490976 - [@ CSSLoaderImpl::SheetComplete - ... CSSLoaderImpl::SheetComplete]

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[timeless]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.21) Gecko/20090327 Camino/1.6.7 (like Firefox/2.0.0.21pre)

Process:         Camino [1655]
Path:            /Applications/Camino.app/Contents/MacOS/Camino
Identifier:      org.mozilla.camino
Version:         1.6.7 (1609.03.27)
Code Type:       X86 (Native)

Date/Time:       2009-05-01 14:00:13.038 +0300
OS Version:      Mac OS X 10.5.6 (9G2133)

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000c000009b
Crashed Thread:  0

Thread 0 Crashed:
0   0x00370578 CSSLoaderImpl::SheetComplete(SheetLoadData*, int) + 114
1   CSSLoaderImpl::LoadSheet(SheetLoadData*, StyleSheetState) + 1386
2   StartAlternateLoads(nsIURI*, SheetLoadData*&, void*) + 34
3   PL_DHashTableEnumerate + 131
4   CSSLoaderImpl::SheetComplete(SheetLoadData*, int) + 439
5   CSSLoaderImpl::LoadSheet(SheetLoadData*, StyleSheetState) + 1386
6   StartAlternateLoads(nsIURI*, SheetLoadData*&, void*) + 34
7   PL_DHashTableEnumerate + 131
8   CSSLoaderImpl::DropDocumentReference() + 63
9   nsDocument::~nsDocument() + 887
10  nsHTMLDocument::~nsHTMLDocument() + 398
11  nsDocument::Release() + 53
12  nsCOMPtr_base::~nsCOMPtr_base() + 20
13  nsContentSink::~nsContentSink() + 112
14  HTMLContentSink::~HTMLContentSink() + 530
15  nsContentSink::Release() + 41
16  nsCOMPtr_base::~nsCOMPtr_base() + 20
17  nsParser::~nsParser() + 119
18  nsParser::Release() + 41
19  nsCOMPtr_base::assign_with_AddRef(nsISupports*) + 40
20  CSSLoaderImpl::SheetComplete(SheetLoadData*, int) + 67
21  SheetLoadData::OnStreamComplete(nsIUnicharStreamLoader*, nsISupports*, unsigned int, nsIUnicharInputStream*) + 623
22  nsUnicharStreamLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) + 376
23  nsHttpChannel::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) + 346
24  nsInputStreamPump::OnStateStop() + 88
25  nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) + 133
26  nsAStreamCopier::Process() + 751
27  PL_HandleEvent + 21
28  PL_ProcessPendingEvents + 103
29  CFRunLoopRunSpecific + 3141
30  CFRunLoopRunInMode + 88
31  RunCurrentEventLoopInMode + 283
32  ReceiveNextEventCommon + 175
33  BlockUntilNextEventMatchingListInMode + 106
34  _DPSNextEvent + 657
35  -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
36  -[NSButtonCell performClick:] + 981
37  -[NSApplication sendAction:to:from:] + 112
38  -[NSMenu performActionForItemAtIndex:] + 493
39  -[NSCarbonMenuImpl performActionWithHighlightingForItemAtIndex:] + 220
40  -[NSMenu performKeyEquivalent:] + 866
41  -[NSApplication _handleKeyEquivalent:] + 492
42  -[NSApplication sendEvent:] + 3999
43  -[NSApplication run] + 847
44  NSApplicationMain + 574
45  main + 196
46  _start + 216
47  start + 41

i remember playing near https://bug468552.bugzilla.mozilla.org/attachment.cgi?id=352025 and trying to go back/use view-source:

Comment 1

[Jesse Ruderman]

bz, can you figure out much from the stack and the memory address 0xc000009b?  If not, please mark this bug as incomplete.

Comment 2

[Boris Zbarsky [:bzbarsky]]

No idea about the memory address, but the stack's helpful.  Looking into this.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Oh, camino.  Gecko 1.8.  Bah.  This bug (which is due to an obvious logic flaw that could cause hashtable enumeration reentry as per the stack in comment 0) was fixed for gecko 1.9 by the patch in bug 380612.

I could create a more localized 1.8 branch fix if really needed, but I don't think I'm going to bother unless there's actual demand.