Crash when hitting browse button

VERIFIED DUPLICATE of bug 56157

Status

()

Core
Editor
VERIFIED DUPLICATE of bug 56157
17 years ago
17 years ago

People

(Reporter: scottputterman, Assigned: kinmoz)

Tracking

Trunk
mozilla0.9
x86
Windows NT
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

17 years ago
This has been happening to me a lot lately.  I can't get to talkback right now
or else I'd give you a stack trace.

These steps seem to cause a crash for me.

1. Edit a document and save it.
2. Hit the browse button and view the page in the browser (do not close this window)
3. Go back to your document and type something else and save it.
4. Hit the browse button and crash.
(Reporter)

Comment 1

17 years ago
 Below is a stack. I'm using 2001011204 and the talkback id I'm using for this
is 24282068

  0x121aff30 
  nsURILoader::OpenURI 
  nsDocShell::DoChannelLoad 
  nsDocShell::DoURILoad 
  nsDocShell::InternalLoad 
  nsDocShell::LoadURI 
  nsHTMLFrameInnerFrame::DoLoadURL 
  nsHTMLFrameInnerFrame::Reflow 
  nsContainerFrame::ReflowChild 
  nsHTMLFrameOuterFrame::Reflow 
  nsBoxToBlockAdaptor::Reflow 
  nsBoxToBlockAdaptor::GetPrefSize 
  nsSprocketLayout::GetPrefSize 
  nsContainerBox::GetPrefSize 
  nsBoxFrame::GetPrefSize 
  nsSprocketLayout::GetPrefSize 
  nsContainerBox::GetPrefSize 
  nsBoxFrame::GetPrefSize 
  nsSprocketLayout::GetPrefSize 
  nsContainerBox::GetPrefSize 
  nsBoxFrame::GetPrefSize 
  nsSprocketLayout::PopulateBoxSizes 
  nsSprocketLayout::Layout 
  nsContainerBox::DoLayout 
  nsBoxFrame::DoLayout 
  nsBox::Layout 
  nsStackLayout::Layout 
  nsContainerBox::DoLayout 
  nsBoxFrame::DoLayout 
  nsBox::Layout 
  nsBoxFrame::Reflow 
  nsRootBoxFrame::Reflow 
  nsContainerFrame::ReflowChild 
  ViewportFrame::Reflow 
  PresShell::InitialReflow 
  nsXULDocument::StartLayout 
  nsXULDocument::ResumeWalk 
  nsXULDocument::CachedChromeStreamListener::OnStopRequest 
  nsDocumentOpenInfo::OnStopRequest 
  nsCachedChromeChannel::HandleStopLoadEvent 
  PL_HandleEvent 
  PL_ProcessPendingEvents 
  _md_EventReceiverProc 
 
(Reporter)

Comment 2

17 years ago
nominating nsbeta1.  I need to be able to see what my document is going to look
like.
Keywords: nsbeta1

Comment 3

17 years ago
I can't dup this on win98, will check out on mac and linux
(Reporter)

Comment 4

17 years ago
I can very easily duplicate this with different documents on different NT machines.

Comment 5

17 years ago
can you attach some of those documents so we can use them as testcases?
(Reporter)

Comment 6

17 years ago
Created attachment 22796 [details]
file that crashes for me

Comment 7

17 years ago
I can't get it to crash, but I do get a blank browse page on the second browse 
selection on win98. On linux I got it to crash and got a talkback report too!

