71531 - M08 crash [@ nsDocShell::SetLoadType]

Status: VERIFIED WORKSFORME

(Core :: DOM: Navigation, defect)

Description

[Jay Patel [:jay]]

This is a topcrasher with mozilla 0.8 (M08) on Linux.  Here is the stack trace 
and some talkback info that might help us reproduce this crash:

Incident ID 26709124 
nsDocShell::SetLoadType() 
nsDSURIContentListener::DoContent() 
nsDocumentOpenInfo::DispatchContent() 
nsDocumentOpenInfo::OnStartRequest() 
nsHTTPFinalListener::OnStartRequest() 
InterceptStreamListener::OnStartRequest() 
nsHTTPServerListener::FinishedResponseHeaders() 
nsHTTPServerListener::OnDataAvailable() 
nsOnDataAvailableEvent::HandleEvent() 
nsStreamObserverEvent::HandlePLEvent() 
PL_HandleEvent() 
PL_ProcessPendingEvents() 
nsEventQueueImpl::ProcessPendingEvents() 
event_processor_callback() 
our_gdk_io_invoke() 
libglib-1.2.so.0 + 0xf320 (0x40698320) 
libglib-1.2.so.0 + 0x10bb6 (0x40699bb6) 
libglib-1.2.so.0 + 0x111e3 (0x4069a1e3) 
libglib-1.2.so.0 + 0x113ac (0x4069a3ac) 
libgtk-1.2.so.0 + 0x9361c (0x405b861c) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x18a8e (0x40248a8e) 

Some user comments and urls:

        URL:(27422854) http://komodo.mozilla.org/buster/test_url_25.html
        URL:(26937324) www.antwerpen.be
        URL:(27178189) http://www.conservativeHQ.com/
        URL:(27050096) http://www.linuxgames.com/news/index.php3/3995
        URL:(26709124) http://www.tv-spielfilm.de/surftips
        URL:(27457301) www.tomshardware.com
        URL:(27438279) www.torchgallery.com
        URL:(26756600) http://www.winehq.org
        URL:(27123210) http://www.ruby.ch/en/rubymain.shtml
        URL:(27117202) http://www.avsforum.com (unknown subpage URL)
        Comment: (26937324) Opening streetplan Antwerp
        Comment: (27178189) browsing multiple pages
        Comment: (26903289) clicked on a banner ad
        Comment: (26709124) clicked on a link
        Comment: (26940572) Open echo.msk.ru and wait
        Comment: (27457301) loading the web page and reading mail in mozilla
        Comment: (27438279) Loading page when it crashed
        Comment: (27289828) Deleting a mail item.
        Comment: (27123210) Clicking on the "rwiki plus" href
        Comment: (27117202) closed a window
        Comment: (27009859) I had just close a window before it reach the web 
site that I want to open
        Comment: (27263125) press ctrl-m in mailnews

Comment 1

[Jay Patel [:jay]]

Adding crash, topcrash keywords, M08 and [@ nsDocShell::SetLoadType] for 
tracking.

Comment 2

[Jan Carpenter]

M08 topcrasher on Windows too.  Changing OS to All.

Stack Trace for Windows:

Incident ID 26787226 
nsDocShell::SetLoadType [d:\builds\0.8\mozilla\docshell\base\nsDocShell.cpp, 
line 4356] 
nsDSURIContentListener::DoContent 
[d:\builds\0.8\mozilla\docshell\base\nsDSURIContentListener.cpp, line 97] 
nsDocumentOpenInfo::DispatchContent 
[d:\builds\0.8\mozilla\uriloader\base\nsURILoader.cpp, line 370] 
nsDocumentOpenInfo::OnStartRequest 
[d:\builds\0.8\mozilla\uriloader\base\nsURILoader.cpp, line 242] 
nsHTTPFinalListener::OnStartRequest 
[d:\builds\0.8\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cpp, 
line 1142] 
nsHTTPServerListener::FinishedResponseHeaders
[d:\builds\0.8\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cpp, 
line 1080] 
nsHTTPServerListener::OnDataAvailable 
[d:\builds\0.8\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cpp, 
line 430]

nsOnDataAvailableEvent::HandleEvent 
[d:\builds\0.8\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 172] 
nsStreamObserverEvent::HandlePLEvent 
[d:\builds\0.8\mozilla\netwerk\base\src\nsStreamObserverProxy.cpp, line 78] 
PL_HandleEvent [d:\builds\0.8\mozilla\xpcom\threads\plevent.c, line 577] 
PL_ProcessPendingEvents [d:\builds\0.8\mozilla\xpcom\threads\plevent.c, line 
513] 
_md_EventReceiverProc [d:\builds\0.8\mozilla\xpcom\threads\plevent.c, line 1055] 
nsAppShellService::Run 
[d:\builds\0.8\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 408] 
main1 [d:\builds\0.8\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 985] 
main [d:\builds\0.8\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1275] 
WinMain [d:\builds\0.8\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1293] 
WinMainCRTStartup() 
KERNEL32.DLL + 0x192a6 (0x77e992a6) 

User comments and URLs:

        URL:(27063091) 
http://www.designjet.hp.com/Data/Spring2001/5000datasheetUS.pdf?ticket=47KCrw6Od
7&pageseq=17074067
        URL:(27057742) 
http://www.lostuniverse.org/bsod/pages/funypict/index.shtml
        URL:(26867813) mozdev.org
        URL:(26706502) forums.ixbt.com
        Comment: (27063091) Closing after unsuccessful attept to read PDF file
        Comment: (27057742) Trying to open a new browser window to target URL 
from
another site.
        Comment: (27253342) Opening a newsgroup message
        Comment: (26867813) Looking for screen shots of the Jaberzilla client
        Comment: (26706502) fast window closing

Comment 3

[Jay Patel [:jay]]

adding crash, topcrash keywords.  also adding qawanted keyword because we need a 
reproducible testcase.

