485382 - crash [@ txExecutionState::~txExecutionState]

Status: VERIFIED DUPLICATE of bug 485217

(Firefox :: General, defect)

Description

[reelix]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6

The page: http://www.reelix.za.net/KO/crashFirefox.html will crash all open instances of Firefox, bringing up the "Crash Reporter" screen.

Reproducible: Always

Steps to Reproduce:
1. Go to http://www.reelix.za.net/KO/crashFirefox.html
2. Crash
3.
Actual Results:  
Firefox crashes.

Expected Results:  
Firefox should not crash.

Confirmed on Firefox 3.1 Beta 1 as well.

Comment 1

[reelix]

Attachment: Zip file containing crash files.

Comment 2

[Doug Turner (:dougt)]

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x134746ca in txExecutionState::~txExecutionState (this=0xbfffde5c) at /Users/dougt/builds/mozilla/mozilla-central/content/xslt/src/xslt/txExecutionState.cpp:108

l#2  0x134bb720 in txMozillaXSLTProcessor::TransformToDoc (this=0x19d2c440, aOutputDoc=0x0, aResult=0x0) at /Users/dougt/builds/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:704
#3  0x134bdea2 in nsTransformBlockerEvent::Run (this=0x1710ee30) at /Users/dougt/builds/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:564
#4  0x005295a6 in nsThread::ProcessNextEvent (this=0x718850, mayWait=0, result=0xbfffe044) at /Users/dougt/builds/mozilla/mozilla-central/xpcom/threads/nsThread.cpp:510
#5  0x004b230a in NS_ProcessPendingEvents_P (thread=0x718850, timeout=20) at nsThreadUtils.cpp:180
#6  0x11833063 in nsBaseAppShell::NativeEventCallback (this=0x748900) at /Users/dougt/builds/mozilla/mozilla-central/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#7  0x117e9116 in nsAppShell::ProcessGeckoEvents (aInfo=0x748900) at /Users/dougt/builds/mozilla/mozilla-central/widget/src/cocoa/nsAppShell.mm:412
#8  0x953f85f5 in CFRunLoopRunSpecific ()
#9  0x953f8cd8 in CFRunLoopRunInMode ()
#10 0x92a532c0 in RunCurrentEventLoopInMode ()
#11 0x92a530d9 in ReceiveNextEventCommon ()
#12 0x92a52f4d in BlockUntilNextEventMatchingListInMode ()
#13 0x93b41d7d in _DPSNextEvent ()
#14 0x93b41630 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#15 0x93b3a66b in -[NSApplication run] ()
#16 0x117e71e4 in nsAppShell::Run (this=0x748900) at /Users/dougt/builds/mozilla/mozilla-central/widget/src/cocoa/nsAppShell.mm:723
#17 0x124f0f32 in nsAppStartup::Run (this=0x761d70) at /Users/dougt/builds/mozilla/mozilla-central/toolkit/components/startup/src/nsAppStartup.cpp:192
#18 0x000a89b6 in XRE_main (argc=1, argv=0xbffff6a0, aAppData=0x70e880) at /Users/dougt/builds/mozilla/mozilla-central/toolkit/xre/nsAppRunner.cpp:3220
#19 0x000027cb in main (argc=1, argv=0xbffff6a0) at /Users/dougt/builds/mozilla/mozilla-central/browser/app/nsBrowserApp.cpp:156
(gdb) 
#0  0x00000000 in ?? ()
#1  0x134746ca in txExecutionState::~txExecutionState (this=0xbfffde5c) at /Users/dougt/builds/mozilla/mozilla-central/content/xslt/src/xslt/txExecutionState.cpp:108
#2  0x134bb720 in txMozillaXSLTProcessor::TransformToDoc (this=0x19d2c440, aOutputDoc=0x0, aResult=0x0) at /Users/dougt/builds/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:704
#3  0x134bdea2 in nsTransformBlockerEvent::Run (this=0x1710ee30) at /Users/dougt/builds/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:564
#4  0x005295a6 in nsThread::ProcessNextEvent (this=0x718850, mayWait=0, result=0xbfffe044) at /Users/dougt/builds/mozilla/mozilla-central/xpcom/threads/nsThread.cpp:510
#5  0x004b230a in NS_ProcessPendingEvents_P (thread=0x718850, timeout=20) at nsThreadUtils.cpp:180
#6  0x11833063 in nsBaseAppShell::NativeEventCallback (this=0x748900) at /Users/dougt/builds/mozilla/mozilla-central/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#7  0x117e9116 in nsAppShell::ProcessGeckoEvents (aInfo=0x748900) at /Users/dougt/builds/mozilla/mozilla-central/widget/src/cocoa/nsAppShell.mm:412
#8  0x953f85f5 in CFRunLoopRunSpecific ()
#9  0x953f8cd8 in CFRunLoopRunInMode ()
#10 0x92a532c0 in RunCurrentEventLoopInMode ()
#11 0x92a530d9 in ReceiveNextEventCommon ()
#12 0x92a52f4d in BlockUntilNextEventMatchingListInMode ()
#13 0x93b41d7d in _DPSNextEvent ()
#14 0x93b41630 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#15 0x93b3a66b in -[NSApplication run] ()
#16 0x117e71e4 in nsAppShell::Run (this=0x748900) at /Users/dougt/builds/mozilla/mozilla-central/widget/src/cocoa/nsAppShell.mm:723
#17 0x124f0f32 in nsAppStartup::Run (this=0x761d70) at /Users/dougt/builds/mozilla/mozilla-central/toolkit/components/startup/src/nsAppStartup.cpp:192
#18 0x000a89b6 in XRE_main (argc=1, argv=0xbffff6a0, aAppData=0x70e880) at /Users/dougt/builds/mozilla/mozilla-central/toolkit/xre/nsAppRunner.cpp:3220
#19 0x000027cb in main (argc=1, argv=0xbffff6a0) at /Users/dougt/builds/mozilla/mozilla-central/browser/app/nsBrowserApp.cpp:156

Comment 3

[Doug Turner (:dougt)]

blake, looks familiar?