Closed Bug 619287 Opened 15 years ago Closed 14 years ago

crash [@ nsEditor::CreateTxnForDeleteCharacter(nsIDOMCharacterData*, unsigned int, short, DeleteTextTxn**) ]

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression)

Crash Data

It is a new crash signature that appeared in 3.6.13 and 4.0b8pre builds. Signature nsEditor::CreateTxnForDeleteCharacter(nsIDOMCharacterData*, unsigned int, short, DeleteTextTxn**) UUID a2c0c586-3974-47bc-9d52-649532101213 Time 2010-12-13 20:12:28.735824 Uptime 17511 Last Crash 530383 seconds (6.1 days) before submission Install Age 144639 seconds (1.7 days) since version was first installed. Product Firefox Version 3.6.13 Build ID 20101203075014 Branch 1.9.2 OS Windows NT OS Version 5.1.2600 Service Pack 3 CPU x86 CPU Info GenuineIntel family 15 model 3 stepping 4 Crash Reason EXCEPTION_ACCESS_VIOLATION_WRITE Crash Address 0x0 Frame Module Signature [Expand] Source 0 xul.dll nsEditor::CreateTxnForDeleteCharacter editor/libeditor/base/nsEditor.cpp:4900 1 xul.dll nsEditor::DeleteSelectionImpl editor/libeditor/base/nsEditor.cpp:4455 2 xul.dll nsTextEditRules::WillDeleteSelection More reports at: http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsEditor%3A%3ACreateTxnForDeleteCharacter%28nsIDOMCharacterData*%2C%20unsigned%20int%2C%20short%2C%20DeleteTextTxn**%29
This should be a regression from bug 604332, because that's the only editor related thing landed for 1.9.2.13.
Blocks: 604332
...except that I really can't see how adding a new string check could trigger a crash, and the stacks are only misleading...
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [a2c0c586-3974-47bc-9d52-649532101213.dmp] User Mini Dump File: Only registers, stack and portions of memory are available Symbol search path is: srv*c:\symbols*http://symbols.mozilla.org/firefox;srv*c:\symbols*http://symbols.mozilla.org/thunderbird;srv* Executable search path is: Windows XP Version 2600 (Service Pack 3) UP Free x86 compatible Product: WinNt, suite: SingleUserTS Personal Machine Name: Debug session time: Tue Dec 14 06:12:20.000 2010 (UTC + 2:00) System Uptime: not available Process Uptime: 0 days 4:51:53.000 ................................................................ ..................... This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (16a4.828): Access violation - code c0000005 (first/second chance not available) eax=0000f0a0 ebx=00000000 ecx=c0000005 edx=00000000 esi=00000074 edi=00000000 eip=7c90e514 esp=0012ea28 ebp=0012ea8c iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246 ntdll!KiFastSystemCallRet: 7c90e514 c3 ret 0:000> .sympath Symbol search path is: srv*c:\symbols*http://symbols.mozilla.org/firefox;srv*c:\symbols*http://symbols.mozilla.org/thunderbird;srv* Expanded Symbol search path is: srv*c:\symbols*http://symbols.mozilla.org/firefox;srv*c:\symbols*http://symbols.mozilla.org/thunderbird;cache*;SRV*http://msdl.microsoft.com/download/symbols 0:000> .reload /f .... Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. ......................Unable to load image C:\WINDOWS\system32\shlwapi.