Closed Bug 416383 Opened 16 years ago Closed 16 years ago

Crash going back on and forth on [@nsDOMAttribute::GetValue(nsAString_internal&)]


(Core :: DOM: Core & HTML, defect)

Not set





(Reporter: cbook, Assigned: smaug)




(Keywords: crash)

Crash Data


(3 files)

Attached file crash log
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b4pre) Gecko/2008020717 Firefox/3.0b4pre

Steps to reproduce:

- Go to
- Click on "weiter"
- next page loads
- go back

Reported by isv during the firfox 3 beta 3 testday. His crash reporter url for this crash on linux is

Attached is also my crash report from my debug build. Crashs also Windows Fx 3 Beta3 Builds.
Flags: blocking-firefox3?
Component: General → DOM
Flags: blocking-firefox3?
Product: Firefox → Core
QA Contact: general → general
The crash stack makes me suspect DOM or cycle collector.
Flags: blocking1.9?
Summary: Crash going back on and forth on → Crash going back on and forth on [@nsDOMAttribute::GetValue(nsAString_internal&)]
The crash also occurs when you close the tab or window with
the page in it.

I believe this is caused by a document in an iframe using
window.setInterval to make an AJAX request. I can't tell
if that request is still made before the crash. If the
request succeeds, the function tries to access the page's
DOM, which I suppose isn't there anymore. In any case,
the crash takes place in time with the setInterval timing.

The document from the iframe does not crash on its own. It's

Perhaps this is to do with bug 194994?
Assignee: nobody → Olli.Pettay
Attached patch possible fixSplinter Review
This is the simplest fix. Other one would be to make nsDOMAttributeMap::mContent
strong ref, but since our DOM doesn't keep parent nodes etc. alive anyway when
having a reference to child, this should be enough. And this doesn't change the
Attachment #302308 - Flags: superreview?(peterv)
Attachment #302308 - Flags: review?(peterv)
Comment on attachment 302308 [details] [diff] [review]
possible fix

Yeah, I'd say lets keep the strong references one-way for 1.9. In moz2 everything will be MMgc anyway.
Attachment #302308 - Flags: superreview?(peterv)
Attachment #302308 - Flags: superreview+
Attachment #302308 - Flags: review?(peterv)
Attachment #302308 - Flags: review+
Attachment #302308 - Flags: approval1.9?
Attachment #302445 - Flags: approval1.9+
Attachment #302308 - Flags: approval1.9?
Closed: 16 years ago
Flags: blocking1.9? → in-testsuite+
Resolution: --- → FIXED
Crash Signature: [@nsDOMAttribute::GetValue(nsAString_internal&)]
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.