54747 - <tabcontrol><tabbox> crashes in nsXBLPrototypeBinding::LocateInstance

Status: VERIFIED FIXED

(Core :: XBL, defect, P3)

Description

[John Morrison]

per bug 53116, there is a crash when you do "Tasks -> Privacy & Security ->
Cookie Manager -> View Stored Cookies" with the **trunk** windows build
2000-09-29-M18. This does not occur on the branch.

The crash occurs in nsXBLPrototypeBinding::LocateInstance according to 
talkback, which is new code that hyatt put on the trunk. This is however
code that we very likely want to land on the branch after nsbeta3, as it
produces some very big improvements in mailnews performance. 

Steps to reproduce:
1) with a trunk build, do 'Tasks -> Privacy & Security ->
   Cookie Manager -> View Stored Cookies' 

2) crash

Nominating rtm and setting bug 53417 dependent on this bug. If this is to
be landed on the branch, we need to solve this crash.

Talkback stack trace:

nsXBLPrototypeBinding::LocateInstance 
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLPrototypeBinding.cpp, line 
528] 
nsXBLPrototypeBinding::GetSingleInsertionPoint 
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLPrototypeBinding.cpp, line 
447] 
nsXBLBinding::GetSingleInsertionPoint 
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLBinding.cpp, line 1407] 
nsXBLService::GetContentList 
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLService.cpp, line 725] 
nsCSSFrameConstructor::CreateAnonymousFrames 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 5287] 
nsCSSFrameConstructor::ConstructXULFrame 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 6162] 
nsCSSFrameConstructor::ConstructFrameInternal 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 7530] 
nsCSSFrameConstructor::ConstructFrameInternal 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 7503] 
nsCSSFrameConstructor::ConstructFrame 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 7441] 
nsCSSFrameConstructor::ContentInserted 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 8791] 
StyleSetImpl::ContentInserted 
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1147] 
PresShell::ContentInserted 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 3678] 
nsXBLBindingRequest::DocumentLoaded 
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLService.cpp, line 157] 
nsXBLStreamListener::Load 
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLService.cpp, line 375] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
1325] 
nsDocument::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 3046] 
nsXMLDocument::EndLoad 
[d:\builds\seamonkey\mozilla\layout\xml\document\src\nsXMLDocument.cpp, line 
623] 
nsXMLContentSink::DidBuildModel 
[d:\builds\seamonkey\mozilla\layout\xml\document\src\nsXMLContentSink.cpp, line 
273] 
CWellFormedDTD::DidBuildModel 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 315] 
nsParser::DidBuildModel 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1426] 
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 1941] 
nsParser::OnStopRequest 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2390] 
nsXBLStreamListener::OnStopRequest 
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLService.cpp, line 284] 
nsJARChannel::OnStopRequest 
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 
703] 
nsOnStopRequestEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
302] 
nsStreamListenerEvent::HandlePLEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
106] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 576] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 512] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 1046]

Comment 1

[Luke]

*** Bug 54733 has been marked as a duplicate of this bug. ***

Comment 2

[Blake Ross]

*** Bug 54494 has been marked as a duplicate of this bug. ***

Comment 3

[Blake Ross]

So, Bookmarks Properties crashes also (bug 54494), and so does the About dialog 
when I set it to be modal from the debug prefs.  Seems like any dialog with a 
<tabcontrol> will crash, doing further testing to confirm this...

Comment 4

[Blake Ross]

Attachment: testcase

Comment 5

[Blake Ross]

attached a testcase which crashes for me (same stack).  contents of it are:

<?xml version="1.0"?>
<window xmlns:html="http://www.w3.org/1999/xhtml"
        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<?xml-stylesheet href="chrome://communicator/skin/" type="text/css"?>
 <tabcontrol>
  <tabbox>
  </tabbox>
 </tabcontrol>
</window>

doesn't crash without the <tabbox></tabbox>

Comment 6

[Blake Ross]

cc'ing beppe because if you have the edit mode toolbar (which consists of tabs) 
shown in Composer, Composer crashes upon opening.

also: note that this seems to be a classic-only problem, as far as I can tell.  
Or did you see this in modern also, John?

Comment 7

[John Morrison]

Yes, this appears to be in Classic only, for the shared Classic skin for win32
and linux. I don't see it in (mac/linux/win32)+Modern, or in Mac Classic, for
builds on the trunk.

Comment 8

[Blake Ross]

*** Bug 54843 has been marked as a duplicate of this bug. ***

Comment 9

[Blake Ross]

*** Bug 54846 has been marked as a duplicate of this bug. ***

Comment 10

[David Hyatt]

This is a dup of a bugscape bug that has been rtm+.  danm has a patch.  
reassigning to him.

Comment 11

[Dan M]

GetInsertionPoint wanted a guard against null entries in the insertion point 
table.

Comment 12

[Blake Ross]

*** Bug 54951 has been marked as a duplicate of this bug. ***

Comment 13

[lchiang]

Does this happen in the branch builds (after 9-29)?
This is marked fixed - is this fixed for branch?

Thanks.

Comment 14

[John Morrison]

The code that could result in the crash has never been landed on the branch.
So this is neither fixed nor broken on the branch. (I'm feeling dizzy).

Comment 15

[Blake Ross]

well, hold on.  kin said he's positive he sees (or saw) bug 54951 in a branch 
build, and said someone else did also.  what's going on?  was 53417 snuck into 
the branch?

Comment 16

[Dan M]

John is correct. At time of writing, there is no nsXBLPrototypeBinding object in 
the Netscape_20000922_BRANCH, so the stack trace given in bug 54951 had to come 
from the trunk.

Comment 17

[Blake Ross]

*** Bug 55118 has been marked as a duplicate of this bug. ***

Comment 18

[lchiang]

Thanks.  This should be verified in the trunk only then.  I just got confused 
since it was nominated for rtm :-)

Comment 19

[Blake Ross]

Let's just verify this in the trunk and the branch, since (although this got 
fixed first), 53417 was just fixed in the branch also.

Comment 20

[Dan M]

  Har. Yup, the code that caused this bug has now been moved to Netscape's rtm 
branch as well. So while we expect that this trunk fix will never be a problem on 
the branch, it now deserves verification there, too.

Comment 21

[Matthias Versen [:Matti]]

*** Bug 60177 has been marked as a duplicate of this bug. ***

Comment 22

[Matthias Versen [:Matti]]

*** Bug 60177 has been marked as a duplicate of this bug. ***

Comment 23

[John Morrison]

verified fixed (and dead, and I suck).