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for shlwapi.dll ......................Unable to load image C:\WINDOWS\system32\wshtcpip.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for wshtcpip.dll .Unable to load image C:\WINDOWS\system32\iphlpapi.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for iphlpapi.dll .......Unable to load image C:\Program Files\Bonjour\mdnsNSP.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for mdnsNSP.dll *** ERROR: Module load completed but symbols could not be loaded for mdnsNSP.dll .Unable to load image C:\WINDOWS\system32\xpsp2res.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for xpsp2res.dll *** ERROR: Module load completed but symbols could not be loaded for xpsp2res.dll ..Unable to load image C:\WINDOWS\system32\urlmon.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for urlmon.dll .Unable to load image C:\WINDOWS\system32\iertutil.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for iertutil.dll .... *** WARNING: Unable to verify checksum for softokn3.dll .*** WARNING: Unable to verify checksum for nssdbm3.dll .*** WARNING: Unable to verify checksum for freebl3.dll .....Unable to load image C:\WINDOWS\system32\msasn1.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for msasn1.dll ..Unable to load image C:\WINDOWS\system32\wininet.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for wininet.dll .Unable to load image C:\WINDOWS\system32\normaliz.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for normaliz.dll *** ERROR: Module load completed but symbols could not be loaded for normaliz.dll .Unable to load image C:\WINDOWS\system32\wintrust.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for wintrust.dll ..Unable to load image C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll, Win32 error 0n2 *** WARNING: Unable to verify timestamp for NPSWF32.dll *** ERROR: Module load completed but symbols could not be loaded for NPSWF32.dll ........ 0:000> lm start end module name 00280000 002fb000 sqlite3 (private pdb symbols) c:\symbols\sqlite3.pdb\1BAFC49C00004BCB9A2A4A4E111D39321\sqlite3.pdb 00300000 003fa000 js3250 (private pdb symbols) c:\symbols\js3250.pdb\69F17842AE164654A7D27C2518CB49612\js3250.pdb 00400000 004e0000 firefox (private pdb symbols) c:\symbols\firefox.pdb\5F0662B9EA55440192592EA0466AA8412\firefox.pdb 004e0000 00511000 nspr4 (private pdb symbols) c:\symbols\nspr4.pdb\F787D7B9247241689CD65A164D69241F1\nspr4.pdb 00520000 00538000 smime3 (private pdb symbols) c:\symbols\smime3.pdb\170D36FCB90B4E06A2D577C8E6E68AE41\smime3.pdb 00540000 005dd000 nss3 (private pdb symbols) c:\symbols\nss3.pdb\CFCECAA4E5D7442F81E09CA566EE4E6B1\nss3.pdb 005e0000 005f4000 nssutil3 (private pdb symbols) c:\symbols\nssutil3.pdb\7188D66E46CB4697BAF0D94FF049E7FD1\nssutil3.pdb 00600000 00607000 plc4 (private pdb symbols) c:\symbols\plc4.pdb\678D7414A7CC489291134EA05B19E7131\plc4.pdb 00610000 00617000 plds4 (private pdb symbols) c:\symbols\plds4.pdb\8885F9ABCC4A4265B2C2FAD0304873681\plds4.pdb 00620000 00641000 