Crash [@ nsXBLPrototypeBinding::AttributeChanged][@ nsXULElement::UnsetAttr][@ nsXULDocument::CheckBroadcasterHookup] with menulist, observes and acceltext

VERIFIED FIXED

Status

()

P2
critical
VERIFIED FIXED
10 years ago
4 months ago

People

(Reporter: martijn.martijn, Assigned: smaug)

Tracking

(4 keywords)

Trunk
x86
Windows XP
crash, regression, testcase, verified1.9.1
Points:
---
Bug Flags:
blocking1.9.1 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

693 bytes, application/vnd.mozilla.xul+xml
Details
582 bytes, application/vnd.mozilla.xul+xml
Details
(Reporter)

Description

10 years ago
See testcase, which crashes current trunk build after 100ms.
It doesn't crash in a 2008-12-03 build, it does crash in a 2008-12-04 build:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2008-12-03+04%3A00%3A00&enddate=2008-12-04+06%3A00%3A00

Perhaps this is related to bug 470687, because it has the same regression range?

http://crash-stats.mozilla.com/report/index/baf37f75-2c72-442c-9240-db26f2081229
0  	xul.dll  	nsXBLPrototypeBinding::AttributeChanged  	 content/xbl/src/nsXBLPrototypeBinding.cpp:640
1 		@0x6a3460f

http://crash-stats.mozilla.com/report/index/3976c67f-9e55-4922-a6ae-f5c1a2081229?p=1
0  	xul.dll  	nsXULElement::UnsetAttr  	 content/xul/content/src/nsXULElement.cpp:1267
1 	xul.dll 	nsMenuFrame::BuildAcceleratorText 	layout/xul/base/src/nsMenuFrame.cpp:1022
2 	xul.dll 	xul.dll@0x2d3619 	
3 	xul.dll 	nsCSSFrameConstructor::AttributeChanged 	layout/base/nsCSSFrameConstructor.cpp:10109
4 	xul.dll 	PresShell::AttributeChanged 	layout/base/nsPresShell.cpp:4641
5 	xul.dll 	nsNodeUtils::AttributeChanged 	content/base/src/nsNodeUtils.cpp:110
6 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.cpp:4332
7 	xul.dll 	nsGenericElement::SetAttr 	content/base/src/nsGenericElement.cpp:4263
8 	xul.dll 	nsAString_internal::Assign 	xpcom/string/src/nsTSubstring.cpp:411
9 	xul.dll 	nsNodeUtils::AttributeChanged 	content/base/src/nsNodeUtils.cpp:110
10 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.cpp:4332
Flags: blocking1.9.2?
(Reporter)

Comment 1

10 years ago
Created attachment 354707 [details]
testcase
(Reporter)

Comment 2

10 years ago
Created attachment 354771 [details]
testcase2

Another one. This one has this breakpad stack:
http://crash-stats.mozilla.com/report/index/cff0bce1-fb70-4beb-9869-1ac4b2081229?p=1
0  	xul.dll  	nsXULDocument::CheckBroadcasterHookup  	 content/xul/document/src/nsXULDocument.cpp:4326
1 	xul.dll 	nsXULDocument::AttributeChanged 	content/xul/document/src/nsXULDocument.cpp:1049
2 	xul.dll 	SearchTable 	obj-firefox/xpcom/build/pldhash.c:423
3 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.cpp:4332
4 	xul.dll 	nsGenericElement::SetAttr 	content/base/src/nsGenericElement.cpp:4263
5 	xul.dll 	nsCOMPtr<nsIDOMDocumentView>::~nsCOMPtr<nsIDOMDocumentView> 	
6 	xul.dll 	nsXBLPrototypeBinding::AttributeChanged 	content/xbl/src/nsXBLPrototypeBinding.cpp:603
7 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.
(Reporter)

Comment 3

10 years ago
Also crashes in 1.9.1 trunk.
Flags: blocking1.9.1?
(Reporter)

Updated

10 years ago
Summary: Crash [@ nsXBLPrototypeBinding::AttributeChanged][@ nsXULElement::UnsetAttr] with menulist, observes and acceltext → Crash [@ nsXBLPrototypeBinding::AttributeChanged][@ nsXULElement::UnsetAttr][@ nsXULDocument::CheckBroadcasterHookup] with menulist, observes and acceltext
(Assignee)

Updated

10 years ago
Assignee: nobody → Olli.Pettay
(Reporter)

Updated

10 years ago
Depends on: 470687
(Assignee)

Updated

10 years ago
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
(Reporter)

Comment 4

10 years ago
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090108 Minefield/3.2a1pre
Status: RESOLVED → VERIFIED

Updated

10 years ago
Flags: blocking1.9.2?
Flags: blocking1.9.1?
Flags: blocking1.9.1+
Priority: -- → P2
(Assignee)

Updated

10 years ago
Keywords: fixed1.9.1
Verified fixed on the 1.9.1 branch using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090312 Shiretoko/3.1b4pre
Keywords: fixed1.9.1 → verified1.9.1
Crash Signature: [@ nsXBLPrototypeBinding::AttributeChanged] [@ nsXULElement::UnsetAttr] [@ nsXULDocument::CheckBroadcasterHookup]
Moving to Core:XUL per https://bugzilla.mozilla.org/show_bug.cgi?id=1455336
Component: XP Toolkit/Widgets: XUL → XUL
You need to log in before you can comment on or make changes to this bug.