63820 - Crash dismissing app while theme is changing

Status: VERIFIED DUPLICATE of bug 43350

(Core Graveyard :: Skinability, defect, P1)

Description

[scalkins]

Saw this with trunk builds 
Windows 2000-12-27-06Mtrunk
Mac 2000-12-27-04Mtrunk
(Could not get the crash to occur on Linux with todays trunk build)

Steps to repro:
1)Launch NS6 browser with modern theme.
2)Invoke another NS6 app such as Composer.
3)Place browser and composer apps so you can see both on the screen.
3)On the browser, pull down and select View-->Apply Theme-->Classic
4) While the theme is redrawing the two app windows, dismiss the Composer app 
via clicking the box in upper right corner.

Actual results: You will crash out of NS6
 

Talkback trace from Incident ID 23672685 follows 

 Trigger Type:  Program Crash 

 Trigger Reason:  Access violation 

 Thread ID:   

 Call Stack:    (Signature = PresShell::HandlePostedReflowCallbacks 89137797) 
     
   PresShell::HandlePostedReflowCallbacks 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4093]
     
   PresShell::ProcessReflowCommands 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5184]
     
   PresShell::FlushPendingNotifications 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4184]
     
   nsXULDocument::FlushPendingNotifications
                                           
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 1936]
     
   nsXBLStreamListener::Load 
                                           
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLService.cpp, line 409]
     
   nsEventListenerManager::HandleEvent 
                                           
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
1380]
     
   nsDocument::HandleDOMEvent 
                                           
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 3106]
     
   nsXMLDocument::EndLoad 
                                           
[d:\builds\seamonkey\mozilla\layout\xml\document\src\nsXMLDocument.cpp, line 
678]
     
   nsXMLContentSink::DidBuildModel 
                                           
[d:\builds\seamonkey\mozilla\layout\xml\document\src\nsXMLContentSink.cpp, line 
291]
     
   CWellFormedDTD::DidBuildModel 
                                           
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 315]
     
   nsParser::DidBuildModel 
                                           
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1423]
     
   nsParser::ResumeParse 
                                           
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1937]
     
   nsParser::OnStopRequest 
                                           
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2378]
     
   nsXBLStreamListener::OnStopRequest 
                                           
[d:\builds\seamonkey\mozilla\layout\xbl\src\nsXBLService.cpp, line 302]
     
   nsJARChannel::OnStopRequest 
                                           
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 
703]
     
   nsOnStopRequestEvent::HandleEvent 
                                           
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
302]
     
   nsStreamListenerEvent::HandlePLEvent 
                                           
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
101]
     
   PL_HandleEvent 
                                           
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 577]
     
   PL_ProcessPendingEvents 
                                           
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 513]
     
   _md_EventReceiverProc 
                                           
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1055]

Comment 1

[hangas]

Sending to Hewitt.

Comment 2

[Joe Hewitt (gone)]

over to skinnability

Comment 3

[scalkins]

adding crash keyword
still occurs..saw it today on Mac 2001-01-17-08Mtrnk

Comment 4

[scalkins]

Nominating nsbeta1

Comment 5

[Paul Chen]

Setting target milestone of mozilla0.9, assigning to pchen to investigate crash

Comment 6

[Paul Chen]

No, really, reassigning to pchen to investigate crash

Comment 7

[Paul Chen]

Marking nsbeta1+, p1

Comment 8

[Joseph Elwell]

Here's a windows callstack from build 2001032904 comm.

Call Stack:    (Signature = gklayout.dll + 0x8484d (0x6038484d) 6062736d) 
     
   gklayout.dll + 0x8484d (0x6038484d) 
                                         
     
   xpcom.dll + 0x109a (0x60e1109a) 
                                         
     
   xpc3250.dll + 0xf505 (0x60adf505) 
                                         
     
   xpc3250.dll + 0xfe99 (0x60adfe99) 
                                         
     
   js3250.dll + 0x6d43 (0x60bd6d43) 
                                         
     
   js3250.dll + 0xcadd (0x60bdcadd) 
                                         
