65554 - Crash when hitting browse button

Status: VERIFIED DUPLICATE of bug 56157

(Core :: DOM: Editor, defect)

Description

[scottputterman]

This has been happening to me a lot lately.  I can't get to talkback right now
or else I'd give you a stack trace.

These steps seem to cause a crash for me.

1. Edit a document and save it.
2. Hit the browse button and view the page in the browser (do not close this window)
3. Go back to your document and type something else and save it.
4. Hit the browse button and crash.

Comment 1

[scottputterman]

 Below is a stack. I'm using 2001011204 and the talkback id I'm using for this
is 24282068

  0x121aff30 
  nsURILoader::OpenURI 
  nsDocShell::DoChannelLoad 
  nsDocShell::DoURILoad 
  nsDocShell::InternalLoad 
  nsDocShell::LoadURI 
  nsHTMLFrameInnerFrame::DoLoadURL 
  nsHTMLFrameInnerFrame::Reflow 
  nsContainerFrame::ReflowChild 
  nsHTMLFrameOuterFrame::Reflow 
  nsBoxToBlockAdaptor::Reflow 
  nsBoxToBlockAdaptor::GetPrefSize 
  nsSprocketLayout::GetPrefSize 
  nsContainerBox::GetPrefSize 
  nsBoxFrame::GetPrefSize 
  nsSprocketLayout::GetPrefSize 
  nsContainerBox::GetPrefSize 
  nsBoxFrame::GetPrefSize 
  nsSprocketLayout::GetPrefSize 
  nsContainerBox::GetPrefSize 
  nsBoxFrame::GetPrefSize 
  nsSprocketLayout::PopulateBoxSizes 
  nsSprocketLayout::Layout 
  nsContainerBox::DoLayout 
  nsBoxFrame::DoLayout 
  nsBox::Layout 
  nsStackLayout::Layout 
  nsContainerBox::DoLayout 
  nsBoxFrame::DoLayout 
  nsBox::Layout 
  nsBoxFrame::Reflow 
  nsRootBoxFrame::Reflow 
  nsContainerFrame::ReflowChild 
  ViewportFrame::Reflow 
  PresShell::InitialReflow 
  nsXULDocument::StartLayout 
  nsXULDocument::ResumeWalk 
  nsXULDocument::CachedChromeStreamListener::OnStopRequest 
  nsDocumentOpenInfo::OnStopRequest 
  nsCachedChromeChannel::HandleStopLoadEvent 
  PL_HandleEvent 
  PL_ProcessPendingEvents 
  _md_EventReceiverProc 
 

Comment 2

[scottputterman]

nominating nsbeta1.  I need to be able to see what my document is going to look
like.

Comment 3

[rubydoo123]

I can't dup this on win98, will check out on mac and linux

Comment 4

[scottputterman]

I can very easily duplicate this with different documents on different NT machines.

Comment 5

[rubydoo123]

can you attach some of those documents so we can use them as testcases?

Comment 6

[scottputterman]

Attachment: file that crashes for me

Comment 7

[rubydoo123]

I can't get it to crash, but I do get a blank browse page on the second browse 
selection on win98. On linux I got it to crash and got a talkback report too!

asking kin to look at the talkback reports and see what's the issue

Comment 8

[rubydoo123]

assign to kin

Comment 9

[rubydoo123]

ncident ID 24807185 
 Trigger Time 
              2001-01-17 17:23:25 
 Email Address 
              [e-mail] 
 User Comments 
              stacktrace for 65554 
 Build ID
              2001011708 
 Product ID
              Netscape6 
 Platform ID
              LinuxIntel 
 Stack Trace

nsDSURIContentListener::OnStartURIOpen() 
nsDSURIContentListener::OnStartURIOpen() 
nsURILoader::OpenURIVia() 
nsURILoader::OpenURI() 
nsDocShell::DoChannelLoad() 
nsDocShell::DoURILoad() 
nsDocShell::InternalLoad() 
nsDocShell::LoadURI() 
nsHTMLFrameInnerFrame::DoLoadURL() 
nsHTMLFrameInnerFrame::Reflow() 
nsContainerFrame::ReflowChild() 
nsHTMLFrameOuterFrame::Reflow() 
nsBoxToBlockAdaptor::Reflow() 
nsBoxToBlockAdaptor::GetPrefSize() 
nsSprocketLayout::GetPrefSize() 
nsContainerBox::GetPrefSize() 
nsBoxFrame::GetPrefSize() 
nsSprocketLayout::GetPrefSize() 
nsContainerBox::GetPrefSize() 
nsBoxFrame::GetPrefSize() 
nsSprocketLayout::GetPrefSize() 
nsContainerBox::GetPrefSize() 
nsBoxFrame::GetPrefSize() 
nsSprocketLayout::PopulateBoxSizes() 
nsSprocketLayout::Layout() 
nsContainerBox::DoLayout() 
nsBoxFrame::DoLayout() 
nsBox::Layout() 
nsStackLayout::Layout() 
nsContainerBox::DoLayout() 
nsBoxFrame::DoLayout() 
nsBox::Layout() 
nsBoxFrame::Reflow() 
nsRootBoxFrame::Reflow() 
nsContainerFrame::ReflowChild() 
ViewportFrame::Reflow() 
PresShell::InitialReflow() 
nsXULDocument::StartLayout() 
nsXULDocument::ResumeWalk() 
OnStopRequest() 
nsDocumentOpenInfo::OnStopRequest() 
nsCachedChromeChannel::HandleStopLoadEvent() 
PL_HandleEvent() 
PL_ProcessPendingEvents() 
nsEventQueueImpl::ProcessPendingEvents() 
event_processor_callback() 
our_gdk_io_invoke() 
libglib-1.2.so.0 + 0x101a0 (0x40a051a0) 
libglib-1.2.so.0 + 0x11987 (0x40a06987) 
libglib-1.2.so.0 + 0x12001 (0x40a07001) 
libglib-1.2.so.0 + 0x121cc (0x40a071cc) 
libgtk-1.2.so.0 + 0x93e57 (0x4091de57) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x1bb65 (0x4024ab65) 

Comment 10

[Nathan]

I'm running Windows 98SE with build 2001012708 and I reproduce this every time I
try.

