649264 - crash [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsDocShell::Destroy()]

Status: RESOLVED INCOMPLETE

(Core :: DOM: Navigation, defect)

Description

[timeless]

Signature	nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsDocShell::Destroy()
UUID	8dd63ddb-db0f-4114-aedc-7d2172110412
Time 	2011-04-12 01:59:20.91853
Uptime	167
Last Crash	108386 seconds (1.3 days) before submission
Install Age	1155147 seconds (1.9 weeks) since version was first installed.
Product	Firefox
Version	4.2a1pre
Build ID	20110329030437
Branch	2.2
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
CPU	x86
CPU Info	GenuineIntel family 6 model 28 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x8
User Comments	using venkmann
App Notes 	AdapterVendorID: 8086, AdapterDeviceID: a011, AdapterDriverVersion: 8.14.10.2230
D3D10 Layers? D3D10 Layers-
D3D9 Layers? D3D9 Layers-
Processor Notes 	
EMCheckCompatibility	False
Bugzilla - Report this Crash
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsCOMPtr_base::assign_assuming_AddRef 	
1 	xul.dll 	nsDocShell::Destroy 	docshell/base/nsDocShell.cpp:4563
2 	xul.dll 	nsXULWindow::Destroy 	xpfe/appshell/src/nsXULWindow.cpp:528
3 	xul.dll 	nsWebShellWindow::Destroy 	xpfe/appshell/src/nsWebShellWindow.cpp:832
4 	xul.dll 	nsWebShellWindow::HandleEvent 	
5 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3767
6 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3805
7 	xul.dll 	nsWindow::DispatchStandardEvent 	widget/src/windows/nsWindow.cpp:3798
8 	xul.dll 	nsWindow::ProcessMessage 	
9 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4627
10 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:65
11 		@0xcba0dcf4 	
12 	xul.dll 	xul.dll@0x35b86f 	
13 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:4574

I think i was closing a certificate manager that i was debugging.

4491 nsDocShell::Destroy() 
4561   if (mContentViewer) {

i believe this reenters nsDocShell enalbing mContentViewer to be null'd:
4562     mContentViewer->Close(nsnull);
thus when it returns, we crash here:
4563     mContentViewer->Destroy();
4564     mContentViewer = nsnull;
4565 }

Comment 1

[Andrew McCreight [:mccr8]]

This bug is 5 years old and doesn't have any real information to go on, so I'm going to mark it incomplete.