ssl3 (private pdb symbols) c:\symbols\ssl3.pdb\C4A53415B93E4A77B69DCEB1063699011\ssl3.pdb 00650000 00657000 xpcom (private pdb symbols) c:\symbols\xpcom.pdb\4DA33B9A17324C4FBF6A44B5040D56B22\xpcom.pdb 01230000 01238000 browserdirprovider (private pdb symbols) c:\symbols\browserdirprovider.pdb\30FCB8D7C7C14D7291D79FEDA233476E2\browserdirprovider.pdb 01450000 01474000 brwsrcmp (private pdb symbols) c:\symbols\brwsrcmp.pdb\CD6EC47D18124B0F97885FA7485220612\brwsrcmp.pdb 02130000 023f5000 xpsp2res T (no symbols) 02f00000 03033000 urlmon T (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\urlmon.pdb\1A568E0A69EF43FEA4C54E5ACDAF94DF2\urlmon.pdb 03560000 03586000 softokn3 C (private pdb symbols) c:\symbols\softokn3.pdb\66C1E41B9EA84B23B4D01CDDECFE070B1\softokn3.pdb 03590000 035a8000 nssdbm3 C (private pdb symbols) c:\symbols\nssdbm3.pdb\6E438EB5AA08487482E4B11A7EEE864C1\nssdbm3.pdb 035b0000 035f1000 freebl3 C (private pdb symbols) c:\symbols\freebl3.pdb\2CE8BA54C37244EBB3E940C8515F896A1\freebl3.pdb 03ca0000 03cf2000 nssckbi (private pdb symbols) c:\symbols\nssckbi.pdb\5248B37A3C4F46DF8C9A4E96ED8E7CCA1\nssckbi.pdb 04670000 04679000 normaliz T (no symbols) 06b00000 070d2000 NPSWF32 T (no symbols) 10000000 10b55000 xul (private pdb symbols) c:\symbols\xul.pdb\CE2DF3F0B6EE465A9E403E5F147CEF692\xul.pdb 3d930000 3da16000 wininet T (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\wininet.pdb\FD4687FC94A24A839D3978FA33AA7F6D2\wininet.pdb 3dfd0000 3e1b8000 iertutil T (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\iertutil.pdb\01BC9DFD01714DD592C3A1FB141A79682\iertutil.pdb 59a60000 59b01000 dbghelp (pdb symbols) c:\symbols\dbghelp.pdb\7FA1C63A9BF54470BCA31E35A94F49971\dbghelp.pdb 5ad70000 5ada8000 uxtheme (pdb symbols) c:\symbols\uxtheme.pdb\E99E16308F094767B1F07FB5C3E5E2462\uxtheme.pdb 5b860000 5b8b5000 netapi32 (pdb symbols) c:\symbols\netapi32.pdb\49D4D68E25CA4118A09AA9A66E7390E32\netapi32.pdb 605d0000 605d9000 mslbui (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\MSLBUI.pdb\B20AB895EE6643038694B861D02646971\MSLBUI.pdb 64000000 64025000 mdnsNSP T (no symbols) 662b0000 66308000 hnetcfg (pdb symbols) c:\symbols\HNetCfg.pdb\87332C2BFF6E42FCB89784A1D24EC2711\HNetCfg.pdb 68000000 68036000 rsaenh (pdb symbols) c:\symbols\rsaenh.pdb\893323FC16E048E8943A01E789A49C9B1\rsaenh.pdb 71a50000 71a8f000 mswsock (pdb symbols) c:\symbols\mswsock.pdb\CC64D9118D4E458292AF634D2C79EF662\mswsock.pdb 71a90000 71a98000 wshtcpip T (pdb symbols) c:\symbols\wshtcpip.pdb\DE2E52603FFB406D9052C8D884A1AD722\wshtcpip.pdb 71aa0000 71aa8000 ws2help (pdb symbols) c:\symbols\ws2help.pdb\6049CF5877C54E2AB512ABC1B4B2E7992\ws2help.pdb 71ab0000 71ac7000 ws2_32 (pdb symbols) c:\symbols\ws2_32.pdb\A7605F8695A34329B38DDB8421A004CA2\ws2_32.pdb 71ad0000 71ad9000 wsock32 (pdb symbols) c:\symbols\wsock32.pdb\2B38FE8F84144DACB8A4FD07C05E49FC2\wsock32.pdb 71bf0000 71c03000 samlib (pdb symbols) c:\symbols\samlib.pdb\4BB85DE79B104F1595F96DF1ADAC91C82\samlib.pdb 72d10000 72d18000 msacm32 (pdb symbols) c:\symbols\msacm32.pdb\3B7D82B51\msacm32.pdb 