Also, if I open the page from a blank composer window, I don't have to edit the
page to get it to crash. If I open from File->Open Location, I have to edit
before I can browse.

I can reproduce with:
1. Open any document with composer.
2. Click browse.
3. Go back to composer and click browse again.


I always get an invalid page fault error, usually in "module DOCSHELL.DLL",
however sometimes it says "module <unknown>" or "module JS3250.DLL"

Also, the size of the page doesn't seem to matter, as I've tried this with a
blank document and with a bare bones document.

Comment 11

[kinmoz]

The crash is happening because there is an nsDSURIContentListener that is 
storing an un-ref'd pointer to an nsBrowserInstance in it's 
mParentContentListener.

The 2nd time we hit the preview button, it looks like the nsBrowserInstance is 
getting deleted, but the nsDSURIContentListener is still pointing to it.

I don't know much about how URL dispatching should work, the editor seems to do 
it via the following line of JS in ComposerCommands.js:

window.openDialog(getBrowserURL(), "EditorPreview", "chrome,all,dialog=no", 
window._content.location);

Cc'ing [e-mail] since this stuff seems to be happening at the 
docshell level.

Here's the stack trace to where the nsBrowserInstance is being deleted:

nsBrowserInstance::~nsBrowserInstance() line 441
nsBrowserInstance::`scalar deleting destructor'() + 15 bytes
nsBrowserInstance::Release(nsBrowserInstance * const 0x051cd7d0) line 607 + 158 
bytes
nsXPCWrappedNative::~nsXPCWrappedNative() line 398 + 27 bytes
nsXPCWrappedNative::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsXPCWrappedNative::Release(nsXPCWrappedNative * const 0x051cd630) line 71 + 31 
bytes
nsXPCWrappedNative::JSObjectFinalized(JSContext * 0x04ef9830, JSObject * 
0x00e0c7f0) line 96
WrappedNative_Finalize(JSContext * 0x04ef9830, JSObject * 0x00e0c7f0) line 894
js_FinalizeObject(JSContext * 0x04ef9830, JSObject * 0x00e0c7f0) line 1627 + 274 
bytes
js_GC(JSContext * 0x04ef9830, unsigned int 0) line 1196 + 11 bytes
js_ForceGC(JSContext * 0x04ef9830) line 931 + 11 bytes
JS_GC(JSContext * 0x04ef9830) line 1595 + 9 bytes
nsJSContext::GC(nsJSContext * const 0x04eff070) line 1316 + 13 bytes
GlobalWindowImpl::SetNewDocument(GlobalWindowImpl * const 0x04eff800, 
nsIDOMDocument * 0x044e8dfc) line 389
DocumentViewerImpl::Init(DocumentViewerImpl * const 0x044e8bd0, nsIWidget * 
0x04efd5c4, nsIDeviceContext * 0x04f67790, const nsRect & {...}) line 554
nsDocShell::SetupNewViewer(nsDocShell * const 0x04effca0, nsIContentViewer * 
0x044e8bd0) line 2970 + 66 bytes
nsWebShell::SetupNewViewer(nsWebShell * const 0x04effca0, nsIContentViewer * 
0x044e8bd0) line 352 + 13 bytes
nsDocShell::Embed(nsDocShell * const 0x04effcc0, nsIContentViewer * 0x044e8bd0, 
const char * 0x01c51de4, nsISupports * 0x00000000) line 2522 + 23 bytes
nsWebShell::Embed(nsWebShell * const 0x04effcc0, nsIContentViewer * 0x044e8bd0, 
const char * 0x01c51de4, nsISupports * 0x00000000) line 385
nsDocShell::CreateContentViewer(nsDocShell * const 0x04effca0, const char * 
0x0012fb58, nsIChannel * 0x0535d8d0, nsIStreamListener * * 0x0012fbac) line 2796 
+ 32 bytes
nsDSURIContentListener::DoContent(nsDSURIContentListener * const 0x04efd0c0, 
const char * 0x0012fb58, int 0, const char * 0x100af040 gCommonEmptyBuffer, 
nsIChannel * 0x0535d8d0, nsIStreamListener * * 0x0012fbac, int * 0x0012fb3c) 
line 103 + 33 bytes
nsDocumentOpenInfo::DispatchContent(nsIChannel * 0x0535d8d0, nsISupports * 
0x00000000) line 367 + 109 bytes
nsDocumentOpenInfo::OnStartRequest(nsDocumentOpenInfo * const 0x0535d7a0, 
nsIChannel * 0x0535d8d0, nsISupports * 0x00000000) line 241 + 16 bytes
nsCachedChromeChannel::HandleStartLoadEvent(PLEvent * 0x053587f0) line 514
PL_HandleEvent(PLEvent * 0x053587f0) line 576 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00ac91b0) line 509 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x07320574, unsigned int 49371, unsigned int 0, 
long 11309488) line 1054 + 9 bytes
USER32! 77e7124c()
00ac91b0()

Comment 12

[Simon Fraser [no longer active]]

*** This bug has been marked as a duplicate of 56157 ***

Comment 13

[sujay]

verified in 1/31 build.