Last Comment Bug 540953 - crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]
: crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]
: crash, topcrash
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: 1.9.1 Branch
: x86 All
-- critical (vote)
: ---
Assigned To: timeless
: Andrew Overholt [:overholt]
Depends on:
  Show dependency treegraph
Reported: 2010-01-20 14:50 PST by Wayne Mery (:wsmwk, NI for questions)
Modified: 2011-06-09 14:58 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

proposal (739 bytes, patch)
2010-02-03 06:44 PST, timeless
bugs: review+
Details | Diff | Splinter Review
for 1.9.1 only (747 bytes, patch)
2010-02-03 09:48 PST, timeless
timeless: review+
dveditz: approval1.9.1.9+
Details | Diff | Splinter Review

Description User image Wayne Mery (:wsmwk, NI for questions) 2010-01-20 14:50:37 PST
#2 crash for SM 2.0.2
crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]

a few comments include:
editing a simple html file 
PAting text into Composer
pasting without format 
closing windows, email, main window - then crash
closing the composer using the "X" in the upper right corner after saving a web page I created.

closing the composer using the "X" in the upper right corner after saving a web page I created.
0	seamonkey.exe	nsHTMLAnchorElement::UnbindFromTree	 content/html/content/src/nsHTMLAreaElement.cpp:240
1	seamonkey.exe	nsElementDeletionObserver::NodeWillBeDestroyed	editor/libeditor/html/nsHTMLAnonymousUtils.cpp:130
2	seamonkey.exe	nsNodeUtils::LastRelease	content/base/src/nsNodeUtils.cpp:196
3	seamonkey.exe	nsGenericDOMDataNode::Release	content/base/src/nsGenericElement.cpp:4124
4	seamonkey.exe	XPCJSRuntime::GCCallback	js/src/xpconnect/src/xpcjsruntime.cpp:775
5	jsd3250.dll	jsds_GCCallbackProc	js/jsd/jsd_xpc.cpp:531
6	seamonkey.exe	DOMGCCallback	dom/src/base/nsJSEnvironment.cpp:3692
7	seamonkey.exe	XPCCycleCollectGCCallback	js/src/xpconnect/src/nsXPConnect.cpp:411
8	js3250.dll	js_GC	js/src/jsgc.cpp:3792
9	js3250.dll	JS_GC	js/src/jsapi.cpp:2458
10	seamonkey.exe	nsXPConnect::Collect	js/src/xpconnect/src/nsXPConnect.cpp:477
11	xpcom_core.dll	nsCycleCollector::Collect	xpcom/base/nsCycleCollector.cpp:2386
12	xpcom_core.dll	nsCycleCollector_collect	xpcom/base/nsCycleCollector.cpp:3045
13	seamonkey.exe	nsJSContext::CC	dom/src/base/nsJSEnvironment.cpp:3512
14	seamonkey.exe	GCTimerFired	dom/src/base/nsJSEnvironment.cpp:3620
15	xpcom_core.dll	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:420
16	xpcom_core.dll	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:512
Comment 1 User image Robert Kaiser 2010-02-03 05:41:50 PST
nsElementDeletionObserver::NodeWillBeDestroyed always seems tzo be the caller to nsHTMLAnchorElement::UnbindFromTree there.

This is the #2 topcrash for SeaMonkey 2.0.2, happening cross-platform, and it's also #159 on the Firefox 3.5.7 topcrash list, this very much seems to be core code. Many people seem to report, not surprisingly, as editor/ code is involved, being in an HTML form or editor of some kind when they crash.

bug 533061 sounds similar and is on the Thunderbird 3.0.1 topcrash list.
Comment 3 User image timeless 2010-02-03 06:43:49 PST
so, the 0x0 makes sense.

This code doesn't exist on trunk.
Comment 4 User image timeless 2010-02-03 06:44:47 PST
Created attachment 424981 [details] [diff] [review]

So, the other parts of this file null check GetCurrentDoc(), and the function naming implies it could return null, so here it presumably did....
Comment 5 User image Olli Pettay [:smaug] (pto-ish for couple of days) 2010-02-03 09:18:57 PST
Comment on attachment 424981 [details] [diff] [review]

Yeah, this is unfortunate, but needed.
Comment 6 User image timeless 2010-02-03 09:48:58 PST
Created attachment 425017 [details] [diff] [review]
for 1.9.1 only

so, the patch i posted belongs in bug 533061. the reason they look the same and that i posted that one here is that in 1.9.1 the compiler code folded them so they shared code and thus line numbers, because it was the same code.

But this specific crash only exists in 1.9.1, whereas the other one exists in both places.
Comment 7 User image Wayne Mery (:wsmwk, NI for questions) 2010-02-06 02:57:47 PST
related to bug 480300?
Comment 8 User image Daniel Veditz [:dveditz] 2010-02-22 10:37:04 PST
Comment on attachment 425017 [details] [diff] [review]
for 1.9.1 only

Approved for, a=dveditz for release-drivers
Comment 10 User image Al Billings [:abillings] 2010-03-12 17:05:06 PST
There doesn't seem to be anything for QA to do here for 1.9.1 verification.

Note You need to log in before you can comment on or make changes to this bug.