73858 - crash at end of profile migration; in Style System code

Status: RESOLVED DUPLICATE of bug 68208

(Core :: CSS Parsing and Computation, defect)

Description

[John Morrison]

For another bug, I blew away my profile directory completely. (e.g., on win2k
G:\Documents and Settings\Administrator\Application Data\Mozilla).

This will then offer to migrate your profile. Select the right hand (on win32)
button to "Manage Profiles" [it says 'Cancel' right now; that was the bug I
was fixing].

Then select your 4.x profile from the dialog that comes up after that, and
then 'start'. Say OK to the next dialog (allow it to convert).

The profile enters into the migration, but at some point I crash on this
stack, perhaps as the browser is starting up.

I was running with the build that had your changes Pierre. I can't reproduce
this in the 3/27 commercial build on win2k, but this is 100% in the build with
your style changes.


GKCONTENT! const  CSSStyleRuleImpl::`vftable'{for `nsIDOMCSSStyleRule'} address 
0x01a7949c
StyleContextImpl::ShareStyleData(StyleContextImpl * const 0x00000001) line 3427 
+ 20 bytes
StyleContextImpl::RemapStyle(StyleContextImpl * const 0x02dd84d0, 
nsIPresContext * 0x00d149c8, int 1) line 3267
NS_NewStyleContext(nsIStyleContext * * 0x0012e22c, nsIStyleContext * 
0x00d2d818, nsIAtom * 0x00000000, nsISupportsArray * 0x00dcd9c8, nsIPresContext 
* 0x00d149c8) line 3939
StyleSetImpl::GetContext(StyleSetImpl * const 0x00000001, nsIPresContext * 
0x00d149c8, nsIStyleContext * 0x00d2d818, nsIAtom * 0x00000000, 
nsISupportsArray * 0x00dcd9c8, int 0, int & 0) line 838 + 19 bytes
StyleSetImpl::ResolveStyleFor(StyleSetImpl * const 0x00000001, nsIPresContext * 
0x00dcd9c8, nsIContent * 0x00d60158, nsIStyleContext * 0x00d2d818, int 0) line 
923
nsPresContext::ResolveStyleContextFor(nsPresContext * const 0x00d149c8, 
nsIContent * 0x00d60158, nsIStyleContext * 0x00d2d818, int 0, nsIStyleContext * 
* 0x0012e2fc) line 656 + 15 bytes
nsCSSFrameConstructor::ResolveStyleContext(nsCSSFrameConstructor * const 
0x00000001, nsIPresContext * 0x00d149c8, nsIFrame * 0x00dabec8, nsIContent * 
0x00d60158, nsIAtom * 0x00bbef60, nsIStyleContext * * 0x0012e2fc) line 6715 + 
19 bytes
nsCSSFrameConstructor::ConstructFrame(nsCSSFrameConstructor * const 0x00000001, 
nsIPresShell * 0x00c84a90, nsIPresContext * 0x00d149c8, nsFrameConstructorState 
& {...}, nsIContent * 0x00bbef60, nsIFrame * 0x00dabec8, nsFrameItems & {...}) 
line 7070 + 26 bytes
nsCSSFrameConstructor::ProcessChildren(nsCSSFrameConstructor * const 
0x00000001, nsIPresShell * 0x00c84a90, nsIPresContext * 0x00d149c8, 
nsFrameConstructorState & {...}, nsIContent * 0x00d607b0, nsIFrame * 
0x00dabec8, int 0, nsFrameItems & {...}, int 0, nsTableCreator * 0x00d60158) 
line 11202
nsCSSFrameConstructor::ConstructXULFrame(nsCSSFrameConstructor * const 
0x00000001, nsIPresShell * 0x00c84a90, nsIPresContext * 0x00d149c8, 
nsFrameConstructorState & {...}, nsIContent * 0x00d607b0, nsIFrame * 
0x00d956fc, nsIAtom * 0x00bbedf8, int 12707264, nsIStyleContext * 0x00d2d818, 
nsFrameItems & {...}, int 12839104, int & 0) line 5809 + 27 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsCSSFrameConstructor * const 
0x00000001, nsIPresShell * 0x00c84a90, nsIPresContext * 0x00d149c8, 
nsFrameConstructorState & {...}, nsIContent * 0x00d607b0, nsIFrame * 
0x00d956fc, nsIAtom * 0x00bbedf8, int 6, nsIStyleContext * 0x00d2d818, 
nsFrameItems & {...}, int 0) line 7186
nsCSSFrameConstructor::ConstructFrame(nsCSSFrameConstructor * const 0x00000001, 
nsIPresShell * 0x00c84a90, nsIPresContext * 0x00d149c8, nsFrameConstructorState 
& {...}, nsIContent * 0x00bbedf8, nsIFrame * 0x00d956fc, nsFrameItems & {...}) 
line 7085 + 35 bytes
nsCSSFrameConstructor::ProcessChildren(nsCSSFrameConstructor * const 
0x00000001, nsIPresShell * 0x00c84a90, nsIPresContext * 0x00d149c8, 
nsFrameConstructorState & {...}, nsIContent * 0x00d33010, nsIFrame * 
0x00000000, int 1, nsFrameItems & {...}, int 0, nsTableCreator * 0x00d607b0) 
