Closed Bug 540953 Opened 13 years ago Closed 13 years ago

crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]


(Core :: DOM: Core & HTML, defect)

1.9.1 Branch
Not set



Tracking Status
status1.9.1 --- .9-fixed


(Reporter: wsmwk, Assigned: timeless)


(Keywords: crash, topcrash)

Crash Data


(1 file, 1 obsolete file)

#2 crash for SM 2.0.2
crash [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]

a few comments include:
editing a simple html file 
PAting text into Composer
pasting without format 
closing windows, email, main window - then crash
closing the composer using the "X" in the upper right corner after saving a web page I created.

closing the composer using the "X" in the upper right corner after saving a web page I created.
0	seamonkey.exe	nsHTMLAnchorElement::UnbindFromTree	 content/html/content/src/nsHTMLAreaElement.cpp:240
1	seamonkey.exe	nsElementDeletionObserver::NodeWillBeDestroyed	editor/libeditor/html/nsHTMLAnonymousUtils.cpp:130
2	seamonkey.exe	nsNodeUtils::LastRelease	content/base/src/nsNodeUtils.cpp:196
3	seamonkey.exe	nsGenericDOMDataNode::Release	content/base/src/nsGenericElement.cpp:4124
4	seamonkey.exe	XPCJSRuntime::GCCallback	js/src/xpconnect/src/xpcjsruntime.cpp:775
5	jsd3250.dll	jsds_GCCallbackProc	js/jsd/jsd_xpc.cpp:531
6	seamonkey.exe	DOMGCCallback	dom/src/base/nsJSEnvironment.cpp:3692
7	seamonkey.exe	XPCCycleCollectGCCallback	js/src/xpconnect/src/nsXPConnect.cpp:411
8	js3250.dll	js_GC	js/src/jsgc.cpp:3792
9	js3250.dll	JS_GC	js/src/jsapi.cpp:2458
10	seamonkey.exe	nsXPConnect::Collect	js/src/xpconnect/src/nsXPConnect.cpp:477
11	xpcom_core.dll	nsCycleCollector::Collect	xpcom/base/nsCycleCollector.cpp:2386
12	xpcom_core.dll	nsCycleCollector_collect	xpcom/base/nsCycleCollector.cpp:3045
13	seamonkey.exe	nsJSContext::CC	dom/src/base/nsJSEnvironment.cpp:3512
14	seamonkey.exe	GCTimerFired	dom/src/base/nsJSEnvironment.cpp:3620
15	xpcom_core.dll	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:420
16	xpcom_core.dll	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:512
nsElementDeletionObserver::NodeWillBeDestroyed always seems tzo be the caller to nsHTMLAnchorElement::UnbindFromTree there.

This is the #2 topcrash for SeaMonkey 2.0.2, happening cross-platform, and it's also #159 on the Firefox 3.5.7 topcrash list, this very much seems to be core code. Many people seem to report, not surprisingly, as editor/ code is involved, being in an HTML form or editor of some kind when they crash.

bug 533061 sounds similar and is on the Thunderbird 3.0.1 topcrash list.
Component: Composer → Editor
Product: SeaMonkey → Core
QA Contact: composer → editor
Version: SeaMonkey 2.0 Branch → 1.9.1 Branch
so, the 0x0 makes sense.

This code doesn't exist on trunk.
Assignee: nobody → timeless
Component: Editor → DOM: Core & HTML
QA Contact: editor → general
Attached patch proposal (obsolete) — Splinter Review
So, the other parts of this file null check GetCurrentDoc(), and the function naming implies it could return null, so here it presumably did....
Attachment #424981 - Flags: review?(Olli.Pettay)
Comment on attachment 424981 [details] [diff] [review]

Yeah, this is unfortunate, but needed.
Attachment #424981 - Flags: review?(Olli.Pettay) → review+
Attached patch for 1.9.1 onlySplinter Review
so, the patch i posted belongs in bug 533061. the reason they look the same and that i posted that one here is that in 1.9.1 the compiler code folded them so they shared code and thus line numbers, because it was the same code.

But this specific crash only exists in 1.9.1, whereas the other one exists in both places.
Attachment #424981 - Attachment is obsolete: true
Attachment #425017 - Flags: review+
Attachment #425017 - Flags: approval1.9.1.9?
related to bug 480300?
Comment on attachment 425017 [details] [diff] [review]
for 1.9.1 only

Approved for, a=dveditz for release-drivers
Attachment #425017 - Flags: approval1.9.1.9? → approval1.9.1.9+
Closed: 13 years ago
Resolution: --- → FIXED
There doesn't seem to be anything for QA to do here for 1.9.1 verification.
Crash Signature: [@ nsHTMLAnchorElement::UnbindFromTree(int, int)]
You need to log in before you can comment on or make changes to this bug.