72d20000 72d29000 wdmaud (pdb symbols) c:\symbols\wdmdrv.pdb\CC3EC71E05C44E6595271A6773E15AF21\wdmdrv.pdb 73000000 73026000 winspool (pdb symbols) c:\symbols\winspool.pdb\5199B63B39904A05A517CEE5158071522\winspool.pdb 73b30000 73b45000 mscms (pdb symbols) c:\symbols\mscms.pdb\CCA4C075EBA841D195A0C3BF597CB8112\mscms.pdb 73ce0000 73d01000 t2embed (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\t2embed.pdb\E317B5562BDD4146973BB987D4D7B3F31\t2embed.pdb 73dc0000 73dc3000 lz32 (pdb symbols) c:\symbols\lz32.pdb\3B7D84BD1\lz32.pdb 73f10000 73f6c000 dsound (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\dsound.pdb\E6A70905731741B880582C84083D9E602\dsound.pdb 74720000 7476c000 msctf (pdb symbols) c:\symbols\msctf.pdb\C52F0B4C00E94556AE999F228B0019662\msctf.pdb 74d90000 74dfb000 usp10 (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\usp10.pdb\D4BA2952809F469BB6D1D3AF6B956E6B1\usp10.pdb 754d0000 75550000 cryptui (pdb symbols) c:\symbols\cryptui.pdb\EBC7B38E15F9461D9BBC9317BBB7E8D42\cryptui.pdb 755c0000 755ee000 msctfime (pdb symbols) c:\symbols\msctfime.pdb\602288883AF44453979369233E091E641\msctfime.pdb 76380000 76385000 msimg32 (pdb symbols) c:\symbols\msimg32.pdb\D2E18526D8234F4BB5A85DE12E71DE812\msimg32.pdb 76390000 763ad000 imm32 (pdb symbols) c:\symbols\imm32.pdb\F7A5B5DB13324153B57AAF340C77EA512\imm32.pdb 763b0000 763f9000 comdlg32 (pdb symbols) c:\symbols\comdlg32.pdb\026A6FF770FD4E6186ADBBE96DFFA99C2\comdlg32.pdb 76b40000 76b6d000 winmm (pdb symbols) c:\symbols\winmm.pdb\90FC96D5AD8440A2B14855895BD92ED62\winmm.pdb 76bf0000 76bfb000 psapi (pdb symbols) c:\symbols\psapi.pdb\B9875A55C874489384EA8FB805322C312\psapi.pdb 76c30000 76c5e000 wintrust T (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\wintrust.pdb\8278C4CC6635458BAE3F9277B618F6C22\wintrust.pdb 76c90000 76cb8000 imagehlp (pdb symbols) c:\symbols\imagehlp.pdb\111D199988C249ACA0335F467A6311412\imagehlp.pdb 76d60000 76d79000 iphlpapi T (pdb symbols) c:\symbols\iphlpapi.pdb\9B09F073003F4CA48F9980B3C091448F2\iphlpapi.pdb 76f20000 76f47000 dnsapi # (pdb symbols) c:\symbols\dnsapi.pdb\8ECFCEE0D6814F54A2EEBA1F19DCE7412\dnsapi.pdb 76f60000 76f8c000 wldap32 (pdb symbols) c:\symbols\wldap32.pdb\AC04BCF6FF294FCEAC8B8D937CBA3A172\wldap32.pdb 76fb0000 76fb8000 winrnr (pdb symbols) c:\symbols\winrnr.pdb\9FE1A4669B69400FAC821A4367AA9CC52\winrnr.pdb 76fc0000 76fc6000 rasadhlp (pdb symbols) c:\symbols\rasadhlp.pdb\CCA669B1582847D0B330D7ABDB446A472\rasadhlp.pdb 76fd0000 7704f000 clbcatq (pdb symbols) c:\symbols\clbcatq.pdb\8AE9C54730824764AAF39EA69F8D87582\clbcatq.pdb 77050000 77115000 comres (pdb symbols) c:\symbols\COMRes.pdb\A02453A3EB42413FBFF95326893E977Df\COMRes.pdb 77120000 771ab000 oleaut32 (pdb symbols) c:\symbols\oleaut32.pdb\F2A209009B694EFCAD1A6CE9D992EBC12\oleaut32.pdb 773d0000 774d3000 comctl32 (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\MicrosoftWindowsCommon-Controls-6.0.2600.6028-comctl32.pdb\E882C2C890724D598449E20A4FE6F07C1\MicrosoftWindowsCommon-Controls-6.0.2600.6028-comctl32.pdb 774e0000 7761e000 ole32 (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\ole32.pdb\0E73207536D64E9C9FB83C682ED9E5852\ole32.pdb 77690000 776b1000 ntmarta (pdb symbols) c:\symbols\ntmarta.pdb\EB9B3E21F92F4F51AD85D86F4D7741A82\ntmarta.pdb 77920000 77a13000 setupapi (pdb symbols) c:\symbols\setupapi.pdb\9D52182415AA4179960B37F4C694F90D2\setupapi.pdb 77a80000 77b15000 crypt32 (pdb symbols) c:\symbols\crypt32.pdb\3D2E43BF4FF5446B83957512615FD0942\crypt32.pdb 77b20000 77b32000 msasn1 T (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\msasn1.pdb\1AED0D31142F496E83481A9BF3DEF1A52\msasn1.pdb 77bd0000 77bd7000 midimap (pdb symbols) c:\symbols\midimap.pdb\D9AE872F08744C789E5170943BBBD10D1\midimap.pdb 77be0000 77bf5000 msacm32_77be0000 (pdb symbols) c:\symbols\msacm32.pdb\8256BD89DE024F3C970B66B9B5E5D8992\msacm32.pdb 77c00000 77c08000 version (pdb symbols) c:\symbols\version.pdb\EA3D1BD3FE65475C8449C8D8B00722962\version.pdb 77c10000 77c68000 msvcrt (pdb symbols) c:\symbols\msvcrt.pdb\7BCF30D8C91B4F1B85FA4E55896250111\msvcrt.pdb 77dd0000 77e6b000 advapi32 (pdb symbols) c:\symbols\advapi32.pdb\F759D3F1C6614313B07C84BC33F02E4D2\advapi32.pdb 77e70000 77f03000 rpcrt4 (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\rpcrt4.pdb\1A465C67828242F28A8C70E3B9D5C4772\rpcrt4.pdb 77f10000 77f59000 gdi32 # (pdb symbols) c:\symbols\gdi32.pdb\372C0F0E08FB456EAB7B4CB2B53E27952\gdi32.pdb 77f60000 77fd6000 shlwapi T (pdb symbols) c:\symbols\shlwapi.pdb\483E8894476B412DABC2FBA7F470E39A2\shlwapi.pdb 77fe0000 77ff1000 secur32 # (pdb symbols) c:\symbols\secur32.pdb\7867B3F28B5C41CE847895E3FC013DC52\secur32.pdb 78130000 781e0000 mozcrt19 (private pdb symbols) c:\symbols\MOZCRT19.pdb\858730465F3145B29B80F27A3951F51D1\MOZCRT19.pdb 7c420000 7c4cf000 mozcpp19 (private pdb symbols) c:\symbols\MOZCPP19.pdb\34C925AE579D4137997D5DA3BCFD97F91\MOZCPP19.pdb 7c800000 7c8f6000 kernel32 (pdb symbols) c:\symbols\kernel32.pdb\072FF0EB54D24DFAAE9D13885486EE092\kernel32.pdb 7c900000 7c9b2000 ntdll (pdb symbols) c:\symbols\ntdll.pdb\6992F4DAF4B144068D78669D6CB5D2072\ntdll.pdb 7c9c0000 7d1d7000 shell32 (pdb symbols) c:\symbols\shell32.pdb\D664FA74256F458FBBCC8D4A941819392\shell32.pdb 7e290000 7e401000 shdocvw (pdb symbols) C:\WinDDK\7600.16385.1\Debuggers\sym\shdocvw.pdb\3E5BFCA8007E450C8448B46876406D7F2\shdocvw.pdb 7e410000 7e4a1000 user32 (pdb symbols) c:\symbols\user32.pdb\D18A41B74E7F458CAAAC1847E2D8BF022\user32.pdb 0:000> !analyze -v -f ERROR: FindPlugIns 8007007b ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* GetPageUrlData failed, server returned HTTP status 404 URL requested: http://watson.microsoft.com/StageOne/firefox_exe/1_9_2_3989/xul_dll/1_9_2_3989/005215cd.htm?Retriage=1 FAULTING_IP: xul!nsEditor::CreateTxnForDeleteCharacter+3 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\editor\libeditor\base\nseditor.cpp @ 4900] 105215cd 249c and al,9Ch EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 105215cd (xul!nsEditor::CreateTxnForDeleteCharacter+0x00000003) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 00000000 Attempt to write to address 00000000 DEFAULT_BUCKET_ID: NULL_POINTER_WRITE PROCESS_NAME: firefox.