90235 - M092 crash [@ nsXBLService::LoadBindings ]

Status: VERIFIED FIXED

(SeaMonkey :: Bookmarks & History, defect, P1)

Description

[greer]

This stack is showing up again in M092 with comments similar to those in bug 
67427 with the same signature. Opening a new bug for M092.

Talkback report info: 

         nsXBLService::LoadBindings
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp  line 640]
         nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp  
line 7173]
         nsCSSFrameConstructor::CreateTreeWidgetContent
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp  
line 12442]
         nsXULTreeGroupFrame::GetFirstTreeBox
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeGroupFrame.cpp  line 
304]
         nsTreeLayout::LazyRowCreator
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsTreeLayout.cpp  line 343]
         nsXULTreeOuterGroupFrame::ReflowFinished
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp  
line 1323]
         PresShell::HandlePostedReflowCallbacks
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 4705]
         PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5894]
         PresShell::FlushPendingNotifications
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 4796]
         nsXULTreeOuterGroupFrame::InternalPositionChanged
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp  
line 781]
         nsXULTreeOuterGroupFrame::InternalPositionChangedCallback
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp  
line 695]
         nsScrollSmoother::Notify
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp  
line 210]
         nsTimerManager::FireNextReadyTimer
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp  line 
117]
         nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 419]
         PR_AtomicDecrement     [../../../../pr/src/misc/pratom.c  line 292]
         nsMemoryImpl::Release  
[d:\builds\seamonkey\mozilla\xpcom\base\nsMemoryImpl.cpp  line 201]
         nsCOMPtr_base::~nsCOMPtr_base  
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp  line
50]
         NS_InitXPCOM2  [d:\builds\seamonkey\mozilla\xpcom\build\nsXPComInit.cpp  
line 415]
         nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 419]
         main1  [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  
line 1168]
         main   [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  
line 1467]
         WinMain        
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1485]
         WinMainCRTStartup()
         KERNEL32.DLL + 0x1b560 (0xbff8b560)
         KERNEL32.DLL + 0x1b412 (0xbff8b412)
         KERNEL32.DLL + 0x19dd5 (0xbff89dd5)

(32616641)  Comments: opening and closing folders while browsing the filesystem 
tree!!It keeps crashing! it is very repeatable: just click on
an arrowto close a folder and then double click on a folder
     (32504498) Comments: Browsing bookmarks menu
     (32501876) URL: www.alsa-project.org
     (32501876) Comments: waiting for page to load
     (32449406) Comments: paging through a search
     (32411481) URL: www.google.com
     (32411481) Comments: searching

Comment 1

[Viswanath Ramachandran]

adding xptoolkit folks. this is a topcrash and shd be PDT+ if we can reproduce 
it and find a fix. Saari/Hyatt - could you take it? thanks! Vishy

Comment 2

[Viswanath Ramachandran]

Looks like waterson already checked in a null check for document on 07/03/2001
(after m092) as part of fixing bug 85422, CVS revision 1.120. This crash seems
to be the same as that ( at least from line number in the stack trace). Waterson
could you confirm that we can close this bug as a dupe?

Oh and the null document check seems to be on the branch tooo. 

Comment 3

[John Morrison]

If the line numbers are accurate, then for the source code used to build 
the binaries that crashed, then it looks like the null check for |document| 
is not sufficient, since it crashes past the point where |document| is 
dereferenced. 

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xbl/src/nsXBLServic
e.cpp&rev=1.119

634 nsCOMPtr<nsIDocument> document;
635 aContent->GetDocument(*getter_AddRefs(document)); // null check inserted 
636 nsCOMPtr<nsIBindingManager> bindingManager;       // between these lines
637 document->GetBindingManager(getter_AddRefs(bindingManager));
638 
639 nsCOMPtr<nsIXBLBinding> binding;
640 bindingManager->GetBinding(aContent, getter_AddRefs(binding)); //<-- crash
641 if (binding && !aAugmentFlag) {
 ...

On the other hand, I don't see any talkback reports with a build ID later than
June 28 when I did a query on climate just now, so ...

Comment 4

[chris hofmann]

waterson is on vacation so we will need to figure this one out with his help.
he will be back Monday if we really need him

Comment 5

[Paul Chen]

nav triage team:

Marking nsbeta1+, p1, and mozilla1.0. If John is correct, then maybe it's been 
fixed already? At any rate, doesn't look like the bug as67427, right clicking on 
bookmarks works fine on a mozilla 0.9.2 mac branch build that I built this 
morning.

Comment 6

[Viswanath Ramachandran]

moving to mozilla0.9.4 as topcrash. 

Comment 7

[chris hofmann]

taking the nsbeta1+ off to avoid some confusion.

Comment 8

[Jan Carpenter]

This stack sig is not showing up in M093, trunk, or N610 talkback topcrash reports.

Comment 9

[Jan Carpenter]

Also not in M094 talkback topcrash report.
In fact, I did a search on the database and only found 5 reports, the most
recent of which was 2001060713   Netscape6.10B1

I'm marking this fixed.  If someone is still having this, please reopen.

Comment 10

[Claudius Gayle]

ok. marking VERIFIED Fixed