92816 - N610 crash clicking Back Fwd buttons in quick succession on bugzilla page [@ nsTimer::~nsTimer]

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect)

Description

[shrirang khanzode]

windows branch 0727

steps:
1 go to this page
2 Under 'Status', select "unconfirmed, new, assigned, reopened'
3 select 'QA Contact' and enter an email address in the textfield
4 Scroll down to the textfield titled 'Keyword' and enter "rel" inside the 
  textfield
5 Click on 'Submit Query" button and as soon as you see the "keyword error 
  message" , click BACK and then FWD button in the browser

 should crash. Checked this on 98 and win2k 

stack :
Stack Signature
               0x03b663ec 5fdae1bf 
 Bug ID
 Trigger Time 
               2001-07-30 11:02:31 
 User Comments 
 Build ID
               2001072700 
 Product ID
               Netscape6.10 
 Platform ID
               Win32 
 Stack Trace

0x03b663ec 
nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 426] 
netscp6.exe + 0x16f0 (0x004016f0) 
netscp6.exe + 0x11b8 (0x004011b8) 
netscp6.exe + 0x3397 (0x00403397) 
KERNEL32.dll + 0x1ba06 (0x77f1ba06)

Comment 1

[lchiang]

Shrir - was this reproducible on a build before the 26th?   Want to see if this
bug has always been there or showed up after Darin's branch fix.

Comment 2

[shrirang khanzode]

let me try... *installing older build now*

Comment 3

[shrirang khanzode]

I can reproduce on 0724 branch build too. so might not be a regression. 

Comment 4

[Radha on family leave (not reading bugmail)]

I'm presuming, this is in the branch. From the stack trace it doesn't look like
it is in the Session History component. The crash is in the event loop. I'm
pulling the branch now. 

Comment 5

[shrirang khanzode]

updated summary. To be able to repro this bug 100%, after clicking the BACK 
button, without waiting for the contents of the page to appear, click FORWARD 
button almost immediately...

Comment 6

[shrirang khanzode]

ok , crashed on cnn.com too this time. This is happening! Happned while I was 
rechecking bug 93445

newer and fresher stack trace:

Stack Signature
               nsTimer::~nsTimer 03469498 
 Bug ID
 Trigger Time 
               2001-08-03 12:47:30 
 User Comments 
               back fwd .BOOM~~ 
 Build ID
               2001080210 
 Product ID
               MozillaTrunk 
 Platform ID
               Win32 
 Stack Trace

nsTimer::~nsTimer 
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 123] 
nsTimer::`scalar deleting destructor' 
nsTimer::Release 
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 94] 
nsTimerManager::FireNextReadyTimer 
[d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimerManager.cpp, line 
119] 
nsAppShell::Run [d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp, 
line 118] 
nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 425] 
netscp6.exe + 0x174d (0x0040174d) 
netscp6.exe + 0x121a (0x0040121a) 
netscp6.exe + 0x368f (0x0040368f) 
KERNEL32.dll + 0x1ba06 (0x77f1ba06) 

Comment 7

[Radha on family leave (not reading bugmail)]

cc'ing dcone and rpotts who may be familiar with recent changes in the event
loop and timer code.

Comment 8

[dcone (gone)]

I just fixed a problem with this in printing, and the problem was that the 
nsDocumentViewer was being destroyed before printing was finished using it.  So 
I refcounted my use of the DocumentViewer, and and made sure in the Destroy 
method that printing was finished before it cleaned up.  Sounds like a simular 
problem, different battle.

Comment 9

[dcone (gone)]

see bug 90060 for more information on what happened with that bug.

Comment 10

[greer]

Adding stack signature to summary for future talkback tracking.

Comment 11

[Radha on family leave (not reading bugmail)]

shrir, can you try this in latest builds? Thanks,

Comment 12

[Claudius Gayle]

I just tried with the current build on Win98(2001081003) and I was able to
reproduce although I had to get a little aggressive on the back/fwd clicking. 
My stack was shorter but similar. I was unable to repro this after many tries
with a 2001080901 Linux build btw.