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 00000000 WRITE_ADDRESS: 00000000 FOLLOWUP_IP: xul!nsEditor::CreateTxnForDeleteCharacter+3 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\editor\libeditor\base\nseditor.cpp @ 4900] 105215cd 249c and al,9Ch MOD_LIST: <ANALYSIS/> FAULTING_THREAD: 00000828 PRIMARY_PROBLEM_CLASS: NULL_POINTER_WRITE BUGCHECK_STR: APPLICATION_FAULT_NULL_POINTER_WRITE LAST_CONTROL_TRANSFER: from 1010de68 to 105215cd STACK_TEXT: 0012f220 1010de68 04535040 00000000 00000000 xul!nsEditor::CreateTxnForDeleteCharacter+0x3 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\editor\libeditor\base\nseditor.cpp @ 4900] 0012f238 1037e343 078a8210 00000002 0012f358 xul!nsTextNode::Release+0x58 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\content\base\src\nstextnode.cpp @ 152] 0012f25c 100be33e 047fb0f0 00000002 0012f350 xul!nsTextEditRules::WillDeleteSelection+0x1d90ea 0012f308 1023934e 08b71280 100ce731 078a8210 xul!nsTextEditRules::WillDoAction+0x19e [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\editor\libeditor\text\nstexteditrules.cpp @ 340] 0012f320 100a3b16 07a29760 084107c0 0012f364 xul!nsRefPtr<nsParser>::~nsRefPtr<nsParser>+0xc [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\obj-firefox\dist\include\nsautoptr.h @ 957] 0012f394 104ae47d 084107c0 00000002 047891d0 xul!nsPlaintextEditor::DeleteSelection+0x146 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\editor\libeditor\text\nsplaintexteditor.cpp @ 753] 0012f3c8 1012b4c3 00000000 078a82d0 0012f4f8 xul!nsTextEditorKeyListener::KeyPress+0x1ce [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\editor\libeditor\text\nseditoreventlisteners.cpp @ 210] 0012f42c 1012ad41 07be5c40 0614d800 0012f6f0 xul!nsEventListenerManager::HandleEvent+0x433 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\content\events\src\nseventlistenermanager.cpp @ 1143] 0012f474 1012af50 01cf65e4 00000206 0012f588 xul!nsEventTargetChainItem::HandleEventTargetChain+0x281 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\content\events\src\nseventdispatcher.cpp @ 312] 0012f4b0 10117418 01cf65e4 00000006 0012f588 xul!nsEventTargetChainItem::HandleEventTargetChain+0x490 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\content\events\src\nseventdispatcher.cpp @ 365] 0012f53c 101f9ab7 05ad4000 0614d800 0012f6f0 xul!nsEventDispatcher::Dispatch+0x478 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\content\events\src\nseventdispatcher.cpp @ 577] 0012f59c 103e351a 0012f6f0 06572940 0012f608 xul!PresShell::HandleEventInternal+0x152 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\layout\base\nspresshell.cpp @ 6525] 0012f5e8 101fe3e1 038b1484 06572940 0012f6f0 xul!PresShell::HandleEvent+0x1e5313 0012f60c 100de755 0012f6f0 0000001e 0000001e xul!nsViewManager::HandleEvent+0x2d [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\view\src\nsviewmanager.cpp @ 1227] 0012f66c 100cb1da 065728e0 0012f6f0 06572940 xul!nsViewManager::DispatchEvent+0x575 