From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.4+) Gecko/20010925 BuildID: 2001092506 I get a reproducible crash when I open a new tab, switch to the first page and close it, then type a URL in to the URL bar and hit enter. Talkback IDs: TB35862178X TB35862369H TB35862424Q TB35862505G Reproducible: Always Steps to Reproduce: 1. Start browser and hit ctrl+t to open new tab. 2. Click on tab for original page and close it (closing the new tab will not cause the crash). 3. The page from the new tab is now the only page in the browser window. Type a URL in the location bar and hit enter. 4. Browser should now crash. Actual Results: browser crashes Expected Results: browser should now go to the new URL I was also able to reproduce this with three tabs open, also by closing the original page and attempting to go to a new URL from the location bar.

nsXULWindow::GetPrimaryContentShell() nsChromeTreeOwner::GetPrimaryContentShell() GlobalWindowImpl::GetContent() XPTC_InvokeByIndex() XPCWrappedNative::CallMethod() XPC_WN_GetterSetter() js_Invoke() js_InternalInvoke() js_GetProperty() js_Interpret() js_Invoke() js_InternalInvoke() js_Interpret() js_Invoke() nsXPCWrappedJSClass::CallMethod() nsXPCWrappedJS::CallMethod() PrepareAndDispatch() nsXPTCStubBase::Stub4() nsGlobalHistory::OnStartLookup() XPTC_InvokeByIndex() XPCWrappedNative::CallMethod() XPC_WN_CallMethod() js_Invoke() js_Interpret() js_Invoke() js_InternalInvoke() JS_CallFunctionValue() nsJSContext::CallEventHandler() GlobalWindowImpl::RunTimeout() nsGlobalWindow_RunTimeout() nsTimerGtk::FireTimeout() process_timers() TimerCallbackFunc() libglib-1.2.so.0 + 0x1122a (0x4034f22a)

I see this on win98, moz build 2001092503. After closing the first tab, I noticed the browser window title and url bar still had the first tab's information. I pressed the reload button to cause the crash.

Comment on attachment 50772 [details] [diff] [review] Fix crash. r=jag

*** Bug 101706 has been marked as a duplicate of this bug. ***

*** Bug 101751 has been marked as a duplicate of this bug. ***

r=blake

Fixed.

