90294 - Crash [@ appshell!nsQueryReferent::operator=]

Status: RESOLVED WONTFIX

(Core :: Layout, defect, P1)

Description

[Thomas Guyot]

Mozilla crash log. Can't tell what exactly crashed it, I was playin with the
Forward/Back buttons with several windows open when it happened.

Mozilla 0.9.2, Win2k
Build ID: 2001062815

The log it too long to fit in there, sending as attachement.

Comment 1

[Thomas Guyot]

Attachment: DrWatson log

Comment 2

[Matthias Versen [:Matti]]

Reporter: 
We need a stack trace and/or clear steps to reproduce to fix crashes.
If you don't build yourself you can use a talkback enabled build.
After the crash run /components/talkback.exe und poste the Talkback ID# here.
With that talkback ID # [e-mail] can extract the stack trace from your crash.
If you can't add more informations, we will mark this bug invalid/worksforme.

Comment 3

[Asa Dotzler [:asa]]

probably bug 88343

Comment 4

[Thomas Guyot]

Well, the mozilla full installer doesn't install talkback, i had to use the
internet installer (The ~200k one) to get talkback installed, and i done this
after the crash, so no talkback events.

I thought a DrWatson log were enought. I also have a 176 MB memory dump (22.5 MB
.rar compressed) that came with the DrWatson log (user.dmp). If it can help you
ill send it, else mark it as invalid.

Ps: Are you sure the log doesn't have a stack trace? It contain a *----> Stack
Back Trace <----* sections followed by a *----> Raw Stack Dump <----* one for
each threads.

Comment 5

[Oliver Klee]

There's a stack trace at the Dr. Watson log indeed. Updating summary.

Comment 6

[Thomas Guyot]

Crashed again doing the same thing... I were in a bugzilla bug and pressed the
back button 2-3 times to get back to the query page. It crashed.

Now I have a Talkback ID ;-) It's ** TB32800678Y **

I can send a DrWatson log as well if you think it may help too. Also, you can
note that i had the newsreader open with big newsgroups (somes groups with 10000
to 30000 headers), so the memory usage were around 100mb

Comment 7

[Asa Dotzler [:asa]]

Incident ID 32800678
Stack Signature 0x1e884614 48c6434e
Bug ID
Trigger Time 2001-07-12 00:07:32
User Comments I pressed the back button 2 or 3 times in a row.
Build ID 2001062817
Product ID Netscape6.10
Platform ID Win32
Stack Trace
0x1e884614
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1467]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1485]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 8

[Keyser Sose]

Marking NEW.

Comment 9

[timeless]

1463 dp       1.108   NS_ASSERTION( NS_SUCCEEDED(rv), "NS_InitXPCOM failed" );
the stuff between is all xremote stuff.
1478 sfraser  1.206   nsresult mainResult = main1(argc, argv, nativeApp ? 
(nsISupports*)nativeApp : (nsISupports*)splash);

um,.... i'm tempted to ask for the rar file, but it's probably 
useless (most likely it contains 20 other crashes plus the data you already 
attached).  

grasping at straws, I'd love to believe something clobbered your call stack - 
but it doesn't fit, there aren't any threads doing stuff that would look like 
networking or... 

the problem is that your stack trace(s) imply mozilla doesn't really have 
windows ready for you to use ...

hrm, you have java running can you try a fresh install of mozilla and make sure 
that none of the java plugin files are present in moz or nc4's plugin 
directories?

checking through the drwatson report, the only thread that's more interesting 
is:
function: DebugBreak
        77eaaf10 ff25dc10e877     jmp     dword ptr [77e810dc]   
ds:77e810dc=77fa018c

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
1EF6FFB4 77E8758A 00000000 00B8FCBC 77FB9DA7 00000000 kernel32!DebugBreak 
1EF6FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetFilePointer 

Comment 10

[Thomas Guyot]

>um,.... i'm tempted to ask for the rar file, but it's probably 
>useless (most likely it contains 20 other crashes plus the data you already 
>attached).  

The dump contains only data from that crash.. It appear to be the dump of the 
memory used by moz, and maybe some other related stuff. (I checked with an hex 
editor. In the first pages, it contains the word mozilla several times..)

>hrm, you have java running can you try a fresh install of mozilla and make sure
>that none of the java plugin files are present in moz or nc4's plugin 
>directories?

I have the java plug-in installed so it copies the java plug-in files on 
install. For nc4, NPJava130_0*.dll are present, NPOJI600.dll is missing.