Comment 4

[Adam Lock]

The nsDocShell:SetLoadType() is a simple method that sets a member variable and 
returns. This suggests a refcounting issue or a race condition is happening 
where the content listener is trying to put content into a docshell that has 
already been destroyed.

Comment 5

[Adam Lock]

I have been unable to reproduce the the crash with latest nightly builds and the 
provided URL. Can anyone else reproduce it?

Comment 6

[chris hofmann]

Here is the latest talkback data out of M0.8.1.
Crash is still appearing.  Looks like the highest pct.
of nsDocShell::SetLoadType might be coming on linux...

there are also a few test urls that we might get the 
tucson helpers to pound on...

Netscape6.50,2001032614,28801365,2001-04-07,Windows NT  5.0 build
2195,4372,4599,nsDocShell::SetLoadType 03f40c62,
d:\builds\0.8.1\mozilla\docshell\base\nsDocShell.cpp,4274,,

Netscape6.50,2001032614,28851921,2001-04-08,Windows NT  4.0 build
1381,1236,1359,,,nsDocShell::SetLoadType b2efacaf,
d:\builds\0.8.1\mozilla\docshell\base\nsDocShell.cpp,4274,,

Netscape6.50,2001032614,28854048,2001-04-08,Windows NT  5.0 build
2195,68926,68926,,nsDocShell::SetLoadType 18dc011a,
d:\builds\0.8.1\mozilla\docshell\base\nsDocShell.cpp,4274,
http://www.webstandards.org/resources.html,
I double-clicked on a link (W3C info link)

Netscape6.50,2001032614,29038135,2001-04-12,Windows NT  5.0 build 2195,22042,22042,
,,nsDocShell::SetLoadType 2995998e,
d:\builds\0.8.1\mozilla\docshell\base\nsDocShell.cpp,4274,,

Netscape6.50,2001032614,29041737,2001-04-12,Windows NT  5.0 build
2195,254631,254631,,nsDocShell::SetLoadType 18dc011a,
d:\builds\0.8.1\mozilla\docshell\base\nsDocShell.cpp,4274,,

Netscape6.50,2001032615,28835533,2001-04-08,Linux
2.4.2,283,283,U6B1FAE61-2C40-11D5-AB7F0090-27C21B29,
,nsDocShell::SetLoadType() d5ae2f5d,,,,

Netscape6.50,2001032615,28912090,2001-04-10,Linux
2.4.2,473186,473186,U4BF02EEF-19CC-11D4-94C10090-27C21B29,
,nsDocShell::SetLoadType() fca15753,,,,

Netscape6.50,2001032615,28922118,2001-04-10,Linux 2.2.14-5.0smp,184942,184942,
,,nsDocShell::SetLoadType() c5ca7709,,,,

Netscape6.50,2001032615,28944798,2001-04-10,Linux 2.2.5-15,6461,98710,
,,nsDocShell::SetLoadType() a8e8475d,,,,

Netscape6.50,2001032615,28953561,2001-04-11,Linux 2.2.18-2.2.18-ATA66,6987,466962,
,,nsDocShell::SetLoadType() 1e914628,,,,

Netscape6.50,2001032615,28987637,2001-04-11,Linux 2.4.0-4GB,437823,437823,
,,nsDocShell::SetLoadType() b8d5f4cf,,,,

Netscape6.50,2001032615,28998960,2001-04-12,Linux 2.2.17,249068,249068,
,nsDocShell::SetLoadType() 9943232d,,,
http://www.heise.de/newsticker/data/hps-12.04.01-000/
,I followed the link to the Deutsches Patent- und Markenamt, and gota blank
page, which I closed.

Netscape6.50,2001032615,29065176,2001-04-13,Linux 2.4.3,84481,124640,
,,nsDocShell::SetLoadType() 797a590a,,,,

Netscape6.50,2001032615,29086617,2001-04-13,Linux 2.2.18pre21,326234,649652,
,,nsDocShell::SetLoadType() 660be505,,,,

Comment 7

[Judson Valeski]

off to future until we can repro this.

Comment 8

[MrEdwardHyde]

from Tucson Beta
Unable to reproducethe errors.   Many of the URL's listed as problems/test 
cases are not found.   Many would open a new browser window, and be slow to 
load, but no crashes or errors.

Comment 9

[Adam Lock]

Without any way to reproduce this bug I am marking it WORKSFORME

Comment 10

[Jay Patel [:jay]]

verified worksforme.  current talkback data shows this only happening with
Netscape 6.00 and 6.01 builds...nothing more recent.