Last Comment Bug 540953 - crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]
: crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]
: crash, topcrash
Product: Core
Classification: Components
Component: DOM: Core & HTML (show other bugs)
: 1.9.1 Branch
: x86 All
: -- critical (vote)
: ---
Assigned To: timeless
Depends on:
  Show dependency treegraph
Reported: 2010-01-20 14:50 PST by Wayne Mery (:wsmwk, use Needinfo for questions)
Modified: 2011-06-09 14:58 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

proposal (739 bytes, patch)
2010-02-03 06:44 PST, timeless
bugs: review+
Details | Diff | Review
for 1.9.1 only (747 bytes, patch)
2010-02-03 09:48 PST, timeless
timeless: review+
dveditz: approval1.9.1.9+
Details | Diff | Review

Description Wayne Mery (:wsmwk, use Needinfo for questions) 2010-01-20 14:50:37 PST
#2 crash for SM 2.0.2
crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]

a few comments include:
editing a simple html file 
PAting text into Composer
pasting without format 
closing windows, email, main window - then crash
closing the composer using the "X" in the upper right corner after saving a web page I created.

closing the composer using the "X" in the upper right corner after saving a web page I created.
0	seamonkey.exe	nsHTMLAnchorElement::UnbindFromTree	 content/html/content/src/nsHTMLAreaElement.cpp:240
1	seamonkey.exe	nsElementDeletionObserver::NodeWillBeDestroyed	editor/libeditor/html/nsHTMLAnonymousUtils.cpp:130
2	seamonkey.exe	nsNodeUtils::LastRelease	content/base/src/nsNodeUtils.cpp:196
3	seamonkey.exe	nsGenericDOMDataNode::Release	content/base/src/nsGenericElement.cpp:4124
4	seamonkey.exe	XPCJSRuntime::GCCallback	js/src/xpconnect/src/xpcjsruntime.cpp:775
5	jsd3250.dll	jsds_GCCallbackProc	js/jsd/jsd_xpc.cpp:531
6	seamonkey.exe	DOMGCCallback	dom/src/base/nsJSEnvironment.cpp:3692
7	seamonkey.exe	XPCCycleCollectGCCallback	js/src/xpconnect/src/nsXPConnect.cpp:411
8	js3250.dll	js_GC	js/src/jsgc.cpp:3792
9	js3250.dll	JS_GC	js/src/jsapi.cpp:2458
10	seamonkey.exe	nsXPConnect::Collect	js/src/xpconnect/src/nsXPConnect.cpp:477
11	xpcom_core.dll	nsCycleCollector::Collect	xpcom/base/nsCycleCollector.cpp:2386
12	xpcom_core.dll	nsCycleCollector_collect	xpcom/base/nsCycleCollector.cpp:3045
13	seamonkey.exe	nsJSContext::CC	dom/src/base/nsJSEnvironment.cpp:3512
14	seamonkey.exe	GCTimerFired	dom/src/base/nsJSEnvironment.cpp:3620
15	xpcom_core.dll	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:420
16	xpcom_core.dll	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:512
Comment 1 Robert Kaiser (not working on stability any more) 2010-02-03 05:41:50 PST
nsElementDeletionObserver::NodeWillBeDestroyed always seems tzo be the caller to nsHTMLAnchorElement::UnbindFromTree there.

This is the #2 topcrash for SeaMonkey 2.0.2, happening cross-platform, and it's also #159 on the Firefox 3.5.7 topcrash list, this very much seems to be core code. Many people seem to report, not surprisingly, as editor/ code is involved, being in an HTML form or editor of some kind when they crash.

bug 533061 sounds similar and is on the Thunderbird 3.0.1 topcrash list.
Comment 2 Robert Kaiser (not working on stability any more) 2010-02-03 05:44:41 PST
Links to lists of reports for this signature:

Many of those report 0x0 as address, which already sounds fishy to me, even though I don't really know C++ much...
Comment 3 timeless 2010-02-03 06:43:49 PST
so, the 0x0 makes sense.

This code doesn't exist on trunk.
Comment 4 timeless 2010-02-03 06:44:47 PST
Created attachment 424981 [details] [diff] [review]

So, the other parts of this file null check GetCurrentDoc(), and the function naming implies it could return null, so here it presumably did....
Comment 5 Olli Pettay [:smaug] 2010-02-03 09:18:57 PST
Comment on attachment 424981 [details] [diff] [review]

Yeah, this is unfortunate, but needed.
Comment 6 timeless 2010-02-03 09:48:58 PST
Created attachment 425017 [details] [diff] [review]
for 1.9.1 only

so, the patch i posted belongs in bug 533061. the reason they look the same and that i posted that one here is that in 1.9.1 the compiler code folded them so they shared code and thus line numbers, because it was the same code.

But this specific crash only exists in 1.9.1, whereas the other one exists in both places.
Comment 7 Wayne Mery (:wsmwk, use Needinfo for questions) 2010-02-06 02:57:47 PST
related to bug 480300?
Comment 8 Daniel Veditz [:dveditz] 2010-02-22 10:37:04 PST
Comment on attachment 425017 [details] [diff] [review]
for 1.9.1 only

Approved for, a=dveditz for release-drivers
Comment 10 Al Billings [:abillings] 2010-03-12 17:05:06 PST
There doesn't seem to be anything for QA to do here for 1.9.1 verification.

Note You need to log in before you can comment on or make changes to this bug.