asking kin to look at the talkback reports and see what's the issue

Comment 8

17 years ago
assign to kin
Assignee: beppe → kin

Comment 9

17 years ago
ncident ID 24807185 
 Trigger Time 
              2001-01-17 17:23:25 
 Email Address 
              beppe@netscape.com 
 User Comments 
              stacktrace for 65554 
 Build ID
              2001011708 
 Product ID
              Netscape6 
 Platform ID
              LinuxIntel 
 Stack Trace

nsDSURIContentListener::OnStartURIOpen() 
nsDSURIContentListener::OnStartURIOpen() 
nsURILoader::OpenURIVia() 
nsURILoader::OpenURI() 
nsDocShell::DoChannelLoad() 
nsDocShell::DoURILoad() 
nsDocShell::InternalLoad() 
nsDocShell::LoadURI() 
nsHTMLFrameInnerFrame::DoLoadURL() 
nsHTMLFrameInnerFrame::Reflow() 
nsContainerFrame::ReflowChild() 
nsHTMLFrameOuterFrame::Reflow() 
nsBoxToBlockAdaptor::Reflow() 
nsBoxToBlockAdaptor::GetPrefSize() 
nsSprocketLayout::GetPrefSize() 
nsContainerBox::GetPrefSize() 
nsBoxFrame::GetPrefSize() 
nsSprocketLayout::GetPrefSize() 
nsContainerBox::GetPrefSize() 
nsBoxFrame::GetPrefSize() 
nsSprocketLayout::GetPrefSize() 
nsContainerBox::GetPrefSize() 
nsBoxFrame::GetPrefSize() 
nsSprocketLayout::PopulateBoxSizes() 
nsSprocketLayout::Layout() 
nsContainerBox::DoLayout() 
nsBoxFrame::DoLayout() 
nsBox::Layout() 
nsStackLayout::Layout() 
nsContainerBox::DoLayout() 
nsBoxFrame::DoLayout() 
nsBox::Layout() 
nsBoxFrame::Reflow() 
nsRootBoxFrame::Reflow() 
nsContainerFrame::ReflowChild() 
ViewportFrame::Reflow() 
PresShell::InitialReflow() 
nsXULDocument::StartLayout() 
nsXULDocument::ResumeWalk() 
OnStopRequest() 
nsDocumentOpenInfo::OnStopRequest() 
nsCachedChromeChannel::HandleStopLoadEvent() 
PL_HandleEvent() 
PL_ProcessPendingEvents() 
nsEventQueueImpl::ProcessPendingEvents() 
event_processor_callback() 
our_gdk_io_invoke() 
libglib-1.2.so.0 + 0x101a0 (0x40a051a0) 
libglib-1.2.so.0 + 0x11987 (0x40a06987) 
libglib-1.2.so.0 + 0x12001 (0x40a07001) 
libglib-1.2.so.0 + 0x121cc (0x40a071cc) 
libgtk-1.2.so.0 + 0x93e57 (0x4091de57) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x1bb65 (0x4024ab65) 

Comment 10

17 years ago
I'm running Windows 98SE with build 2001012708 and I reproduce this every time I
try.

Also, if I open the page from a blank composer window, I don't have to edit the
page to get it to crash. If I open from File->Open Location, I have to edit
before I can browse.

I can reproduce with:
1. Open any document with composer.
2. Click browse.
3. Go back to composer and click browse again.


I always get an invalid page fault error, usually in "module DOCSHELL.DLL",
however sometimes it says "module <unknown>" or "module JS3250.DLL"

Also, the size of the page doesn't seem to matter, as I've tried this with a
blank document and with a bare bones document.
(Assignee)

Comment 11

17 years ago
The crash is happening because there is an nsDSURIContentListener that is 
storing an un-ref'd pointer to an nsBrowserInstance in it's 
mParentContentListener.

The 2nd time we hit the preview button, it looks like the nsBrowserInstance is 
getting deleted, but the nsDSURIContentListener is still pointing to it.

I don't know much about how URL dispatching should work, the editor seems to do 
it via the following line of JS in ComposerCommands.js:

window.openDialog(getBrowserURL(), "EditorPreview", "chrome,all,dialog=no", 
window._content.location);

Cc'ing adamlock@netscape.com since this stuff seems to be happening at the 
docshell level.

