Closed
Bug 478869
Opened 15 years ago
Closed 15 years ago
Crash [@ nsCSSStyleSheet::SetDisabled]
Categories
(Core :: CSS Parsing and Computation, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: smaug, Unassigned)
References
Details
(Whiteboard: [sg:critical?])
When running crashtests I occasionally get this crash. I'm not sure, but just guessing that nsCSSStyleSheet::mDocument is dead. I wonder why mDocument and mOwningNode are weak. #0 0x00000032d7097581 in nanosleep () from /lib64/libc.so.6 #1 0x00000032d70973a4 in sleep () from /lib64/libc.so.6 #2 0x00002aaaaaaf4d99 in ah_crap_handler (signum=11) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/toolkit/xre/nsSigHandlers.cpp:149 #3 0x00002aaaaaaf5958 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:216 #4 <signal handler called> #5 PresShell::Paint (this=0x2d630b0, aView=0x2, aRenderingContext=0x32d734c930, aDirtyRegion=@0x0) at ../../dist/include/view/nsIView.h:313 #6 0x00002aaab46467da in nsCSSStyleSheet::SetDisabled (this=0x3218180, aDisabled=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/layout/style/nsCSSStyleSheet.cpp:1660 #7 0x00002aaab4abe8f2 in nsHTMLEditor::EnableExistingStyleSheet (this=<value optimized out>, aURL=@0x7fffc46d4560) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/editor/libeditor/html/nsHTMLEditor.cpp:3704 #8 0x00002aaab4ac18b3 in nsHTMLEditor::AddOverrideStyleSheet (this=0x7fffc46d4340, aURL=@0x2) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/editor/libeditor/html/nsHTMLEditor.cpp:3586 #9 0x00002aaab48126cc in nsHTMLDocument::EditingStateChanged (this=0x2b4b340) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/document/src/nsHTMLDocument.cpp:3395 #10 0x00002aaab45a0a89 in ~mozAutoDocUpdate (this=<value optimized out>) at ../../../dist/include/content/mozAutoDocUpdate.h:66 #11 0x00002aaab473b77a in nsGenericElement::doInsertChildAt (aKid=0x327db40, aIndex=1, aNotify=1, aParent=0x0, aDocument=0x2b4b340, aChildArray=@0x2b4b518) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsGenericElement.cpp:3295 #12 0x00002aaab4829515 in nsXMLContentSink::SetDocElement (this=0x2e2e060, aNameSpaceID=3, aTagName=0xb45e50, aContent=0x327db40) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/xml/document/src/nsXMLContentSink.cpp:997 #13 0x00002aaab4828c0a in nsXMLContentSink::HandleStartElement (this=0x2e2e060, aName=<value optimized out>, aAtts=0x196b710, aAttsCount=<value optimized out>, aIndex=-1, aLineNumber=2, aInterruptable=1) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/xml/document/src/nsXMLContentSink.cpp:1097 #14 0x00002aaab4828fd2 in nsXMLContentSink::HandleStartElement (this=0x7fffc46d4340, aName=0x2, aAtts=0x33073a0, aAttsCount=0, aIndex=-1412034288, aLineNumber=774778670) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/xml/document/src/nsXMLContentSink.cpp:1020 #15 0x00002aaab6d87b09 in nsExpatDriver::HandleStartElement (this=0x196b290, aValue=0x327da50, aAtts=0x196b710) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/parser/htmlparser/src/nsExpatDriver.cpp:435 #16 0x00002aaab6daac5a in doContent (parser=0x196b360, startTagLevel=0, enc=0x2aaab6fda6c0, s=0x196b07a "<", end=0x196b204 "����", nextPtr=0x7fffc46d4b10, haveMore=1 '\001') at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/parser/expat/lib/xmlparse.c:2438 #17 0x00002aaab6dabd6c in contentProcessor (parser=0x196b360, start=0x0, end=0x2aaaabd61110 "\020\021֫�*", endPtr=0x7369642f2e2e2f2e) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/parser/expat/lib/xmlparse.c:2095 #18 0x00002aaab6da9abd in doProlog (parser=0x196b360, enc=0x2aaab6fda6c0, s=0x196b07a "<", end=0x196b204 "����", tok=<value optimized out>, next=0x196b07a "<", nextPtr=0x7fffc46d4b10, haveMore=1 '\001') at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/parser/expat/lib/xmlparse.c:4075 #19 0x00002aaab6dabe7f in prologProcessor (parser=0x196b360, s=0x196b020 "<", end=0x196b204 "����", nextPtr=0x7fffc46d4b10) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/parser/expat/lib/xmlparse.c:3809 #20 0x00002aaab6da5052 in MOZ_XML_Parse (parser=0x7fffc46d4340, s=0x196b020 "<", len=53506976, isFinal=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/parser/expat/lib/xmlparse.c:1528 #21 0x00002aaab6d84e96 in nsExpatDriver::ParseBuffer (this=0x196b290, aBuffer=0x196b020, aLength=242, aIsFinal=0, aConsumed=0x7fffc46d4e9c) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/parser/htmlparser/src/nsExpatDriver.cpp:1025 #22 0x00002aaab6d871d6 in nsExpatDriver::ConsumeToken (this=0x196b290, aScanner=@0x15faa10, aFlushTokens=<value optimized out>) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/parser/htmlparser/src/nsExpatDriver.cpp:1128
Reporter | ||
Comment 1•15 years ago
|
||
Or perhaps this is an editor bug.
Reporter | ||
Comment 2•15 years ago
|
||
nsHTMLEditor::AddOverrideStyleSheet sets stylesheet's owning document, but I have no idea what keeps that document alive or clears the owning document.
Comment 3•15 years ago
|
||
Is this fixed by the patch in bug 432114?
Reporter | ||
Comment 4•15 years ago
|
||
Seems like that might help. Not 100% sure though, because I can't always reproduce this. If the crash happens, it is when running 214/1064.
Depends on: 432114
Yeah, this sounds a lot like bug 432114 and bug 476975. The fundamental problem there is that editor calls nsIStyleSheet::SetOwningDocument() with a document that doesn't own the style sheet.
Updated•15 years ago
|
Whiteboard: [sg:critical?]
Reporter | ||
Comment 6•15 years ago
|
||
Can't reproduce this anymore.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Updated•11 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•