603938 - Crash on startup nsDocument::ResetToURI | nsHTMLDocument::ResetToURI | nsContentDLF::CreateBlankDocument

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect, P5)

Description

[Jonathan Chang]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-us) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5
Build Identifier: Firefox 4.0b6

Firefox crashes on startup on Mac OS X 10.6.4 x86, even in safe mode. Profile manager won't start either. 

Reproducible: Always

Steps to Reproduce:
1. Start Firefox.
Actual Results:  
Crash reporter appears.

Expected Results:  
Firefox should open.

Some crash IDs:

bp-13414ed9-83ca-4441-8541-338292101013
bp-4608b94b-ce6c-4f22-a44e-973032101013
bp-7871a964-d56d-4094-b2d8-11b672101013
bp-807a0e5d-a545-4bdb-b386-b5a672101013
bp-c1023e7a-9dc8-4201-94a1-a7f312101013
bp-ee9c7b46-370a-483a-932b-658a32101013

Comment 1

[timeless]

Signature	nsDocument::ResetToURI
UUID	13414ed9-83ca-4441-8541-338292101013
Time 	2010-10-13 06:11:18.984904
Uptime	3
Last Crash	44486 seconds (12.4 hours) before submission
Install Age	2340159 seconds (3.9 weeks) since version was first installed.
Product	Firefox
Version	4.0b6
Build ID	20100914072643
Branch	2.0
OS	Mac OS X
OS Version	10.6.4 10F569
CPU	x86
CPU Info	family 6 model 28 stepping 2
Crash Reason	EXC_BAD_ACCESS / 0x0000000d
Crash Address	0x2
User Comments	startup
Processor Notes 	
EMCheckCompatibility	False
Related Bugs

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	nsDocument::ResetToURI 	content/base/src/mozAutoDocUpdate.h:66
1 	XUL 	nsHTMLDocument::ResetToURI 	content/html/document/src/nsHTMLDocument.cpp:337
2 	XUL 	nsContentDLF::CreateBlankDocument 	layout/build/nsContentDLF.cpp:389
3 	XUL 	nsDocShell::CreateAboutBlankContentViewer 	docshell/base/nsDocShell.cpp:6405
4 	XUL 	nsDocShell::EnsureContentViewer 	docshell/base/nsDocShell.cpp:6328
5 	XUL 	nsDocShell::GetInterface 	docshell/base/nsDocShell.cpp:883
6 	XUL 	nsGetInterface::operator 	nsIInterfaceRequestorUtils.cpp:52
7 	XUL 	nsCOMPtr_base::assign_from_helper 	nsCOMPtr.cpp:150
8 	XUL 	nsGlobalWindow::GetDocument 	
9 	XUL 	nsOuterWindowSH::PreCreate 	.h:332
10 	XUL 	XPCWrappedNative::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednative.cpp:434
11 	XUL 	XPCConvert::NativeInterface2JSObject 	js/src/xpconnect/src/xpcconvert.cpp:1238
12 	XUL 	XPCConvert::NativeData2JS 	js/src/xpconnect/src/xpcconvert.cpp:473
13 	XUL 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcprivate.h:3176
14 	XUL 	XPC_WN_GetterSetter 	js/src/xpconnect/src/xpcprivate.h:2573
15 	XUL 	js::InvokeCommon<JSBool > 	js/src/jscntxtinlines.h:554
16 	XUL 	js::Invoke 	js/src/jsinterp.cpp:696
17 	XUL 	js::InternalInvoke 	js/src/jsinterp.cpp:736
18 	XUL 	js::InternalGetOrSet 	js/src/jsinterp.h:651
19 	XUL 	js_NativeGet 	js/src/jsscopeinlines.h:306
20 	XUL 	js_GetPropertyHelper 	js/src/jsobj.cpp:4853
21 	XUL 	js::Interpret 	js/src/jsinterp.cpp:4005
22 	XUL 	js::InvokeCommon<JSBool > 	js/src/jsinterp.cpp:577
23 	XUL 	js::Invoke 	js/src/jsinterp.cpp:696
24 	XUL 	js::InternalInvoke 	js/src/jsinterp.cpp:736
25 	XUL 	JS_CallFunctionValue 	js/src/jsinterp.h:651
26 	XUL 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1688
27 	XUL 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:570
28 	XUL 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
29 	XUL 	nsXPTCStubBase::Stub3 	xptcstubsdef.inc:1
30 	XUL 	nsDocLoader::FireOnStateChange 	uriloader/base/nsDocLoader.cpp:1334
31 	XUL 	nsDocLoader::FireOnStateChange 	uriloader/base/nsDocLoader.cpp:1341
32 	XUL 	nsDocLoader::OnStartRequest 	uriloader/base/nsDocLoader.cpp:851
33 	XUL 	nsLoadGroup::AddRequest 	netwerk/base/src/nsLoadGroup.cpp:595
34 	XUL 	nsJARChannel::AsyncOpen 	modules/libjar/nsJARChannel.cpp:715
35 	XUL 	nsURILoader::OpenURI 	uriloader/base/nsURILoader.cpp:863
36 	XUL 	nsDocShell::DoChannelLoad 	docshell/base/nsDocShell.cpp:8881
37 	XUL 	nsDocShell::DoURILoad 	docshell/base/nsDocShell.cpp:8723
38 	XUL 	nsDocShell::InternalLoad 	docshell/base/nsDocShell.cpp:8393
39 	XUL 	nsDocShell::LoadURI 	docshell/base/nsDocShell.cpp:1415
40 	XUL 	nsDocShell::LoadURI 	docshell/base/nsDocShell.cpp:3678
41 	XUL 	nsWebShellWindow::Initialize 	xpfe/appshell/src/nsWebShellWindow.cpp:253
42 	XUL 	nsAppShellService::JustCreateTopWindow 	xpfe/appshell/src/nsAppShellService.cpp:442
43 	XUL 	nsAppShellService::CreateHiddenWindow 	xpfe/appshell/src/nsAppShellService.cpp:182
44 	XUL 	nsAppStartup::CreateHiddenWindow 	toolkit/components/startup/src/nsAppStartup.cpp:160
45 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3591
46 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
47 	firefox-bin 	firefox-bin@0xbe5 	
48 		@0x1

