83027 - Trunk crash [@ nsXBLPrototypeBinding::NotifyBoundElements]

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[greer]

This is a trunk crash on Windows and Linux. User comments point to a problem 
changing themes.

     (30884052) URL: x.themes.org
     (30884052) Comments: clicked on 'lcarkstrek' theme (or similiar...)
     (30815291) Comments: Install a theme
     (30811896) Comments: Changed themes
     (30968662) URL: http://jove.prohosting.com/~sonikku/E3/
     (30968662) Comments: Loaded mozilla and closed it - and it crashed!
     (30915564) Comments: Tried to go offline when editing a draft email and not
connected to a network.
     (30910128) Comments: I was opening mozilla build 2001052404 and have it set
to open both navigator and mail on startup.  my mail server uses S/IMAP and
requires presentation of a certificate.  i guess it didn't like having to do
that on startup...

Here's that stack:
         nsXBLPrototypeBinding::NotifyBoundElements()
         nsXBLPrototypeBinding::StyleSheetLoaded()
         CSSLoaderImpl::InsertSheetInDoc()
         InsertPendingSheet()
         nsVoidArray::EnumerateForwards()
         CSSLoaderImpl::Cleanup()
         CSSLoaderImpl::SheetComplete()
         CSSLoaderImpl::ParseSheet()
         CSSLoaderImpl::DidLoadStyle()
         SheetLoadData::OnStreamComplete()
         nsStreamLoader::OnStopRequest()
         nsJARChannel::OnStopRequest()
         nsOnStopRequestEvent::HandleEvent()
         nsARequestObserverEvent::HandlePLEvent()
         PL_HandleEvent()
         PL_ProcessEventsBeforeID()
         processQueue()
         nsVoidArray::EnumerateForwards()
         nsAppShell::ProcessBeforeID()
         handle_gdk_event()
         libgdk-1.2.so.0 + 0x174b7 (0x403224b7)
         libglib-1.2.so.0 + 0x10328 (0x40352328)
         libglib-1.2.so.0 + 0x10933 (0x40352933)
         libglib-1.2.so.0 + 0x10acc (0x40352acc)
         libgtk-1.2.so.0 + 0x8d667 (0x40273667)
         nsAppShell::Run()
         nsAppShellService::Run()
         main1()
         main()
         libc.so.6 + 0x1d2eb (0x4048e2eb)

Comment 1

[greer]

Adding keywords crash, topcrash for tracking

Comment 2

[Jay Patel [:jay]]

According to Talkback, this crash last occurred with build 2001052622.  Does
anyone know if something was fixed recently to prevent this crash?  

John, if you don't know of any recent checkins that would have fixed this crash
you might want to mark this worksforme.

Comment 3

[Shiva Thirumazhusai]

Jay, let us wait for few more days before we mark it resolved.

Comment 4

[Jay Patel [:jay]]

I spoke too soon...there were quite a few crashes with builds 2001052908 (linux)
and 2001052909 (win32)...here are the entries that had urls and/or comments
submitted within the last 3 days:

nsXBLPrototypeBinding::NotifyBoundElements f8874795
       
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp
line 1416
        Build: 2001052909 CrashDate: 2001-05-29 UptimeMinutes: 0  Total: 0 
        OS: Windows 98  4.10 build 67766446
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31070850
         StackTrace:
http://climate/reports/stackcommentemail.cfm?dynamicBBID=31070850
     (31070850) URL: slashdot.org
     (31070850) Comments: a broswer window opened up while finishing the install
of the latest nightly build (29 May).  Possibly the old version that I installed
from a zip.