Have you looked to the crash with the talkback ID? I have a DrWatson log and 
dump for it too (Dump is 225 MB comp. to 35,4 MB .rar) These both crash 
happened while pressing few times the back button...

Comment 11

[timeless]

iirc NPOJI600.dll is old and can be trashed.

your log file probably contains all mozilla crashes (4-9).

please try renaming the log file, moving all the java plugins away (out of the 
nc4 dir) and installing fresh (delete the entire mozilla directory and 
mozreg.dat) again... hrm. i might even like a dependency walker log since that 
at least lets me check for forward progress... 
http://www.mozilla.org/quality/help/dependency-walker.html
attach the log (you should cause yoru crash while running mozilla from 
dependency walker) here as a zip file (application/zip) as most of us don't 
have rar support but anyone w/ mozilla has zip support. 

Comment 12

[Thomas Guyot]

I can't force the crash to happen, it just happen sometimes (rarely) when I 
press rapidly the back button few times...

I can send you a log (without crash) if you want, but if u need the crash on it 
cross your fingers while I use depends.exe to run mozilla...

I deleted the java dlls from the nc4 dir, but what they have to do with 
mozilla??? is it was really necessary?

And dont worry about me being able to use zip, i use rar just because it has a 
better compression algorithm. I can decompress almost any format.

And about the log file, i don't understant why you say that... It contained 
only one crash (at the time i sent it, mozilla had only crashed one time) and i 
can separate mozilla crashes easily from the log. (like I did for the log I 
sent, else if would have 6246864374 crashes before the mozilla one)

Comment 13

[Asa Dotzler [:asa]]

this is probably bug 88343

Comment 14

[Thomas Guyot]

I don't think so, but in case it is, I loged the crash. Ill send it in zip 
format

Comment 15

[Thomas Guyot]

Attachment: Dependency Walker log (zip format) after doing procedure cited in bug 88343

Comment 16

[timeless]

00:00:37.544: LoadLibraryA("USER32.dll") called from "c:\program 
files\mozilla.org\mozilla\components\FULLSOFT.DLL" at address 0x01627473 by 
thread 49.
00:00:37.544: LoadLibraryA("USER32.dll") returned 0x77E10000 by thread 49.
00:00:37.574: GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL], 
"PostMessageA") called from "c:\winnt\system32\WS2_32.DLL" at address 
0x7503E34E and returned 0x77E1595B by thread 49.
00:00:38.495: GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL], 
"PostMessageA") called from "c:\winnt\system32\WS2_32.DLL" at address 
0x7503E34E and returned 0x77E1595B by thread 49.
00:00:39.547: WM_DESTROY is called
00:00:39.547: GetProcAddress(0x50250000 
[c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\JAVA.DLL], 
"_Java_sun_awt_windows_WComponentPeer_hide@8") called from 
"c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\HPI.DLL" at address 0x5022118A and 
returned NULL by thread 1. Error: The specified procedure could not be found 
(127).
00:00:39.547: GetProcAddress(0x50020000 [c:\program 
files\javasoft\jre\1.3.0_01\bin\AWT.DLL], 
"_Java_sun_awt_windows_WComponentPeer_hide@8") called from 
"c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\HPI.DLL" at address 0x5022118A and 
returned 0x5004AFF0 by thread 1.
00:00:39.567: GetProcAddress(0x50250000 
[c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\JAVA.DLL], 
"_Java_sun_awt_windows_WComponentPeer_disable@8") called from 
"c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\HPI.DLL" at address 0x5022118A and 
returned NULL by thread 1. Error: The specified procedure could not be found 
(127).
00:00:39.567: GetProcAddress(0x50020000 [c:\program 
files\javasoft\jre\1.3.0_01\bin\AWT.DLL], 
"_Java_sun_awt_windows_WComponentPeer_disable@8") called from 
"c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\HPI.DLL" at address 0x5022118A and 
returned 0x5004B123 by thread 1.
00:00:39.607: GetProcAddress(0x50250000 
[c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\JAVA.DLL], 
"_Java_sun_awt_windows_WComponentPeer__1dispose@8") called from 
"c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\HPI.DLL" at address 0x5022118A and 
returned NULL by thread 28. Error: The specified procedure could not be found 
(127).
00:00:39.617: GetProcAddress(0x50020000 [c:\program 
files\javasoft\jre\1.3.0_01\bin\AWT.DLL], 
"_Java_sun_awt_windows_WComponentPeer__1dispose@8") called from 
"c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\HPI.DLL" at address 0x5022118A and 
returned 0x5004B625 by thread 28.
00:00:39.617: GetProcAddress(0x50250000 
[c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\JAVA.DLL], 
"_Java_sun_awt_windows_WFramePeer_getState@8") called from 
"c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\HPI.DLL" at address 0x5022118A and 
returned NULL by thread 28. Error: The specified procedure could not be found 
(127).
00:00:39.627: GetProcAddress(0x50020000 [c:\program 
files\javasoft\jre\1.3.0_01\bin\AWT.DLL], 
"_Java_sun_awt_windows_WFramePeer_getState@8") called from 
"c:\progra~1\javasoft\jre\1315b1~1.0_0\bin\HPI.DLL" at address 0x5022118A and 
returned 0x50052807 by thread 28.
00:00:39.787: Thread 50 started in "c:\winnt\system32\KERNEL32.DLL" at address 
0x77E87532.

