#2 crash for SM 2.0.2 crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)] a few comments include: editing a simple html file PAting text into Composer pasting without format closing windows, email, main window - then crash closing the composer using the "X" in the upper right corner after saving a web page I created. bp-9668ef15-fcb8-42bf-b035-9c55e2091228 closing the composer using the "X" in the upper right corner after saving a web page I created. 0 seamonkey.exe nsHTMLAnchorElement::UnbindFromTree content/html/content/src/nsHTMLAreaElement.cpp:240 1 seamonkey.exe nsElementDeletionObserver::NodeWillBeDestroyed editor/libeditor/html/nsHTMLAnonymousUtils.cpp:130 2 seamonkey.exe nsNodeUtils::LastRelease content/base/src/nsNodeUtils.cpp:196 3 seamonkey.exe nsGenericDOMDataNode::Release content/base/src/nsGenericElement.cpp:4124 4 seamonkey.exe XPCJSRuntime::GCCallback js/src/xpconnect/src/xpcjsruntime.cpp:775 5 jsd3250.dll jsds_GCCallbackProc js/jsd/jsd_xpc.cpp:531 6 seamonkey.exe DOMGCCallback dom/src/base/nsJSEnvironment.cpp:3692 7 seamonkey.exe XPCCycleCollectGCCallback js/src/xpconnect/src/nsXPConnect.cpp:411 8 js3250.dll js_GC js/src/jsgc.cpp:3792 9 js3250.dll JS_GC js/src/jsapi.cpp:2458 10 seamonkey.exe nsXPConnect::Collect js/src/xpconnect/src/nsXPConnect.cpp:477 11 xpcom_core.dll nsCycleCollector::Collect xpcom/base/nsCycleCollector.cpp:2386 12 xpcom_core.dll nsCycleCollector_collect xpcom/base/nsCycleCollector.cpp:3045 13 seamonkey.exe nsJSContext::CC dom/src/base/nsJSEnvironment.cpp:3512 14 seamonkey.exe GCTimerFired dom/src/base/nsJSEnvironment.cpp:3620 15 xpcom_core.dll nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:420 16 xpcom_core.dll nsTimerEvent::Run xpcom/threads/nsTimerImpl.cpp:512
nsElementDeletionObserver::NodeWillBeDestroyed always seems tzo be the caller to nsHTMLAnchorElement::UnbindFromTree there. This is the #2 topcrash for SeaMonkey 2.0.2, happening cross-platform, and it's also #159 on the Firefox 3.5.7 topcrash list, this very much seems to be core code. Many people seem to report, not surprisingly, as editor/ code is involved, being in an HTML form or editor of some kind when they crash. bug 533061 sounds similar and is on the Thunderbird 3.0.1 topcrash list.
Links to lists of reports for this signature: http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=nsHTMLAnchorElement%3A%3AUnbindFromTree%28int%2C%20int%29&version=SeaMonkey%3A2.0.2 http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=nsHTMLAnchorElement%3A%3AUnbindFromTree%28int%2C%20int%29&version=Firefox%3A3.5.7 Many of those report 0x0 as address, which already sounds fishy to me, even though I don't really know C++ much...
so, the 0x0 makes sense. This code doesn't exist on trunk.
Created attachment 424981 [details] [diff] [review] proposal So, the other parts of this file null check GetCurrentDoc(), and the function naming implies it could return null, so here it presumably did....
Comment on attachment 424981 [details] [diff] [review] proposal Yeah, this is unfortunate, but needed.
Created attachment 425017 [details] [diff] [review] for 1.9.1 only so, the patch i posted belongs in bug 533061. the reason they look the same and that i posted that one here is that in 1.9.1 the compiler code folded them so they shared code and thus line numbers, because it was the same code. But this specific crash only exists in 1.9.1, whereas the other one exists in both places.
related to bug 480300?
Comment on attachment 425017 [details] [diff] [review] for 1.9.1 only Approved for 18.104.22.168, a=dveditz for release-drivers
There doesn't seem to be anything for QA to do here for 1.9.1 verification.