Closed Bug 749635 Opened 12 years ago Closed 2 years ago

crash in nsCOMPtr_base::~nsCOMPtr_base | nsDocShell::LoadHistoryEntry

Categories

(Core :: Layout, defect)

ARM
Android
defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
blocking-fennec1.0 --- -

People

(Reporter: martijn.martijn, Unassigned)

References

()

Details

(Keywords: crash, testcase, Whiteboard: [native-crash])

Crash Data

Steps to reproduce:
- Go to testcase
- Tap on the tab menu to open tab list popup
- Wait for at least 10 seconds, then close the tab with the testcase
- Tap on the "Resend" button in the dialog

Result: crash

Tested on the Samsung Galaxy SII and the Samsung Galaxy Nexus.

This bug was filed from the Socorro interface and is 
report bp-b5ce0a53-3118-4ef9-b083-6f4e52120427 .
============================================================= 
0 	libxul.so 	nsCOMPtr_base::~nsCOMPtr_base 	obj-firefox/xpcom/build/nsCOMPtr.cpp:81
1 	libxul.so 	nsDocShell::LoadHistoryEntry 	nsCOMPtr.h:480
2 	libxul.so 	nsDocShell::LoadURI 	docshell/base/nsDocShell.cpp:1419
3 	libxul.so 	nsFrameLoader::ReallyStartLoadingInternal 	content/base/src/nsFrameLoader.cpp:496
4 	libxul.so 	nsFrameLoader::ReallyStartLoading 	content/base/src/nsFrameLoader.cpp:432
5 	libxul.so 	nsDocument::MaybeInitializeFinalizeFrameLoaders 	content/base/src/nsDocument.cpp:5505
6 	libxul.so 	nsDocument::EndUpdate 	content/base/src/nsDocument.cpp:4048
7 	libxul.so 	nsHTMLDocument::EndUpdate 	content/html/document/src/nsHTMLDocument.cpp:2275
8 	libxul.so 	nsHtml5TreeOpExecutor::EndDocUpdate 	parser/html/nsHtml5TreeOpExecutor.h:294
9 	libxul.so 	nsHtml5TreeOpExecutor::RunFlushLoop 	parser/html/nsHtml5TreeOpExecutor.cpp:572
10 	libxul.so 	nsHtml5ExecutorFlusher::Run 	parser/html/nsHtml5StreamParser.cpp:160
11 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:656
blocking-fennec1.0: --- → ?
Summary: crash in nsCOMPtr_base:: → crash in nsCOMPtr_base::~nsCOMPtr_base | nsDocShell::LoadHistoryEntry]
Hardware: All → ARM
Summary: crash in nsCOMPtr_base::~nsCOMPtr_base | nsDocShell::LoadHistoryEntry] → crash in nsCOMPtr_base::~nsCOMPtr_base | nsDocShell::LoadHistoryEntry
Whiteboard: [native-crash]
blocking-fennec1.0: ? → -
Component: General → Layout
Product: Fennec Native → Core
QA Contact: general → layout
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)
Status: RESOLVED → REOPENED
Resolution: WONTFIX → ---
QA Whiteboard: qa-not-actionable
Severity: critical → S2

Unfortunately the testcase here was on people.m.o file-hosting, which is now gone.

Fortunately it was captured by the wayback machine:
https://web.archive.org/web/20220000000000*/https://people.mozilla.org/~mwargers/tests/forms/formautosubmit_reload.htm

Live/direct version at archive.m.o:
https://web.archive.org/web/20150905003810id_/https://people.mozilla.org/~mwargers/tests/forms/formautosubmit_reload.htm

HTML source:

<html><head>
<title>autosubmit after 500ms</title>

<style>
</style>
</head>
<body>
<iframe src="formautosubmit_reload.htm?1"></iframe>

<form method="post"></form>

<script>
var result = document.getElementById('result');
function doe() {
 if (window == top)
  window.frames[0].document.forms[0].submit();
}
setTimeout(doe, 1000);
setTimeout(function() {window.location.reload();}, 4000);
</script>
</body>
</html>

I can't reproduce any crash with my above "Live/direct version at archive.m.o" link. I tested Firefox Nightly 107 on desktop and on Android.

Note I can't quite perform the STR -- in particular this part (on Android):

  • Wait for at least 10 seconds, then close the tab with the testcase
  • Tap on the "Resend" button in the dialog

In current Firefox-for-Android versions, the dialog pops up during the "wait for at least 10 seconds" period of the STR; and it's a modal dialog, so can't close the tab until I've handled the dialog. There's no way for me to close the tab first and then click resend on the dialog.

Nonetheless: I tried a few different things and am unable to repro a crash, so this seems to be not an issue at this point.

Status: REOPENED → RESOLVED
Closed: 6 years ago2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.