     
   js3250.dll + 0x6d81 (0x60bd6d81) 
                                         
     
   js3250.dll + 0xf1da (0x60bdf1da) 
                                         
     
   js3250.dll + 0x12934 (0x60be2934) 
                                         
     
   jsdom.dll + 0x167cd (0x60c367cd) 
                                         
     
   jsdom.dll + 0x2cca1 (0x60c4cca1) 
                                         
     
   gkcontent.dll + 0xa772a (0x01ee772a) 
                                         
     
   gkcontent.dll + 0xaac51 (0x01eeac51) 
                                         
     
   gkcontent.dll + 0xab0d1 (0x01eeb0d1) 
                                         
     
   gkcontent.dll + 0xb2955 (0x01ef2955) 
                                         
     
   gkcontent.dll + 0xda1c1 (0x01f1a1c1) 
                                         
     
   gklayout.dll + 0x1bd86 (0x6031bd86) 
                                         
     
   gklayout.dll + 0x1bc37 (0x6031bc37) 
                                         
     
   gkview.dll + 0x1446 (0x60441446) 
                                         
     
   gkview.dll + 0x1407 (0x60441407) 
                                         
     
   gkview.dll + 0x71b1 (0x604471b1) 
                                         
     
   gkview.dll + 0x1d58 (0x60441d58) 
                                         
     
   gkwidget.dll + 0x5b88 (0x60b85b88) 
                                         
     
   gkwidget.dll + 0x5bce (0x60b85bce) 
                                         
     
   gkwidget.dll + 0x8736 (0x60b88736) 
                                         
     
   gkwidget.dll + 0x8a70 (0x60b88a70) 
                                         
     
   gkwidget.dll + 0x7d3b (0x60b87d3b) 
                                         
     
   gkwidget.dll + 0x6016 (0x60b86016) 
                                         
     
   USER32.DLL + 0x3eb0 (0x77e13eb0) 
                                         
     
   USER32.DLL + 0x401a (0x77e1401a) 
                                         
     
   USER32.DLL + 0x92da (0x77e192da) 
                                         
     
   appshell.dll + 0x680a (0x6009680a) 
                                         
     
   netscp6.exe + 0x16bc (0x004016bc) 
                                         
     
   netscp6.exe + 0x11b8 (0x004011b8) 
                                         
     
   netscp6.exe + 0x2bf8 (0x00402bf8) 
                                         
     
   KERNEL32.DLL + 0x7903 (0x77e87903) 
                                         

Comment 9

[Paul Chen]

I'm having a hard time reproducing this one using 2001040304 win32 mozilla build 
and my mac mozilla debug build which was built around last Friday. The debug 
build does assert in two places in editor, but nothing critical, just one 
non-zero result from a function call and hitting the default case in a switch 
statement. Will look at commercial bits.

Comment 10

[Joseph Elwell]

maybe this will help: In reproducing this, I have to close the window after the
initial theme change has begun in that window. So if you're in classic, and you
select modern - close the second app window when you just start to see the
colors change and widgets start moving around...

Comment 11

[Paul Chen]

Here's the stack trace that I get from my win32 build running on win2k from a 
source pull this morning:

