65513 - crash on back in nsXBLBindingRequest::~nsXBLBindingRequest

Status: RESOLVED WORKSFORME

(Core :: XBL, defect)

Description

[Axel Hecht]

Hi,
when going on Hixie's software page, following the link to the university, and
then going back, I segfault.
I see an assertion before:

Failed to load XBL document
http://software.hixie.ch/resources/bindings/sites.xml
WARNING: XBL load did not complete until after document went away! Modal dialog
bug?
, file /tmp/mozilla/layout/xbl/src/nsXBLService.cpp, line 350

I didn't open any modal dialogs, or popups.

Here goes the stack trace:

#0  0xff097f64 in nsTraceRefcnt::LogReleaseCOMPtr (aCOMPtr=0x22c698, 
    aObject=0xd8d8d8d8) at /tmp/mozilla/xpcom/base/nsTraceRefcnt.cpp:1949
#1  0xfdf5caac in nsCOMPtr<nsIContent>::~nsCOMPtr (this=0x22c698, __in_chrg=2)
    at ../../../dist/include/nsCOMPtr.h:488
#2  0xfc29c110 in nsXBLBindingRequest::~nsXBLBindingRequest (this=0x22c680, 
    __in_chrg=3) at /tmp/mozilla/layout/xbl/src/nsXBLService.cpp:134
#3  0xfbaab1a8 in nsXBLStreamListener::Load (this=0x957b10, aEvent=0x8db4ac)
    at /tmp/mozilla/layout/xbl/src/nsXBLService.cpp:414
#4  0xfb70b778 in nsEventListenerManager::HandleEvent (this=0x957b40, 
    aPresContext=0x0, aEvent=0xffbee5e8, aDOMEvent=0xffbee570, 
    aCurrentTarget=0x93c7fc, aFlags=7, aEventStatus=0xffbee634)
    at /tmp/mozilla/layout/events/src/nsEventListenerManager.cpp:1375
#5  0xfbad6e1c in nsDocument::HandleDOMEvent (this=0x93c7d0, aPresContext=0x0, 
    aEvent=0xffbee5e8, aDOMEvent=0xffbee570, aFlags=1, aEventStatus=0xffbee634)
    at /tmp/mozilla/layout/base/src/nsDocument.cpp:3100
#6  0xfba0efa8 in nsXMLDocument::EndLoad (this=0x93c7d0)
    at /tmp/mozilla/layout/xml/document/src/nsXMLDocument.cpp:676
#7  0xfba03570 in nsXMLContentSink::DidBuildModel (this=0x957168, 
    aQualityLevel=1)
    at /tmp/mozilla/layout/xml/document/src/nsXMLContentSink.cpp:288
#8  0xfb3056f8 in CWellFormedDTD::DidBuildModel (this=0x9ecc88, 
    anErrorCode=2152136711, aNotifySink=1, aParser=0x9569e8, aSink=0x957168)
    at /tmp/mozilla/htmlparser/src/nsWellFormedDTD.cpp:294

This was tested on cvs builds from Jan, 12. Both debug and optim.

Axel

Comment 1

[John Morrison]

same crash for win2k builds.

Comment 2

[Peter Trudelle]

->moz0.9.1/critical

Comment 3

[Håkan Waara]

I don't crash with the steps you mention, Axel.

Can you re-try?

Comment 4

[John Morrison]

I don't crash either with a current trunk build on win2k, which I could easily 
do before. Marking WFM. Thanks.