vrfy 2001092706/Linux

*** Bug 102454 has been marked as a duplicate of this bug. ***

Adding crash keyword and Trunk to summary for tracking. Reopening this bug also, since the latest Talkback data shows this crashing with MozillaTrunk builds after the checkin on 9/26. Here is the most recent crash and a few other incidents: Incident ID 36148634 Stack Signature nsXULWindow::GetPrimaryContentShell df7ac32f Trigger Time 2001-10-01 21:45:19 Email Address User Comments URL http://www.nikkansports.com/news/flash/top-fl.html Build ID 2001093011 Product ID MozillaTrunk Platform ID Win32 Trigger Reason Access violation Stack Trace nsXULWindow::GetPrimaryContentShell [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp, line 203] nsChromeTreeOwner::GetPrimaryContentShell [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsChromeTreeOwner.cpp, line 176] GlobalWindowImpl::GetContent [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 852] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 154] XPCWrappedNative::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1954] XPC_WN_GetterSetter [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 1287] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 900] js_GetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2433] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2559] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 900] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2813] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] nsXPCWrappedJSClass::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp, line 1024] nsXPCWrappedJS::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp, line 430] PrepareAndDispatch [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, line 117] SharedStub [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp, line 139] nsEventListenerManager::HandleEventSubType [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 1214] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 1733] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3719] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3700] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3700] nsXULElement::HandleChromeEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 5105] GlobalWindowImpl::HandleDOMEvent [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 616] nsDocument::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3024] nsEventStateManager::PreHandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 462] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5711] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5641] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 392] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 365] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 365] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2092] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 749] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 766] nsWindow::DispatchFocus [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4500] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3381] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1014] KERNEL32.DLL + 0x363b (0xbff7363b) KERNEL32.DLL + 0x245af (0xbff945af) Some other recent incidents: nsXULWindow::GetPrimaryContentShell af2fd852 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpfe/appshell/src/nsXULWindow.cpp line 203 Build: 2001100106 CrashDate: 2001-10-01 UptimeMinutes: 195 Total: 195 OS: Windows NT 5.0 build 2195 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=36145858 StackTrace: http://climate/reports/singleincidentinfo.cfm?dynamicBBID=36145858 (36145858) Comments: Selected the main tab and clicked close other tabs. nsXULWindow::GetPrimaryContentShell 42e0739d http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpfe/appshell/src/nsXULWindow.cpp line 203 Build: 2001093011 CrashDate: 2001-10-01 UptimeMinutes: 1217 Total: 1217 OS: Windows 98 4.10 build 67766446 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=36141909 StackTrace: http://climate/reports/singleincidentinfo.cfm?dynamicBBID=36141909 (36141909) Comments: Closed a tab. Don't know whether this is purely tab related since I can close other tabs fine. nsXULWindow::GetPrimaryContentShell 6c1d96e0 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpfe/appshell/src/nsXULWindow.cpp line 203 Build: 2001100109 CrashDate: 2001-10-01 UptimeMinutes: 3 Total: 3 OS: Windows 98 4.10 build 67766222 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=36141489 StackTrace: http://climate/reports/singleincidentinfo.cfm?dynamicBBID=36141489 (36141489) Comments: using mouse wheel - multizilla installed nsXULWindow::GetPrimaryContentShell 3174d996 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpfe/appshell/src/nsXULWindow.cpp line 203 Build: 2001093011 CrashDate: 2001-10-01 UptimeMinutes: 27 Total: 371 OS: Windows 95 4.0 build 67306684 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=36129968 StackTrace: http://climate/reports/singleincidentinfo.cfm?dynamicBBID=36129968 (36129968) URL: ftp.netscape...... nsXULWindow::GetPrimaryContentShell 4cf4b617 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpfe/appshell/src/nsXULWindow.cpp line 203 Build: 2001093011 CrashDate: 2001-10-01 UptimeMinutes: 63 Total: 108 OS: Windows NT 5.0 build 2195 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=36121981 StackTrace: http://climate/reports/singleincidentinfo.cfm?dynamicBBID=36121981 (36121981) Comments: I was closing a tab.(Using 'close tab' in the right button menu that appears when you click on the tab. There are quite a few more with MozillaTrunk builds 2001100109, 2001100106, 2001092806, 2001092809 and others.

FWIW, from talkback one can tell that the crash is here: if(shellInfo->primary) { *aDocShellTreeItem = shellInfo->child; NS_ADDREF(*aDocShellTreeItem); <=== CRASH HERE return NS_OK; } because *aDocShellTreeItem is null.

*** Bug 102454 has been marked as a duplicate of this bug. ***

*** Bug 102144 has been marked as a duplicate of this bug. ***

Mozilla 0.9.5 milestone, unable to reproduce. Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.5) Gecko/20011011

Oops -- Linux only. Sorry for the spam.

