually led
to this crash. I may have tried to open the mail account too. Cannot tell
for sure..
Sorry this is of not much help..:-(
-raghu

Comment 9

[Scott MacGregor]

Do you still see this crash raghu? I suspect alec's right and we need to dup it
off the same JS bug that Alec uses to track the crash after you dismiss the
account manager or other modal dialogs. 

Comment 10

[selmer (gone)]

nsbeta3-, necessary info not available.

Comment 11

[Raghu Sakleshpur]

Sorry, I took a while to get back on this. I had difficulty getting an intel
working build here.. I do not see this crash any more. 

-raghu

Comment 12

[Tom Everingham]

marking wfm per reporters comments

Comment 13

[Tom Everingham]

verified