nsCOMPtr<nsISupports>::nsCOMPtr<nsISupports>(nsISupports * 0x04d87ce8) line 783 
+ 13 bytes
nsGetInterface::nsGetInterface(nsISupports * 0x04d87ce8, unsigned int * 
0x00000000) line 101 + 30 bytes
do_GetInterface(nsISupports * 0x04d87ce8, unsigned int * 0x00000000) line 114 + 
16 bytes
nsEditorShell::Shutdown(nsEditorShell * const 0x04d88b08) line 330 + 18 bytes
nsEditorBoxObject::SetDocument(nsEditorBoxObject * const 0x04d889d0, nsIDocument 
* 0x00000000) line 58 + 26 bytes
nsXULDocument::SetBoxObjectFor(nsXULDocument * const 0x041e7060, nsIDOMElement * 
0x0437b154, nsIBoxObject * 0x00000000) line 6113
nsXULElement::SetDocument(nsXULElement * const 0x0437b150, nsIDocument * 
0x00000000, int 1, int 1) line 2418
nsXULElement::SetDocument(nsXULElement * const 0x0437b038, nsIDocument * 
0x00000000, int 1, int 1) line 2508
nsXULElement::SetDocument(nsXULElement * const 0x0437aec8, nsIDocument * 
0x00000000, int 1, int 1) line 2508
nsXULElement::SetDocument(nsXULElement * const 0x0437adb0, nsIDocument * 
0x00000000, int 1, int 1) line 2508
nsXULElement::SetDocument(nsXULElement * const 0x0437ab78, nsIDocument * 
0x00000000, int 1, int 1) line 2508
nsXULElement::SetDocument(nsXULElement * const 0x04247f10, nsIDocument * 
0x00000000, int 1, int 1) line 2508
nsXULDocument::SetScriptGlobalObject(nsXULDocument * const 0x041e7048, 
nsIScriptGlobalObject * 0x00000000) line 1363
DocumentViewerImpl::Destroy(DocumentViewerImpl * const 0x041e7838) line 813
nsDocShell::Destroy(nsDocShell * const 0x041d71c4) line 1736
nsWebShell::Destroy(nsWebShell * const 0x041d71c4) line 1431
nsXULWindow::Destroy(nsXULWindow * const 0x041e5104) line 355
nsWebShellWindow::Destroy(nsWebShellWindow * const 0x041e5104) line 1735 + 9 
bytes
nsWebShellWindow::Close(nsWebShellWindow * const 0x041e5168) line 338
nsWebShellWindow::HandleEvent(nsGUIEvent * 0x0012f4b8) line 408
nsWindow::DispatchEvent(nsWindow * const 0x041d34cc, nsGUIEvent * 0x0012f4b8, 
nsEventStatus & nsEventStatus_eIgnore) line 695 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f4b8) line 716
nsWindow::DispatchStandardEvent(unsigned int 101) line 736 + 15 bytes
nsWindow::ProcessMessage(unsigned int 16, unsigned int 0, long 0, long * 
0x0012f820) line 2822
nsWindow::WindowProc(HWND__ * 0x000d052a, unsigned int 16, unsigned int 0, long 
0) line 950 + 27 bytes
USER32! 77e148dc()
USER32! 77e163fb()
USER32! 77e1643d()
NTDLL! 77f9f04b()
USER32! 77e15b59()
USER32! 77e148dc()
USER32! 77e17ef9()
USER32! 77e17f75()
nsWindow::WindowProc(HWND__ * 0x000d052a, unsigned int 274, unsigned int 61536, 
long 22152425) line 957 + 31 bytes
USER32! 77e148dc()
USER32! 77e163fb()
USER32! 77e1643d()
NTDLL! 77f9f04b()
USER32! 77e15b59()
USER32! 77e148dc()
USER32! 77e17ef9()
USER32! 77e17f75()
nsWindow::WindowProc(HWND__ * 0x000d052a, unsigned int 161, unsigned int 20, 
long 22152425) line 957 + 31 bytes
USER32! 77e148dc()
USER32! 77e14aa7()
USER32! 77e266fd()
nsAppShellService::Run(nsAppShellService * const 0x00c8c4b0) line 408
main1(int 1, char * * 0x004b7ac8, nsISupports * 0x00000000) line 1021 + 32 bytes
main(int 1, char * * 0x004b7ac8) line 1316 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e992a6()

At nsEditorShell::Shutdown(nsEditorShell * const 0x04d88b08), it appears 
mContentAreaDocShell has been deleted because it's mostly filled with 0xDD.

Will dig futher on this one.

Comment 12

[Paul Chen]

Created new bug 75476 for the current crash, marking dependency on that bug. I
think the current crash is masking this bug if it's still around.

Comment 13

[Paul Chen]

So I just found out that 75476 got duped to 71129 which got duped to 43350. I 
guess this should also be marked a dup since this crash has been noted in that 
bug.

*** This bug has been marked as a duplicate of 43350 ***

Comment 14

[Patty Mac]

Verified dup.