line 11202
nsCSSFrameConstructor::ConstructDocElementFrame(nsCSSFrameConstructor * const 
0x00000001, nsIPresShell * 0x00c84a90, nsIPresContext * 0x00d149c8, 
nsFrameConstructorState & {...}, nsIContent * 0x00d33010, nsIFrame * 
0x00d95670, nsIStyleContext * 0x00de013c, nsIFrame * &) line 3540
nsCSSFrameConstructor::ReconstructDocElementHierarchy(nsCSSFrameConstructor * 
const 0x00d966a8, nsIPresContext * 0x00d95670) line 7285
StyleSetImpl::ReconstructDocElementHierarchy(StyleSetImpl * const 0x00d32f58, 
nsIPresContext * 0x00d149c8) line 1207
PresShell::ReconstructFrames(PresShell * const 0x00000001) line 4476
PresShell::StyleSheetRemoved(PresShell * const 0x00c84a98, nsIDocument * 
0x00c1e5c0, nsIStyleSheet * 0x024c2948) line 4493
nsXULDocument::UpdateStyleSheets(nsXULDocument * const 0x00000001, 
nsISupportsArray * 0x024c2948, nsISupportsArray * 0x00000001) line 1189
nsChromeRegistry::RefreshWindow(nsChromeRegistry * const 0x00b85330, 
nsIDOMWindowInternal * 0x02508c78) line 1235 + 18 bytes
nsChromeRegistry::RefreshSkins(nsChromeRegistry * const 0x00b0e3a0) line 1073
nsChromeRegistry::LoadProfileDataSource(nsChromeRegistry * const 0x00000001) 
line 2721
nsChromeRegistry::Observe(nsChromeRegistry * const 0x00b85334, nsISupports * 
0x00b51b40, const unsigned short * 0x00faa300 `string', const unsigned short * 
0x00faa3d4 `string') line 3078 + 8 bytes
nsObserverService::Notify(nsObserverService * const 0x00d5f9f8, nsISupports * 
0x00b51b40, const unsigned short * 0x00faa300 `string', const unsigned short * 
0x00faa3d4 `string') line 238
nsProfile::SetCurrentProfile(nsProfile * const 0x00000000, const unsigned short 
* 0x024d1058) line 995
nsProfile::StartApprunner(nsProfile * const 0x00b51b40, const unsigned short * 
0x024d1058) line 1574 + 12 bytes
XPTC_InvokeByIndex(nsISupports * 0x00b51b40, unsigned int 17, unsigned int 1, 
nsXPTCVariant * 0x0012eb80) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(nsXPCWrappedNativeClass * const 
0x00000001, JSContext * 0x00c1b748, nsXPCWrappedNative * 0x00d2c4f0, const 
XPCNativeMemberDescriptor * 0x00cccdec, nsXPCWrappedNativeClass::CallMode 
16777216, unsigned int 1, long * 0x024d4124, long * 0x0012ed00) line 937
WrappedNative_CallMethod(JSContext * 0x00cc8b78, JSObject * 0x00d80a50, 
unsigned int 1, long * 0x024d4124, long * 0x0012ed00) line 250 + 99 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 0) line 781 + 17 
bytes
js_Interpret(JSContext * 0x00c1b748, long * 0x0012ef58) line 2675
js_Invoke(JSContext * 0x00000001, unsigned int 1, unsigned int 2) line 798 + 10 
bytes
js_InternalInvoke(JSContext * 0x00000000, JSObject * 0x00d81108, long 14163200, 
unsigned int 0, unsigned int 1, long * 0x0012f120, long * 0x0012f068) line 870 
+ 13 bytes
JS_CallFunctionValue(JSContext * 0x00c1b748, JSObject * 0x00d81108, long 
14163200, unsigned int 1, long * 0x0012f120, long * 0x0012f068) line 3299 + 25 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x00bbfff8, void * 
0x00d81108, void * 0x00d81d00, unsigned int 1, void * 0x0012f120, int * 
0x0012f124, int 0) line 940 + 25 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x00000001, 
nsIDOMEvent * 0x024d678c) line 154 + 32 bytes
nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const 
0x00000001, nsListenerStruct * 0x00c3e680, nsIDOMEvent * 0x024d678c, 
nsIDOMEventTarget * 0x00c9c8f0, unsigned int 38627220, unsigned int 13224184) 
line 916 + 8 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x00000001, 
nsIPresContext * 0x00000000, nsEvent * 0x0012f5fc, nsIDOMEvent * * 0x0012f45c, 
nsIDOMEventTarget * 0x00c9c8f0, unsigned int 7, nsEventStatus * 0x0012f658) 
line 1844 + 16 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x00000000, nsIPresContext * 
0x00d149c8, nsEvent * 0x024d6794, nsIDOMEvent * * 0x0012f45c, unsigned int 1, 
nsEventStatus * 0x0012f658) line 3635
PresShell::HandleDOMEventWithTarget(PresShell * const 0x00c84a90, nsIContent * 
0x00b96880, nsEvent * 0x0012f5fc, nsEventStatus * 0x0012f658) line 5111