Stack Trace:
0x11433c91
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 425]
NETSCP6.EXE + 0x174d (0x0040174d)
NETSCP6.EXE + 0x121a (0x0040121a)
NETSCP6.EXE + 0x368f (0x0040368f)
KERNEL32.DLL + 0x1b537 (0xbff8b537)
KERNEL32.DLL + 0x1b3e9 (0xbff8b3e9)
KERNEL32.DLL + 0x19dac (0xbff89dac) 

Comment 13

[shrirang khanzode]

seems like this is windows only... linux is like Chevy Blazer...

Comment 14

[greer]

Adding crash and topcrash keywords. 

Lots of folks comment on getting this crash going to the cnn homepage. Some are 
seeing this one when they press 'Back' during a print job. Comments below.

Comment 15

[greer]

Attachment: Talkback user Comments

Comment 16

[Radha on family leave (not reading bugmail)]

dcone,  Looking thro' the comments, it seems to be happening while priting and
Priting followed by a back. What are the possible places I can put a breakpoint
to catch this one. What should I be looking for?
 Thanks,

Comment 17

[dcone (gone)]

there were problems with printing and hitting the back button, but those have 
been fixed.  The first problem was due to the document being switched out from 
under the printjob.. printing was still using the document, back button was hit 
and document gone.. crash.  That was fixed. Another problem was that the dialog 
was modless.. so the back button could be hit while the dialog was still up.. 
that is fixed also.  I get the feeling this bug is due to a reflow is still 
going on when the document is switched out, and some code started a timer which 
did not refcount the DocumentViewer, the DocumentViewer goes away and the timer 
crashes because the its listener is gone, thats my theory anyway.  In 
nsDocumentViewer look how the printtimer handles this refcount because DBaron 
did some stuff to explicitly take down the DocumentViewer.. so you not only have 
to refcount but make sure the destroy does not take down something you need. 

Comment 18

[Radha on family leave (not reading bugmail)]

I'm not able to reproduce this in my NT boz and in linux.  I did get aggressive
with the back/forward buttons. Is this still reproducible? 

Comment 19

[shrirang khanzode]

yeah, I tried with today's trunk 0824 on my NT and am unable to repro the crash 
mentioned in my steps mentioned above and also on cnn.com. Mysteriously fixed?

Comment 20

[Radha on family leave (not reading bugmail)]

shrir, How about in Win 98?  Adam lock fixed a crash bug 2 days ago related to 
cnn.com and the popup window it throws up setting editions. 

Comment 21

[shrirang khanzode]

adam lock's fix went in on the 20th. I went back on a number of builds and see 
that this crasher got fixed somehow between the 15th and 17th. It crashes on the 
15th build but not on the 17th trunk. spooky...

Comment 22

[shrirang khanzode]

and yeah..tried a win9 also. Does not crash on today's trunk 0824

Comment 23

[rpotts (gone)]

hey don,

did your printing fixes also take into account META-REFRESH or javascript timers
firing while the document was printing?

I bet that to be entirely safe we need a way to pospone dealing with
META-REFRESH or javascript timers if the current document is being printed...

As an aside, cnn.com currently uses a META-REFRESH tag :-)

-- rick

Comment 24

[Jay Patel [:jay]]

Talkback data shows that this crash (nsTimer::~nsTimer) last occurred with
MozillaTrunk build 2001081610. Although dcone seemed to have "fixed" this around
8/6, was there another checkin around 8/16 that could have fixed this for good?
 I guess if we can't reproduce this with the latest MozillaTrunk builds, we
should just mark this fixed.  Claudius?  

Comment 25

[Claudius Gayle]

I'm unable to reporduce with 20010910 builds and the talkback findings seem to
fall perfectly inline with
 Additional Comments From shrirang khanzode 2001-08-24 14:24;
"I went back on a number of builds and see 
that this crasher got fixed somehow between the 15th and 17th. It crashes on the 
15th build but not on the 17th trunk."
...so I'm going to mark this bug fixed and verified.

Comment 26

[Claudius Gayle]

VERIFIED Fixed with 20010910 builds