90144 - M092 Trunk crash [@ nsXBLService::FetchBindingDocument]

Status: VERIFIED FIXED

(Core :: XBL, defect)

Description

[greer]

M092 release and Trunk releases through 20010702xx returned crashes at this 
signature.

         nsXBLService::FetchBindingDocument
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp  line 1256]
         nsXBLService::LoadBindingDocumentInfo
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp  line 1162]
         nsXBLService::GetBindingInternal
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp  line 940]
         nsXBLService::GetBindingInternal
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp  line 1074]
         nsXBLService::BindingReady
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp  line 914]
         nsXBLPrototypeBinding::NotifyBoundElements
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeBinding.cpp  line 
1409]
         nsXBLPrototypeBinding::StyleSheetLoaded
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeBinding.cpp  line 
1389]
         CSSLoaderImpl::InsertSheetInDoc
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 1113]
         InsertPendingSheet     
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp
line 667]
         nsVoidArray::EnumerateForwards 
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp  line
523]
         CSSLoaderImpl::Cleanup 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp
line 731]
         CSSLoaderImpl::SheetComplete
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 829]
         CSSLoaderImpl::ParseSheet
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 864]
         CSSLoaderImpl::DidLoadStyle
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 900]
         SheetLoadData::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp  line 655]
         nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp  line 122]
         nsJARChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp  line 
587]
         nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 
161]
         PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  
line 591]
         PL_ProcessPendingEvents        
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line
524]
         _md_EventReceiverProc  
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
         KERNEL32.DLL + 0x24407 (0xbff94407)
         0x00688b5e
 
Trunk comments:
     (32504360) URL: http://www.gownhire.co.uk
     (32413274) URL: http://www.adcritic.com/content/spec-nike-no-style.html

M092 comments:
     (32718409) Comments: Dump on startup
     (32639322) Comments: I went to the preferences dialog and clicked on two 
different panes really fast.

Comment 1

[Matthias Versen [:Matti]]

related to bug 81970 ?
(see the stack from [e-mail])

Comment 2

[Mike Pinkerton (not reading bugmail)]

hyatt, this is a topcrash, any chance of looking at this?

Comment 3

[Blake Ross]

Have there been any recent topcrashes with this stack? I don't crash at either
of the two urls provided, and no longer do I crash switching pref panes quickly
(I seem to recall that being fixes as part of another bug). I'm tempted to mark 
wfm.

Comment 4

[David Hyatt]

yes, I fixed this some time ago.  this bug is a dup.

Comment 5

[John Morrison]

Reopening. This is still showing up regularly in talkback queries, including 2
with the 7/28 win32 build (8 total in builds since 7/13).

And, I have reproduced this in an opt. build (with symbols) [although hyatt
may tell me I'm cheating (I am)]. But, I don't believe this crash is occurring
_only_ with XUL cache disabled [1].

Anyways, figuring that I would get a little more "asynch" behaviour, I
disabled the XUL cache. With that, I began quickly clicking between panels in
the pref dialog. I get a crash almost immediately, at line 1267 with
|aBoundDocument| being null.


1265 // Add ourselves to the list of loading docs.
1266 nsCOMPtr<nsIBindingManager> bindingManager;
1267 aBoundDocument->GetBindingManager(getter_AddRefs(bindingManager)); // :-(
1268 nsXPIDLCString uri;
1269 aURI->GetSpec(getter_Copies(uri));
1270 bindingManager->PutLoadingDocListener(nsCAutoString(NS_STATIC_CAST(const   
     char*, uri)), xblListener);


----
[1] Sidenote: speaking of XUL cache, shouldn't we ignore any pref that turns
this on in the Netscape release build? Is there any value in letting anyone
ever run in a _Netscape_ release with this disabled?.

Comment 6

[John Morrison]

> This is still showing up regularly in talkback queries, including 2
> with the 7/28 win32 build

Er, 7/18 build (i.e., today's build).

Comment 7

[Kathleen :Brade]

hyatt--given that we check for aBoundDocument being non-null earlier in the 
method, could we add a check between lines 1266 and 1267 as well?

Comment 8

[David Hyatt]

Attachment: Fix crash.

Comment 9

[Kathleen :Brade]

r=brade

Comment 10

[Blake Ross]

sr=blake

Comment 11

[David Hyatt]

Fixed ages ago.  I never closed it.

Comment 12

[Jay Patel [:jay]]

Verifying fixed.  Talkback data shows this last occurred in large numbers with
Netscape 6.10 build 2001072700 and not too many since then.