nsButtonBoxFrame::MouseClicked(nsButtonBoxFrame * const 0x00000001, 
nsIPresContext * 0x00d149c8, nsGUIEvent * 0x0012f734) line 181
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x00da3dd4, 
nsIPresContext * 0x00d149c8, nsGUIEvent * 0x0012f734, nsEventStatus * 
0x0012f910) line 128
PresShell::HandleEventInternal(PresShell * const 0x00000001, nsEvent * 
0x0012f734, nsIView * 0x00000000, unsigned int 1, nsEventStatus * 0x0012f910) 
line 5076 + 20 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x00c84a90, nsEvent * 
0x0012f734, nsIFrame * 0x00da3dd4, nsIContent * 0x00c9c8e8, unsigned int 1, 
nsEventStatus * 0x0012f910) line 5043
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 
0x00c84a90, nsIPresContext * 0x00d149c8, nsMouseEvent * 0x0012f950, 
nsEventStatus * 0x0012f910) line 2073
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x00d967a8, 
nsIPresContext * 0x00d149c8, nsEvent * 0x0012f950, nsIFrame * 0x00da3dd4, 
nsEventStatus * 0x0012f910, nsIView * 0x00ccd438) line 1176 + 17 bytes
PresShell::HandleEventInternal(PresShell * const 0x00000001, nsEvent * 
0x00c9c8e8, nsIView * 0x00ccd438, unsigned int 1, nsEventStatus * 0x0012f910) 
line 5081 + 23 bytes
PresShell::HandleEvent(PresShell * const 0x00c84a90, nsIView * 0x00ccd438, 
nsGUIEvent * 0x0012f950, nsEventStatus * 0x0012f910, int 1, int & 1) line 4996 
+ 17 bytes
nsView::HandleEvent(nsView * const 0x00000005, nsGUIEvent * 0x00d9ca08, 
unsigned int 28, nsEventStatus * 0x0012f910, int 1, int & 1) line 372
nsViewManager::DispatchEvent(nsViewManager * const 0x0000131a, nsGUIEvent * 
0x00000107, nsEventStatus * 0x0012f910) line 1982
HandleEvent(nsGUIEvent * 0x00c1e7c0) line 68
nsWindow::DispatchEvent(nsWindow * const 0x00d316d4, nsGUIEvent * 0x0012f950, 
nsEventStatus & nsEventStatus_eIgnore) line 688 + 6 bytes
nsWindow::DispatchWindowEvent(nsWindow * const 0x00000001, nsGUIEvent * 
0x00000000) line 709
nsWindow::DispatchMouseEvent(nsWindow * const 0x00000001, unsigned int 301, 
nsPoint * 0x00000000) line 3985
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x00000001, unsigned int 
301, nsPoint * 0x00000000) line 4192 + 15 bytes
nsWindow::ProcessMessage(nsWindow * const 0x00000001, unsigned int 514, 
unsigned int 0, long 17236294, long * 0x0012fb6c) line 3018
nsWindow::WindowProc(HWND__ * 0x001107c4, unsigned int 514, unsigned int 0, 
long 13833940) line 943 + 16 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x00b63e40) line 408
nsProfile::LoadDefaultProfileDir(nsProfile * const 0x00000001, nsCString & 
{...}) line 427
nsProfile::LoadDefaultProfileDir(nsProfile * const 0x00000001, nsCString & 
{...}) line 448
nsProfile::StartupWithArgs(nsProfile * const 0x00b51b40, nsICmdLineService * 
0x00b1bed8) line 369
InitializeProfileService(nsICmdLineService * 0x00b1bed8) line 786
main1(int 2, char * * 0x00372ba8, nsISupports * 0x00372bd0) line 970
main(int 2, char * * 0x00372ba8) line 1298 + 25 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x001335a2, 
HINSTANCE__ * 0x00400000) line 1316 + 21 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e87903()


and in StyleContextImpl::ShareStyleData (line 3849) of nsStyleContext.cpp

  if (bEnableSharing && bSharingSupported) {
    // set the CRC
    mStyleData->SetCRC32();

    NS_ASSERTION(mStyleSet, "Expected to have a style set ref...");
    nsIStyleContext *matchingSC = nsnull;

    // check if there is a matching context...
*-> result = mStyleSet->FindMatchingContext(this, &matchingSC);   <--** BOOM
    if ((NS_SUCCEEDED(result)) && 
        (nsnull != matchingSC)) {


|this| has a value of 0x00000001 (can that be right?)

Comment 1

[John Morrison]

Say, Pierre. Did you have a look at this crash? It was in a build that had
your style changes, but not in a release build.

Comment 2

[Pierre Saslawsky]

Marc checked in a fix for this on 04/14.  I merged it in my tree on 04/16.

jrgm: the latest builds you got with my patch should be ok.


*** This bug has been marked as a duplicate of 68208 ***