46430 - Save link as crashes netscape after three or four times

Status: VERIFIED DUPLICATE of bug 43466

(SeaMonkey :: General, defect, P3)

Description

[Barrett Lindstrom]

When saving files by right clicking on the link, and using the "Save link as"
option, after the third or so file saved this way, the browser hangs and
crashes.

Reproducible: Always
Steps to Reproduce:
1.  Start the Browser
2.  In the address field, type
"http://slip/projects/seamonkey/im/whitebox_tests/smoketests.html".  Hit enter.
3.  There will be several links to files on this page.  Click the first link
with a right mouse button click, and select "Save Link As".
4.  Save the file somewhere in your directory (i.e. /u/(username)/temp/)
5.  The file should save correctly.  Repeat this for the rest of the links.

Actual Results:  After around 3 or 4 saves, the browser will hang and/or
crash.							

Expected Results:  All the links should have saved the file correctly.  This
works on the linux build							

This information is displayed on the terminal screen:

WEBSHELL+ = 5
nsWidget::~nsWidget() of toplevel: 25 widgets still exist.
WEBSHELL- = 4
nsWidget::~nsWidget() of toplevel: 23 widgets still exist.
-*- filepicker: CI: {c47de916-1dd1-11b2-8141-82507fa02b21}
-*- filepicker: IID:nsIFilePicker
nsIDOMWindow id value = {a6cf906b-15b3-11d2-932e-00805f8add32}
WEBSHELL+ = 5
Assertion failure: root_points_to_gcArenaPool, at jsgc.c:789
./run-mozilla.sh[30]: 23803 Abort(coredump)

Comment 1

[Shannon Diener]

I'm seeing this in Linux also (8am build on 7-25).  While saving the 4th file 
the browser crashes with the same error message.  The only difference is that 
there is no coredump on Linux.

Comment 2

[sungod]

Also confirmed behavior as listed above in build 2000072508 on Linux, using a
list of bugs from our very own Bugzilla and a personal portal page. Moving from
"UNCONFIRMED" to "NEW."

Comment 3

[John Gaunt (redfive)]

re-assigning to shannon

Comment 4

[Shannon Diener]

accepting bug

Comment 5

[Shannon Diener]

Stack Trace:

#0  0xc01f22b8 in kill () from /usr/lib/libc.2
#1  0xc018f2e8 in raise () from /usr/lib/libc.2
#2  0xc01cfc8c in abort_C () from /usr/lib/libc.2
#3  0xc01cfce4 in abort () from /usr/lib/libc.2
#4  0xc208a170 in JS_Assert (s=0xc2093da8 "root_points_to_gcArenaPool",
file=0xc2093d30 "jsgc.c", ln=789) at
/builds/shannond/seamonkey/source/mozilla/js/src/jsutil.c:174
#5  0xc2020924 in gc_root_marker (he=0x4056ad30, i=142, arg=0x400828d0 "") at
/builds/shannond/seamonkey/source/mozilla/js/src/jsgc.c:789
#6  0xc2023114 in JS_HashTableEnumerateEntries (ht=0x40084b80, f=0x7af12702
<gc_root_marker>, arg=0x400828d0 "") at
/builds/shannond/seamonkey/source/mozilla/js/src/jshash.c:364
#7  0xc20210a4 in js_GC (cx=0x40c121e8, gcflags=0) at
/builds/shannond/seamonkey/source/mozilla/js/src/jsgc.c:957
#8  0xc2020a6c in js_ForceGC (cx=0x40c121e8) at
/builds/shannond/seamonkey/source/mozilla/js/src/jsgc.c:814
#9  0xc1fe10dc in JS_GC (cx=0x40c121e8) at
/builds/shannond/seamonkey/source/mozilla/js/src/jsapi.c:1166
#10 0xc26fb7b0 in nsJSContext::GC (this=0x40c10fe0) at
/builds/shannond/seamonkey/source/mozilla/dom/src/base/nsJSEnvironment.cpp:1126
#11 0xc37ab48c in nsDocShell::SetupNewViewer (this=0x40c10180,
aNewViewer=0x40bc0758) at
/builds/shannond/seamonkey/source/mozilla/docshell/base/nsDocShell.cpp:2529
#12 0xc37be834 in nsWebShell::SetupNewViewer (this=0x40c10180,
aViewer=0x40bc0758) at
/builds/shannond/seamonkey/source/mozilla/docshell/base/nsWebShell.cpp:385
#13 0xc37a7dd4 in nsDocShell::Embed (this=0x40c10180, aContentViewer=0x40bc0758,
aCommand=0xc37d72da "", aExtraInfo=0x0) at
/builds/shannond/seamonkey/source/mozilla/docshell/base/nsDocShell.cpp:2245
#14 0xc37beecc in nsWebShell::Embed (this=0x40c10180, aContentViewer=0x40bc0758,
aCommand=0xc37d72da "", aExtraInfo=0x0) at
/builds/shannond/seamonkey/source/mozilla/docshell/base/nsWebShell.cpp:409
#15 0xc37a97bc in nsDocShell::CreateContentViewer (this=0x40c10180,
aContentType=0x7b04545c "text/cached-xul", aOpenedChannel=0x40db11f0,
aContentHandler=0x7b045400) at
/builds/shannond/seamonkey/source/mozilla/docshell/base/nsDocShell.cpp:2413
#16 0xc37cda70 in nsDSURIContentListener::DoContent (this=0x40c10028,
aContentType=0x7b04545c "text/cached-xul", aCommand=0, aWindowTarget=0x7af10102
"", aOpenedChannel=0x40db11f0, aContentHandler=0x7b045400,
aAbortProcess=0x7b0454f0) at
/builds/shannond/seamonkey/source/mozilla/docshell/base/nsDSURIContentListener.cpp:99
#17 0xc472fc94 in nsDocumentOpenInfo::DispatchContent (this=0x40db1228,
aChannel=0x40db11f0, aCtxt=0x0) at
/builds/shannond/seamonkey/source/mozilla/uriloader/base/nsURILoader.cpp:357
#18 0xc472ef54 in nsDocumentOpenInfo::OnStartRequest (this=0x40db1228,
aChannel=0x40db11f0, aCtxt=0x0) at
/builds/shannond/seamonkey/source/mozilla/uriloader/base/nsURILoader.cpp:233
#19 0xc29d65a4 in nsCachedChromeChannel::HandleStartLoadEvent
(aEvent=0x40db16e0) at
/builds/shannond/seamonkey/source/mozilla/rdf/chrome/src/nsChromeProtocolHandler.cpp:509
#20 0xc228726c in PL_HandleEvent (self=0x40db16e0) at
/builds/shannond/seamonkey/source/mozilla/xpcom/threads/plevent.c:587

Comment 6

[Shannon Diener]

mozilla/js/src/jsgc.c line 789 is contained within a #ifdef DEBUG section.  So 
we are only seeing this on debugs builds.  Seems to work fine on release builds.

Comment 7

[Blake Ross]

spam: Adding crash keyword...

Comment 8

[Shannon Diener]

After responses from jband, brendan, alecf, and danm it looks like this bug is 
similar if not identical to the problem with bug 43466.  Stack trace looks 
similar to mine and all show he-> value pointing to "window_object"

Comment 9

[Shannon Diener]

*** This bug has been marked as a duplicate of 43466 ***

Comment 10

[Rann Bar-On]

seems right to dupe...verifying