...

00:01:48.185: First chance exception 0xC0000005 (Access Violation) occurred in 
"c:\program files\mozilla.org\mozilla\components\GKLAYOUT.DLL" at address 
0x603C2B9A by thread 1.
00:01:48.185: Second chance exception 0xC0000005 (Access Violation) occurred in 
"c:\program files\mozilla.org\mozilla\components\GKLAYOUT.DLL" at address 
0x603C2B9A by thread 1.

so this is the layout library? i'm guessing from the info that you're using a 
3dfx card, but on windows mozilla almost never cares so that shouldn't be an 
issue.  Most of these threads seem to be java related, and it's clear that 
mozilla found java. Again, please run mozilla in such a way that it _does not_ 
find java.

talkback gurus: Given the reporter's build id can i take the gklayout address 
and resolve it to a function/line number?

Comment 17

[Thomas Guyot]

For the java I told you the installer will copy the java dlls files to the 
plugins dir­. All I need to do is delete them and mozilla willnot use java.

So you want me to do the same steps I did (with dep walker) without java 
installed?

Comment 18

[timeless]

yes. well i said delete the files so the installer won't copy them. mozilla 
will find your nc4  plugins so you need to kill them from both places.

Comment 19

[Thomas Guyot]

Mozilla doesn't copy any plugins from nc4 dir. The only thing it copy is the 
java plugin files, so i deleted them. There were no plugins left execpt the 
plugin downloader one (come with mozilla)

Anyway... I did the same thing without any plugin installed, here's the 
depencency walker log...

Comment 20

[Thomas Guyot]

Attachment: Dependency Walker log after doing procedure cited in bug 88343 without plugins installed

Comment 21

[Jon Granrose]

this definitely shouldn't be assigned to leaf.  random punt to xpapps due to
stack being xpfe/bootstrap

Comment 22

[Paul Chen]

nav triage team:

Another fun one for Mr. Law. Reassigning to law

Comment 23

[Paul Chen]

nav triage team:

Marking nsbeta1+ to get off untriaged bug radar

Comment 24

[sairuh (rarely reading bugmail)]

->oji? pls retriage as needed...

Comment 25

[chris hofmann]

shiva, any matches with top crash data on this one?  maybe one for india team?

Comment 26

[Shiva Thirumazhusai]

There is no match in the Talkback Database for this stack signature
nsQueryReferent::operator=. It is not in the topcrash list. 

The following crash seem to be happening in different place than the above
mentioned Stack Signature. 
Incident ID 32800678
Stack Signature 0x1e884614 48c6434e

I have added this crash into our watch list. and I am forwarding this bug to our
india team. ccing vinay. 

Comment 27

[Rob Jaworski]

priority to P1

Comment 28

[Joe Chou]

Could not reproduce the problem with moz099. I went to bugzilla query, pulled out 
a list of bug reports, open a bug report, went to a URL in the bug report, back 
and forth severl times. Not crash.

Reporter, do you still see crashing with the recent builds?

By the way, this problem does not seem to have Java involved. It does not seem to
be an OJI bug, if still a problem. Re-assign to layout (back buttons). Please
re-assign if not right.

Comment 29

[Joe Chou]

Re-assign to layout owner.

Comment 30

[timeless]

.

Comment 31

[Marc Attinasi]

Closing as WONTFIX since it is really old, there is no talkback information on
this crash, no new information from reporter, and no ability to reproduce.

Comment 32

[Thomas Guyot]

For your information, there is a talback ID, it is TB32800678Y

However, I did not see this bug since 0.9.4 or so... It may have been already fixed.