579782 - crash in [@ nsGlobalWindow::SetDocShell(nsIDocShell*) ]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[baffclan]

If click a "javascript:window.close();", crash in [@ nsGlobalWindow::SetDocShell(nsIDocShell*) ] 
Mozilla/5.0 (Windows; Windows NT 5.1; en-US; rv:2.0b2pre) Gecko/20100718 Minefield/4.0b2pre

bp-40421714-a4de-497b-8462-dcd232100718
bp-4c131409-4af4-4a31-9254-2a8682100718

Comment 1

[timeless]

Signature	nsGlobalWindow::SetDocShell(nsIDocShell*)
UUID	40421714-a4de-497b-8462-dcd232100718
Time 	2010-07-18 14:16:33.801020
Uptime	72
Last Crash	78 seconds before submission
Install Age	694 seconds (11.6 minutes) since version was first installed.
Product	Firefox
Version	4.0b2pre
Build ID	20100718041115
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 6 model 8 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
User Comments	
Processor Notes 	
EMCheckCompatibility	False
Related Bugs

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsGlobalWindow::SetDocShell 	dom/base/nsGlobalWindow.cpp:2167
1 	xul.dll 	nsDocShell::Destroy 	docshell/base/nsDocShell.cpp:4368
2 	xul.dll 	nsFrameLoader::Finalize 	content/base/src/nsFrameLoader.cpp:458
3 	xul.dll 	nsDocument::MaybeInitializeFinalizeFrameLoaders 	content/base/src/nsDocument.cpp:5154
4 	xul.dll 	nsRunnableMethodImpl<void 	obj-firefox/dist/include/nsThreadUtils.h:347
5 	xul.dll 	nsContentUtils::RemoveScriptBlocker 	content/base/src/nsContentUtils.cpp:4643
6 	xul.dll 	nsXBLBinding::ChangeDocument 	content/xbl/src/nsXBLBinding.cpp:1200
7 	xul.dll 	nsBindingManager::RemovedFromDocumentInternal 	content/xbl/src/nsBindingManager.cpp:648
8 	xul.dll 	nsBindingManager::RemovedFromDocument 	obj-firefox/dist/include/nsBindingManager.h:98
9 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3781
10 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3792
11 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3792
12 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3792
13 	xul.dll 	nsDocument::Destroy 	content/base/src/nsDocument.cpp:6750
14 	xul.dll 	DocumentViewerImpl::Destroy 	layout/base/nsDocumentViewer.cpp:1591
15 	xul.dll 	nsDocShell::Destroy 	docshell/base/nsDocShell.cpp:4357
16 	xul.dll 	nsXULWindow::Destroy 	xpfe/appshell/src/nsXULWindow.cpp:517
17 	xul.dll 	nsWebShellWindow::Destroy 	xpfe/appshell/src/nsWebShellWindow.cpp:788
18 	xul.dll 	nsWebShellWindow::HandleEvent 	
19 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3537
20 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3575
21 	xul.dll 	nsWindow::DispatchStandardEvent 	widget/src/windows/nsWindow.cpp:3568
22 	xul.dll 	xul.dll@0x4301f9 	
23 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:4310
24 	user32.dll 	InternalCallWinProc

Comment 2

[Boris Zbarsky [:bzbarsky]]

mContext seems to be null.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

This should be the last one. I guess that shutdown is a little loose wrt order of calls.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/bc650e77bc23

Comment 5

[baffclan]

Cannot reproduce on Firefox-trunk/WinXP

Mozilla/5.0 (Windows; Windows NT 5.1; rv:2.0b3pre) Gecko/20100724 Minefield/4.0b2pre

Comment 6

[chris hofmann]

the #2 top crash on 4.0b2 has this signature.  wonder if that is a different bug, or if the fix didn't make it into beta 2?

Comment 8

[chris hofmann]

(In reply to comment #6)
> the #2 top crash on 4.0b2 has this signature.  wonder if that is a different
> bug, or if the fix didn't make it into beta 2?

yeah,  looks like b2 builds were created on the 20th and blake's checkin comment is on the 22cd, so this bug,  Bug 583573, and bug 584447, should be fixed in beta3.