Comment 2

[Wayne Mery (:wsmwk)]

Jonathan, do you still see this crash?

windows signature is nsDocument::ResetToURI(nsIURI*, nsILoadGroup*, nsIPrincipal*), eg bp-e1590784-18cd-4cda-9545-560502120225

Comment 3

[Jonathan Chang]

I currently don't have access to the laptop that had this crash. I'll try to get a hold of it next week. I saved a copy of the profile that crashed, but I might have deleted it. In any case the problem was solved by creating a clean profile.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Jonathan Chang from comment #3)
> I currently don't have access to the laptop that had this crash. I'll try to
> get a hold of it next week. I saved a copy of the profile that crashed, but
> I might have deleted it. In any case the problem was solved by creating a
> clean profile.

thanks for the update.
crash still occurs, so leaving bug open?

bp-3a58de1f-3908-49bf-bcb2-4bd2d2120307 v10
bp-980efa80-faa0-4b96-8c7d-38ee62120303 v13

Comment 5

[Wayne Mery (:wsmwk)]

based on a random sampling of ~15 crashes, the final source lines vary for this crash sig.
but there are couple few themes. examples...

most common, approximately half of crashes
2138 // Reset our stylesheets
2139 ResetStylesheetsToURI(aURI); 
bp-3a58de1f-3908-49bf-bcb2-4bd2d2120307 (cited in comment 4)
bp-67fd578e-c3b8-4fca-bdfd-201f62130220 FF19
bp-3ca61e9a-8b75-4cec-aaaa-080022130220 FF19 beta
bp-cb82b4eb-b568-416f-b084-351a12130220 FF18.0.2 (193seconds, not a startup crash)
bp-235c8764-003a-4944-904a-d25172130220 FF19.0.2 same user, about:sessionstore
bp-1e06a22e-c482-4c4d-963e-fcd252130207 TB17.0.2

20% of crashes...
1998 // Now get our new principal
1999 if (aPrincipal) {
2000 SetPrincipal(aPrincipal); 
bp-21cde9e3-4eec-4f63-88d4-724212130218 FF19 beta
bp-1963072a-137f-4bac-bb6a-ffb3c2130218 FF19 beta  (darcym)

10% of crashes if these two are related (crash is at different source lines), is NOT a startup crash
2203 nsContentUtils::GetSecurityManager();
2204 if (securityManager) { 
bp-163b67a6-d05f-4825-930a-f4e1f2130216 TB17.0 is line 2204
bp-e9eaff1b-cf18-4c6f-baa6-8328d2130215 FF19   is line 2203


solitary examples - only one crash for the source line in the sample set ...

2102 nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup,
2103 nsIPrincipal* aPrincipal)
2104 { 
bp-7a2b81e4-602e-4cf3-ab98-c38fc2121227 TB17

justin@59194 2174 // Clear the original URI so SetDocumentURI sets it.
ayg@106838   2175 mOriginalURI = nullptr;
justin@59194 2176
hg@1         2177 SetDocumentURI(aURI); 
bp-2364c82a-f989-4b78-bb87-c025b2130216

the source line for this next crash is just below the source line of the example above, but note, stack does NOT match the other crashes
bobbyholley@88681 1960 // Release our principal after tearing down the document, rather than before.
...
ayg@103959 1964 SetPrincipal(nullptr); 
bp-2b5f2495-f11d-4192-a523-ee59c2130126 FF20.0a2

Comment 6

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.