This continues to be a topcrasher on the MozillaTrunk...there are more crashes on Windows than Linux now, so changing OS to All. Here is the latest info from Talkback: Windows report: nsXULWindow::GetPrimaryContentShell 140 101554 ASSI hyatt@netscape.com mozilla1.0 BBID range: 36338719 - 36753150 Min/Max Seconds since last crash: 31 - 330772 Min/Max Runtime: 131 - 672920 Crash data range: 2001-10-06 to 2001-10-15 Build ID range: 2001100514 to 2001101510 Keyword List : load(9), browser(7), Stack Trace: nsXULWindow::GetPrimaryContentShell [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp line 203] nsChromeTreeOwner::GetPrimaryContentShell [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsChromeTreeOwner.cpp line 176] GlobalWindowImpl::GetContent [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp line 856] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp line 154] XPCWrappedNative::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp line 1953] XPC_WN_GetterSetter [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp line 1299] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 811] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 902] js_GetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c line 2434] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 2570] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 827] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 902] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 2570] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 827] nsXPCWrappedJSClass::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp line 1024] nsXPCWrappedJS::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp line 430] PrepareAndDispatch [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp line 117] SharedStub [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp line 139] nsEventListenerManager::HandleEventSubType [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp line 1214] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp line 1889] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 3719] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 3700] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 3700] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 3700] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 3700] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 3700] nsXULElement::HandleChromeEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 5113] GlobalWindowImpl::HandleDOMEvent [d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp line 620] DocumentViewerImpl::LoadComplete [d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp line 1110] nsDocShell::EndPageLoad [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp line 3751] nsWebShell::EndPageLoad [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp line 918] nsDocShell::OnStateChange [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp line 3672] nsDocLoaderImpl::FireOnStateChange [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 1110] nsDocLoaderImpl::doStopDocumentLoad [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 749] nsDocLoaderImpl::DocLoaderIsEmpty [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 647] nsDocLoaderImpl::DocLoaderIsEmpty [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 650] nsDocLoaderImpl::OnStopRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 578] nsLoadGroup::RemoveRequest [d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp line 530] nsLoadGroup::Cancel [d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp line 248] nsDocLoaderImpl::Stop [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 296] nsDocLoaderImpl::Stop [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 289] nsURILoader::Stop [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp line 562] nsDocShell::Stop [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp line 2310] nsDocShell::Destroy [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp line 2445] nsWebShell::Destroy [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp line 1412] nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame [d:\builds\seamonkey\mozilla\layout\html\document\src\nsFrameFrame.cpp line 696] nsHTMLFrameInnerFrame::`scalar deleting destructor' nsFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrame.cpp line 473] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp line 131] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp line 136] nsFrameList::DestroyFrame [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp line 217] nsBoxFrame::RemoveFrame [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp line 1226] FrameManager::RemoveFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp line 859] nsCSSFrameConstructor::ContentRemoved [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp line 9263] StyleSetImpl::ContentRemoved [d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp line 1222] PresShell::ContentRemoved [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 5113] nsXULDocument::ContentRemoved [d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp line 1894] nsXULElement::RemoveChildAt [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 2804] nsXULElement::RemoveChild [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 1226] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp line 154] XPCWrappedNative::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp line 1953] XPC_WN_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp line 1267] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 811] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 2733] Source File : http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/xpfe/appshell/src/nsXULWindow.cpp line : 203 (36740108) URL: http://www.zenulon-fr.com (36740108) Comments: OK... Open in new tab before end of current page download then trying to close current page with the "X" on the right of tab bar... (36740038) URL: http://www.zenulon-fr.com (36740038) Comments: open in new tab... (36727680) Comments: Ppened a page in a new tab. Saw a considerable delay during the creation of that tab. Tried to close another tab at the same time. (36716137) Comments: I was running with the Mozilla addon Multizilla 1.1.00 and had just clicked on the "Test" button on its toolbar. (36673249) URL: http://bofa.com/ (36673249) Comments: closing tab after logging off bofa.com (36671215) Comments: clicked on 'x' to close tab #2 (36668825) URL: http://www.n2.com (36668825) Comments: I was trying to close out of a new tab window using the X on the right side. I am using Windows XP RC2 build 2526.. (36653275) Comments: Could be tab-related. (36653232) Comments: closing a tab (36633552) Comments: I was trying to look at a yahoo club from clubs.yahoo.com. I also had another tab open where I was trying to look at mozillazine.org. The yahoo thing did not load. As I tried to close the yahoo tab the browser crashed. (36631598) URL: http://www.oreilly.com/ (36631598) Comments: I closed a tabbrowser tab. (36628641) URL: http://time.greenwich2000.com/ (36624771) URL: microsoft.com (36624771) Comments: I had two Navigator tabs open. The second tab was displaying Microsoft Knowledge Base article Q182901. I clicked on the "X" icon in the tab bar to close that tab. Mozilla then crashed.Here is the Visual C call stack:APPSHELL! 600b317e() (36614965) Comments: using multizilla w/ about 8 tabs (36604617) URL: www.msdn.microsoft.com (36604319) URL: http://www.theregister.co.uk (36595244) URL: developer.novell.com (36595244) Comments: Closing TAB (36588037) Comments: closing tab before laoded (36584420) URL: http://www.dvdpascher.net/home800.php3 (36574629) Comments: i hit the little "X" to close the first tab with two tabs visible (36566220) Comments: closing 2nd tab page was still loading (36564142) URL: www.msdn.microsoft.com (36564142) Comments: browse to code library (36561111) Comments: surfing with tabs (36559894) URL: www.theinquirer.net (36554024) Comments: closing a tab (36551459) Comments: I was closing a tab that was still loading I guess. (36551217) Comments: Second crash in a day with two windows open and one of them with tabbedbrowser and the other not. (36551095) Comments: closed tab (tab browser crash) (36550954) Comments: Closing a SSL page (36537702) Comments: closing a tabbed browser tab (36530895) URL: http://perso.wanadoo.fr/thierry.donati/index-1.htm (36530895) Comments: It's a page not found and it seems sometimes Wanadoo.fr's 404 page crashes Moz. [:(] (36524637) Comments: closing second tab (36506186) Comments: crash using "tabs" tried to close one tab while others were loading (36504874) URL: slashdot.org (36498700) Comments: Closing a tab that was still waiting on a webpage to load (36486808) Comments: closing a tab (36474920) Comments: Closing a tab (36465645) URL: http://www.submail.net/ (36463321) URL: eudoramail.com (36463321) Comments: Closing a tab that was still loading for eudoramail.com (36457727) URL: www.dacode.fr (36445685) URL: www.nvnews.net (36445685) Comments: Closing a tab. (36441444) Comments: Closing a tab (testing out the 'no pop-up windows with javascript') (36431856) URL: www.netzcape.com (36431207) URL: http://abcnews.go.com/wire/US/ap20011005_1305.html (36431207) Comments: hitting the x to close a tab in the tab display. (36416474) URL: http://www.novelsearch.net/database.cgi (36416474) Comments: close a tab (36405930) Comments: Testing bug 102144 again (36384166) URL: gamerankings.com / happypuppy.com (36384166) Comments: Gamerankings opens up new