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\view\src\nsviewmanager.cpp @ 1211] 0012f698 101915a5 00000000 048a59a0 00000000 xul!HandleEvent+0x10a [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\view\src\nsview.cpp @ 168] 0012f6ac 1019156d 048a59a0 0012f6f0 0012f6c8 xul!nsWindow::DispatchEvent+0x25 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\widget\src\windows\nswindow.cpp @ 2979] 0012f6c0 1072a5c9 00000000 604be187 048a59a0 xul!nsWindow::DispatchWindowEvent+0x13 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\widget\src\windows\nswindow.cpp @ 3008] 0012f750 10729f36 00000083 00000000 00000000 xul!nsWindow::DispatchKeyEvent+0xde [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\widget\src\windows\nswindow.cpp @ 3067] 0012f870 1072a4aa 048a59a0 0012f8ec 0012f89c xul!nsWindow::OnKeyDown+0x540 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\widget\src\windows\nswindow.cpp @ 5727] 0012f8a8 103f257b 048a59a0 0012f8ec 00000000 xul!nsWindow::ProcessKeyDownMessage+0x66 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\widget\src\windows\nswindow.cpp @ 4873] 0012f9b8 100d00e5 00000100 0012fa04 0012fa08 xul!nsWindow::ProcessMessage+0x33795b 0012f9f4 7e418734 00000001 00000100 00000008 xul!nsWindow::WindowProc+0xf5 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\widget\src\windows\nswindow.cpp @ 3727] 0012fa20 7e418816 100cfff0 00660202 00000100 user32!InternalCallWinProc+0x28 0012fa88 7e4189cd 00000000 100cfff0 00660202 user32!UserCallWinProcCheckWow+0x150 0012fae8 7e418a10 0012fb14 00000000 008dfb40 user32!DispatchMessageWorker+0x306 0012faf8 100d23ae 0012fb14 008dfb44 008dfb40 user32!DispatchMessageW+0xf 0012fb60 004eeeea 100d257c 00000001 00000000 xul!nsAppShell::ProcessNextNativeEvent+0xae [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\widget\src\windows\nsappshell.cpp @ 179] 0012fb84 100f4115 00000000 0081b240 00000001 nspr4!PR_IntervalNow+0x1a [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\nsprpub\pr\src\misc\prinrval.c @ 78] 0012fbc0 1015fa66 00000000 00000001 0012fbf0 xul!nsThread::ProcessNextEvent+0x155 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\xpcom\threads\nsthread.cpp @ 510] 0012fc00 1022a073 0083d300 604beb6b 0081b240 xul!mozilla::ipc::MessagePump::Run+0x196 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\ipc\glue\messagepump.cpp @ 135] 0012fc3c 1022a03b 604beb23 0081b240 008dfb40 xul!MessageLoop::RunHandler+0x26 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\ipc\chromium\src\base\message_loop.cc @ 200] 0012fc74 10229140 00000000 0151ed60 1022a1eb xul!MessageLoop::Run+0x1f [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\ipc\chromium\src\base\message_loop.cc @ 174] 0012fc80 1022a1eb 008dfb40 004ed950 1002e9fd xul!nsBaseAppShell::Run+0x34 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\widget\src\xpwidgets\nsbaseappshell.cpp @ 180] 0012fc8c 1002e9fd 0151ed60 0082a0a8 00000001 xul!nsAppStartup::Run+0x1e [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\toolkit\components\startup\src\nsappstartup.cpp @ 184] 0012ff34 0040133b 00000001 0082a0a8 00813300 xul!XRE_main+0xdc3 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\toolkit\xre\nsapprunner.cpp @ 3485] 0012ff80 004016c2 00000001 00832080 00812790 firefox!wmain+0x33b [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\toolkit\xre\nswindowswmain.cpp @ 120] 0012ffc0 7c817077 02c2df4c 00000018 7ffdf000 firefox!