Here's the stack trace to where the nsBrowserInstance is being deleted:

nsBrowserInstance::~nsBrowserInstance() line 441
nsBrowserInstance::`scalar deleting destructor'() + 15 bytes
nsBrowserInstance::Release(nsBrowserInstance * const 0x051cd7d0) line 607 + 158 
bytes
nsXPCWrappedNative::~nsXPCWrappedNative() line 398 + 27 bytes
nsXPCWrappedNative::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXPCWrappedNative::Release(nsXPCWrappedNative * const 0x051cd630) line 71 + 31 
bytes
nsXPCWrappedNative::JSObjectFinalized(JSContext * 0x04ef9830, JSObject * 
0x00e0c7f0) line 96
WrappedNative_Finalize(JSContext * 0x04ef9830, JSObject * 0x00e0c7f0) line 894
js_FinalizeObject(JSContext * 0x04ef9830, JSObject * 0x00e0c7f0) line 1627 + 274 
bytes
js_GC(JSContext * 0x04ef9830, unsigned int 0) line 1196 + 11 bytes
js_ForceGC(JSContext * 0x04ef9830) line 931 + 11 bytes
JS_GC(JSContext * 0x04ef9830) line 1595 + 9 bytes
nsJSContext::GC(nsJSContext * const 0x04eff070) line 1316 + 13 bytes
GlobalWindowImpl::SetNewDocument(GlobalWindowImpl * const 0x04eff800, 
nsIDOMDocument * 0x044e8dfc) line 389
DocumentViewerImpl::Init(DocumentViewerImpl * const 0x044e8bd0, nsIWidget * 
0x04efd5c4, nsIDeviceContext * 0x04f67790, const nsRect & {...}) line 554
nsDocShell::SetupNewViewer(nsDocShell * const 0x04effca0, nsIContentViewer * 
0x044e8bd0) line 2970 + 66 bytes
nsWebShell::SetupNewViewer(nsWebShell * const 0x04effca0, nsIContentViewer * 
0x044e8bd0) line 352 + 13 bytes
nsDocShell::Embed(nsDocShell * const 0x04effcc0, nsIContentViewer * 0x044e8bd0, 
const char * 0x01c51de4, nsISupports * 0x00000000) line 2522 + 23 bytes
nsWebShell::Embed(nsWebShell * const 0x04effcc0, nsIContentViewer * 0x044e8bd0, 
const char * 0x01c51de4, nsISupports * 0x00000000) line 385
nsDocShell::CreateContentViewer(nsDocShell * const 0x04effca0, const char * 
0x0012fb58, nsIChannel * 0x0535d8d0, nsIStreamListener * * 0x0012fbac) line 2796 
+ 32 bytes
nsDSURIContentListener::DoContent(nsDSURIContentListener * const 0x04efd0c0, 
const char * 0x0012fb58, int 0, const char * 0x100af040 gCommonEmptyBuffer, 
nsIChannel * 0x0535d8d0, nsIStreamListener * * 0x0012fbac, int * 0x0012fb3c) 
line 103 + 33 bytes
nsDocumentOpenInfo::DispatchContent(nsIChannel * 0x0535d8d0, nsISupports * 
0x00000000) line 367 + 109 bytes
nsDocumentOpenInfo::OnStartRequest(nsDocumentOpenInfo * const 0x0535d7a0, 
nsIChannel * 0x0535d8d0, nsISupports * 0x00000000) line 241 + 16 bytes
nsCachedChromeChannel::HandleStartLoadEvent(PLEvent * 0x053587f0) line 514
PL_HandleEvent(PLEvent * 0x053587f0) line 576 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00ac91b0) line 509 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x07320574, unsigned int 49371, unsigned int 0, 
long 11309488) line 1054 + 9 bytes
USER32! 77e7124c()
00ac91b0()
Status: NEW → ASSIGNED
Target Milestone: --- → mozilla0.9

Comment 12

17 years ago


*** This bug has been marked as a duplicate of 56157 ***
Status: ASSIGNED → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → DUPLICATE

Comment 13

17 years ago
verified in 1/31 build.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.