62160 - Going to one of the url's and then clicking on File>Close of the window crashes the browser

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[balwinder]

1.The above mentioned urls are under DOM-Html tests.Click on either one of these
urls or goto tests under HTMLModElement link .The tests for properties 'cite' or
''date/time' when clicked open up a window displaying a result.
2.When this new window is clicked closed from File>Close , whole of the browser
components (if open) are pulled down ie the browser crashed.If the crash does
not occur the first time , second time it will surely do.Just repeat the steps.

Comment 1

[Johnny Stenback (:jst)]

I don't see this problem here, what version of mozilla are you using? Can you
provide a stack trace of the crash?

Comment 2

[Johnny Stenback (:jst)]

Worksforme, we need more info to resolve this, please reopen and supply more
info if this still happens.

Comment 3

[Michael Mahan]

This bug happens for me using:
Mozilla/5.0 (X11; U; SunOS 5.7 sun4u; en-US; m18) Gecko/2000120721

I can get mozilla to crash by loading and reloading multiple times this url:
 http://mozilla.org/quality/ngdriver/suites/dom1/hmod001.html
It will also crash sometimes if I close the window from the same url.
I will include the stack trace for each case

Comment 4

[Michael Mahan]

Attachment: stack trace for window close crash

Comment 5

[Michael Mahan]

Attachment: stack trace for reload crash

Comment 6

[Johnny Stenback (:jst)]

Ok, now I also see the problem after reloading the page about 5 times. I found
the problem and I'll attach a diff in a while.

Comment 7

[Johnny Stenback (:jst)]

Attachment: Proposed fix

Comment 8

[Johnny Stenback (:jst)]

So, the problem was that the content sink ended up creating the wrong type of
element objects when it saw the <del> and <ins> elements (the sink ended up
creating a span element). Later on when mozilla tried to create a script object
for those elements it tried to QI into nsIDOMHTML{Del,Ins}Element and that
failed so we never got the script object but we still did an AddNamedReference()
but since there was no script object we never did a RemoveReference() so the we
crashed in the JS GC referencing deleted memory.

Brendan, sr=? (PS. There's a minor cleanup in the end of the patch that is not
required, I just forgot to remove it. That cleanup could go in anyway, lemme
know if there's a reason not to check that in.)

Comment 9

[Johnny Stenback (:jst)]

Brendan, never mind, so scc sr'd this and ben reviewed so this is checked in now.

Comment 10

[Heikki Toivonen (remove -bugzilla when emailing directly)]

*** Bug 46030 has been marked as a duplicate of this bug. ***

Comment 11

[Heikki Toivonen (remove -bugzilla when emailing directly)]

*** Bug 46003 has been marked as a duplicate of this bug. ***

Comment 12

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Wow! I just found that this bug was the cause of 2 bugs on joki's list - events
not working for DEL & INS element. I just marked them dupes. 3 dead bugs in one
swat!

When you verify, please test those bugs as well (they have testcases, but note
that key events should NOT work even though the testcases include them).

Comment 13

[Johnny Stenback (:jst)]

*** Bug 62608 has been marked as a duplicate of this bug. ***

Comment 14

[Prashant Desale]

QA contact Update

Comment 15

[Prashant Desale]

Updating QA contact to Shivakiran Tummala.

Comment 16

[Sivakiran Tummala]

does not crash anymore ---verified