__tmainCRTStartup+0x152 [e:\builds\moz2_slave\release-mozilla-1.9.2-win32_build\build\obj-firefox\memory\jemalloc\crtsrc\crtexe.c @ 591] 0012fff0 00000000 00401840 00000000 00000000 kernel32!BaseProcessStart+0x23 STACK_COMMAND: ~0s; .ecxr ; kb SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: xul!nsEditor::CreateTxnForDeleteCharacter+3 FOLLOWUP_NAME: MachineOwner MODULE_NAME: xul IMAGE_NAME: xul.dll DEBUG_FLR_IMAGE_TIMESTAMP: 4cf9289d FAILURE_BUCKET_ID: NULL_POINTER_WRITE_c0000005_xul.dll!nsEditor::CreateTxnForDeleteCharacter BUCKET_ID: APPLICATION_FAULT_NULL_POINTER_WRITE_xul!nsEditor::CreateTxnForDeleteCharacter+3 WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/firefox_exe/1_9_2_3989/4cf9293f/xul_dll/1_9_2_3989/4cf9289d/c0000005/005215cd.htm?Retriage=1 Followup: MachineOwner --------- 0:000> dv this = 0x038b1428 aData = 0x05ad4000 aOffset = 0x12f2e0 aDirection = 0n16384 aTxn = 0x0012f2c4 segLength = 0x658e810 data = class nsAutoString 0:000> dt aTxn Local var @ 0x12f29c Type DeleteTextTxn** 0x0012f2c4 -> (null) 0:000> dt data Local var @ 0x12f1ec Type nsAutoString +0x000 mData : (null) xul!nsEditor::CreateTxnForDeleteCharacter: 4900 105215ca 55 push ebp 4900 105215cb 8d6c249c lea ebp,[esp-64h] <-- in theory this should be the second instruction 4900 105215cf 81eca0000000 sub esp,0A0h 4900 105215d5 a1a096a910 mov eax,dword ptr [xul!__security_cookie (10a996a0)] 4900 105215da 33c5 xor eax,ebp 4900 105215dc 894560 mov dword ptr [ebp+60h],eax 4900 105215df 8b457c mov eax,dword ptr [ebp+7Ch] 4900 105215e2 53 push ebx 4900 105215e3 8b5d6c mov ebx,dword ptr [ebp+6Ch] 4900 105215e6 56 push esi 4900 105215e7 8b7570 mov esi,dword ptr [ebp+70h] 4900 105215ea 57 push edi 4900 105215eb 8b7d74 mov edi,dword ptr [ebp+74h] 4903 105215ee 8d4dcc lea ecx,[ebp-34h] 4905 105215f1 8945c4 mov dword ptr [ebp-3Ch],eax We've been stomped. No prior disassembly possible 4900 105215cd 249c and al,9Ch <-- windbg points to this instruction, which is a problem 4900 105215cf 81eca0000000 sub esp,0A0h 4900 105215d5 a1a096a910 mov eax,dword ptr [xul!__security_cookie (10a996a0)] 4900 105215da 33c5 xor eax,ebp 4900 105215dc 894560 mov dword ptr [ebp+60h],eax 4900 105215df 8b457c mov eax,dword ptr [ebp+7Ch] 4900 105215e2 53 push ebx
OS: Windows XP → All
OS: All → Windows XP
timeless, do you have steps to reproduce?
no, i pulled that from the crash-reports incident.
Depends on: 636074
No longer depends on: 636074
Crash Signature: [@ nsEditor::CreateTxnForDeleteCharacter(nsIDOMCharacterData*, unsigned int, short, DeleteTextTxn**) ]
Only 2 of these crashes in the past 4 weeks; 1 on 3.6.24 and 1 on 6.0.2. Resolving as works for me.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.