44210 - crash in nsGenericElement::HandleDOMEvent following links with deleted mParent

Status: VERIFIED DUPLICATE of bug 44235

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[David :Bienvenu]

I built the tip at 6:30 this morning, and have crashed several times with the
following stack trace. mParent has been deleted. Pollmann and mjudge made
changes to the event handling code that might be related.

nsGenericElement::HandleDOMEvent(nsIPresContext * 0x0619dd10, nsEvent *
0x0012ebe4, nsIDOMEvent * * 0x0012e780, unsigned int 0x00000001, nsEventStatus *
0x0012ec08) line 1369 + 33 bytes
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x064ccfac,
nsIPresContext * 0x0619dd10, nsEvent * 0x0012ebe4, nsIDOMEvent * * 0x00000000,
unsigned int 0x00000001, nsEventStatus * 0x0012ec08) line 813 + 31 bytes
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x06352a28,
nsIPresContext * 0x065293f0, nsEvent * 0x0012ee58, nsIFrame * 0x05206d58,
nsEventStatus * 0x0012edc0, nsIView * 0x063bcb90) line 350
PresShell::HandleEventInternal(nsEvent * 0x0012ee58, nsIView * 0x063bcb90,
nsEventStatus * 0x0012edc0) line 3899 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x062f1d84, nsIView * 0x063bcb90,
nsGUIEvent * 0x0012ee58, nsEventStatus * 0x0012edc0, int & 0x00000000) line 3840
+ 23 bytes
nsView::HandleEvent(nsView * const 0x063bcb90, nsGUIEvent * 0x0012ee58, unsigned
int 0x0000001c, nsEventStatus * 0x0012edc0, int & 0x00000000) line 782
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x063bcd70, nsGUIEvent *
0x0012ee58, nsEventStatus * 0x0012edc0) line 1389
HandleEvent(nsGUIEvent * 0x0012ee58) line 69
nsWindow::DispatchEvent(nsWindow * const 0x063bca64, nsGUIEvent * 0x0012ee58,
nsEventStatus & nsEventStatus_eIgnore) line 560 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012ee58) line 581
nsWindow::DispatchFocus(unsigned int 0x00000069) line 3825 + 15 bytes
nsWindow::ProcessMessage(unsigned int 0x00000007, unsigned int 0x00340358, long
0x00000000, long * 0x0012f19c) line 2887 + 19 bytes
nsWindow::WindowProc(HWND__ * 0x000d0312, unsigned int 0x00000007, unsigned int
0x00340358, long 0x00000000) line 829 + 27 bytes
USER32! 77e7131f()
USER32! 77e71a3d()
NTDLL! 77f7637b()
GlobalWindowImpl::Focus(GlobalWindowImpl * const 0x0631ce24) line 1366 + 23 bytes
CheckForFocus(nsIDocument * 0x06531640) line 1562
PresShell::InitialReflow(PresShell * const 0x062f1d80, int 0x00003c96, int
0x00002af3) line 1686 + 17 bytes
HTMLContentSink::StartLayout() line 3328
HTMLContentSink::OpenBody(HTMLContentSink * const 0x06536700, const
nsIParserNode & {...}) line 2715
CNavDTD::OpenBody(const nsIParserNode * 0x047830d0) line 2888 + 31 bytes
CNavDTD::OpenContainer(const nsIParserNode * 0x047830d0, nsHTMLTag
eHTMLTag_body, int 0x00000001, nsEntryStack * 0x00000000) line 3141 + 12 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x03123b90, nsHTMLTag eHTMLTag_body,
nsIParserNode * 0x047830d0) line 1138 + 20 bytes
CNavDTD::HandleStartToken(CToken * 0x03123b90) line 1562 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x0631aba0, CToken * 0x03123b90, nsIParser
* 0x06535090) line 770 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x0631aba0, nsIParser * 0x06535090,
nsITokenizer * 0x06319860, nsITokenObserver * 0x00000000, nsIContentSink *
0x06536700) line 499 + 20 bytes
nsParser::BuildModel() line 1657 + 34 bytes
nsParser::ResumeParse(int 0x00000001, int 0x00000000) line 1538 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x06535098, nsIChannel * 0x06529220,
nsISupports * 0x00000000, nsIInputStream * 0x0652ec14, unsigned int 0x00000000,
unsigned int 0x000006ed) line 1986 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x06529760,
nsIChannel * 0x06529220, nsISupports * 0x00000000, nsIInputStream * 0x0652ec14,
unsigned int 0x00000000, unsigned int 0x000006ed) line 249 + 46 bytes
nsHTTPFinalListener::OnDataAvailable(nsHTTPFinalListener * const 0x0652ae80,
nsIChannel * 0x06529220, nsISupports * 0x00000000, nsIInputStream * 0x0652ec14,
unsigned int 0x00000000, unsigned int 0x000006ed) line 1228 + 46 bytes
InterceptStreamListener::OnDataAvailable(InterceptStreamListener * const
0x0652ec10, nsIChannel * 0x06529220, nsISupports * 0x00000000, nsIInputStream *
0x06311cd0, unsigned int 0x00000000, unsigned int 0x000006ed) line 1165
nsHTTPChunkConv::OnDataAvailable(nsHTTPChunkConv * const 0x05233870, nsIChannel
* 0x06529220, nsISupports * 0x00000000, nsIInputStream * 0x0652ab2c, unsigned
int 0x00000000, unsigned int 0x000006f4) line 210 + 46 bytes
nsHTTPServerListener::OnDataAvailable(nsHTTPServerListener * const 0x0652abb0,
nsIChannel * 0x06525064, nsISupports * 0x06529220, nsIInputStream * 0x0652ab2c,
unsigned int 0x000000c4, unsigned int 0x000006f4) line 554 + 67 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x06531120)
line 401 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x06530f20) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x06530f20) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x01102240) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x007901d2, unsigned int 0x0000c0a7, unsigned int
0x00000000, long 0x01102240) line 1032 + 9 bytes
USER32! 77e71268()

Comment 1

[David :Bienvenu]

I don't have reproducible steps for this; I just keep running into it trying to
use the browser to enter bugs, etc.

Comment 2

[David :Bienvenu]

OK, I've reproduced this twice with the following steps:

Use a profile that you haven't configured with a mynetscape homepage.

1. Go to www.mynetscape.com
2. Click on the "I have already personalized a home page - go find it" link.

Comment 3

[David :Bienvenu]

adding crash keyword

Comment 4

[sean echevarria]

there's a patch over at 44234

marking dup


*** This bug has been marked as a duplicate of 44235 ***

Comment 5

[Blake Ross]

vrfy