    nsXBLPrototypeBinding::NotifyBoundElements be470fb2
       
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp
line 1416
        Build: 2001052909 CrashDate: 2001-05-29 UptimeMinutes: 0  Total: 0 
        OS: Windows NT  5.0 build 2195
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31070366
         StackTrace:
http://climate/reports/stackcommentemail.cfm?dynamicBBID=31070366
     (31070366) Comments: Installed Mozilla

    nsXBLPrototypeBinding::NotifyBoundElements() a6c45d4a
         line 
        Build: 2001052908 CrashDate: 2001-05-29 UptimeMinutes: 1  Total: 47 
        OS: Linux 2.4.2
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31069327
         StackTrace:
http://climate/reports/stackcommentemail.cfm?dynamicBBID=31069327
     (31069327) URL: http://www.time.com/time/asia/news/interview/0
     (31069327) Comments: was redirected from yahoo. lI clicked this
link:http://dailynews.yahoo.com/r/fcweb/World%2FChina_US_Relations/Magazine%20Articles/%27Please%20Let%20Him%20Come%20Home%20Immediately%27/*http://www.time.com/time/asia/news/interview/0
     (31069327) Comments: then hit back button

    
    nsXBLPrototypeBinding::NotifyBoundElements 4be0ecff
       
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp
line 1416
        Build: 2001052909 CrashDate: 2001-05-29 UptimeMinutes: 94  Total: 162 
        OS: Windows NT  4.0 build 1381
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31064988
         StackTrace:
http://climate/reports/stackcommentemail.cfm?dynamicBBID=31064988
     (31064988) URL:
http://www.sfgate.com/cgi-bin/article-list.cgi?key=SP&directory=/c/a/2001/05/29
     (31064988) Comments: 2001052905 on nt 4.0clikced on an imap account (but
maybe to fst)as i didnt get my first imap account...

    nsXBLPrototypeBinding::NotifyBoundElements 481f15bc
       
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp
line 1416
        Build: 2001052909 CrashDate: 2001-05-29 UptimeMinutes: 42  Total: 46 
        OS: Windows NT  5.0 build 2195
         Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31064660
         StackTrace:
http://climate/reports/stackcommentemail.cfm?dynamicBBID=31064660
     (31064660) Comments: Clicked on a PDF document

Comment 5

[Peter Trudelle]

->0.9.2

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

This is currently (6-2 report) the #4 topcrash.  Any chance someone could look
at it for 0.9.1?

Comment 7

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I think (since Windows talkback stacks are off-by-one) this is crashing on the line:

doc->FlushPendingNotifications();

Is it possible that |doc| is null?  It seems to me like it could be.  What would
be the correct way to handle that?

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

In particular, the |mDocument| of the content would be set to null through the
unrooting done in |DocumentViewerImpl::Destroy|, but the CSS loader wouldn't get
turned off until the XUL Document is destroyed, through
mCSSLoader->DropDocumentReference().  (What if we leak a XUL Document?)

And does this only become a problem given stylesheet scoping?

Comment 9

[Blake Ross]

*** Bug 83853 has been marked as a duplicate of this bug. ***

Comment 10

[Blake Ross]

Bug 83853 points out another case where this occurs, giving a fairly reliable 
way to reproduce it (but you'll likely need to disable the fatality of 
assertions in debug builds). 

Comment 11

[David Hyatt]

I think this is a pretty simple bulletproofing.  The list of mBoundElements held 
by a prototype binding is not dynamic.  In other words, if a bound element is 
removed from the doc before a scope stylesheet load completes, it will not be 
removed from mBoundElements, and I'll still try to notify it that its sheet is 
ready.

A removed element will have a null doc pointer, so I should just skip over that 
element in the notification process if I encounter a null doc.  I believe that 
will fix the problem.

Comment 12

[David Hyatt]

Attachment: Bulletproof crash.

Comment 13

[jag (Peter Annema)]

r=jag

Comment 14

[Blake Ross]

Is

+if (!doc)
+  continue;

cleaner?

sr=blake either way.

Comment 15

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to the trunk.
(on behalf of drivers)

Comment 16

[David Hyatt]

Fixed.

Comment 17

[Scott MacGregor]

*** Bug 86394 has been marked as a duplicate of this bug. ***