pages in frames. I had closed one of the frames (via a 'close frame' button on the site) and I clicked 'Back' from one of the non-framed pages which caused it to attempt to reload the frame+page version. It crashed there. (36384166) Comments: Multitabs although I wasn't actually tabbing at the time. (36379897) Comments: Closing the second of two open tabs (36377864) URL: www.startfrenzy.com (36377864) Comments: closing a tab .. and the browser crashed ... (36376145) URL: www.trafficg.com (36376145) Comments: opening a new tab in the window .. after it loaded .. closing it and the browser crashed .. had 4 tabs open .... (36341645) Comments: closing a tab while a link from the tabbed page was still trying to open (36338719) Comments: closing a focused tab while it was doing connecting: I believe crashed mozilla.. not necessarily doing transfering data. ---------------------------------------------------- Linux report: nsXULWindow::GetPrimaryContentShell 20 101554 ASSI hyatt@netscape.com mozilla1.0 BBID range: 36383816 - 36726082 Min/Max Seconds since last crash: 144 - 207521 Min/Max Runtime: 1293 - 264473 Crash data range: 2001-10-07 to 2001-10-15 Build ID range: 2001100606 to 2001101212 Keyword List : Stack Trace: nsXULWindow::GetPrimaryContentShell() nsChromeTreeOwner::GetPrimaryContentShell() GlobalWindowImpl::GetContent() XPTC_InvokeByIndex() XPCWrappedNative::CallMethod() XPC_WN_GetterSetter() js_Invoke() js_InternalInvoke() js_GetProperty() js_Interpret() js_Invoke() js_InternalInvoke() js_GetProperty() js_Interpret() js_Invoke() nsXPCWrappedJSClass::CallMethod() nsXPCWrappedJS::CallMethod() PrepareAndDispatch() nsXPTCStubBase::Stub3() nsEventListenerManager::HandleEventSubType() nsEventListenerManager::HandleEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleChromeEvent() GlobalWindowImpl::HandleDOMEvent() DocumentViewerImpl::LoadComplete() nsDocShell::EndPageLoad() nsWebShell::EndPageLoad() nsDocShell::OnStateChange() nsDocLoaderImpl::FireOnStateChange() nsDocLoaderImpl::doStopDocumentLoad() nsDocLoaderImpl::DocLoaderIsEmpty() nsDocLoaderImpl::DocLoaderIsEmpty() nsDocLoaderImpl::OnStopRequest() nsLoadGroup::RemoveRequest() nsLoadGroup::Cancel() nsDocLoaderImpl::Stop() nsDocLoaderImpl::Stop() nsURILoader::Stop() nsDocShell::Stop() nsDocShell::Destroy() nsWebShell::Destroy() nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame() nsFrame::Destroy() nsFrameList::DestroyFrames() nsContainerFrame::Destroy() nsFrameList::DestroyFrame() nsBoxFrame::RemoveFrame() FrameManager::RemoveFrame() nsCSSFrameConstructor::ContentRemoved() StyleSetImpl::ContentRemoved() PresShell::ContentRemoved() nsXULDocument::ContentRemoved() nsXULElement::RemoveChildAt() nsXULElement::RemoveChild() XPTC_InvokeByIndex() XPCWrappedNative::CallMethod() XPC_WN_CallMethod() js_Invoke() js_Interpret() js_Invoke() js_InternalInvoke() JS_CallFunctionValue() nsJSContext::CallEventHandler() nsJSEventListener::HandleEvent() nsEventListenerManager::HandleEventSubType() nsEventListenerManager::HandleEvent() nsXULElement::HandleDOMEvent() PresShell::HandleEventInternal() PresShell::HandleEventWithTarget() nsEventStateManager::CheckForAndDispatchClick() nsEventStateManager::PostHandleEvent() PresShell::HandleEventInternal() PresShell::HandleEvent() nsView::HandleEvent() nsViewManager::DispatchEvent() HandleEvent() nsWidget::DispatchEvent() nsWidget::DispatchWindowEvent() nsWidget::DispatchMouseEvent() nsWidget::OnButtonReleaseSignal() nsWindow::HandleGDKEvent() dispatch_superwin_event() handle_gdk_event() libgdk-1.2.so.0 + 0x17d74 (0x40335d74) libglib-1.2.so.0 + 0x10b86 (0x40367b86) libglib-1.2.so.0 + 0x111b3 (0x403681b3) libglib-1.2.so.0 + 0x1137c (0x4036837c) libgtk-1.2.so.0 + 0x92d2c (0x4027fd2c) nsAppShell::Run() nsAppShellService::Run() main1() main() libc.so.6 + 0x1cc6f (0x404b0c6f) (36692059) Comments: Closing a tab (tabbed browsing) (36690972) URL: www.desktopgirls.com (36690972) Comments: [;)] gotta love those pics I just happened to clicke tab close X near the top right also when I try to create an account on nntp it crashes set it up and click finish a friend of mine reported that this doesn't happen with him his nightly build # is (36690972) Comments: about 100 or so greater than but he had also had previous accounts setup before he installed it. (36654822) Comments: Using tabbed browsing (36649825) Comments: closing an tab while loading another page (36628695) Comments: Browsing sourceforge tracker with tabbed browsing (36512505) URL: http://www.xlr8yourmac.com/ (36512505) Comments: Clicking on a link in the forum. (36510426) Comments: Closed tab and browser crashed. Tabs seem to be veryunstable however very useful. (36386452) URL: http://listen.to/distort (36384713) URL: http://listen.to/distort

This is also a topcrasher for Mozilla 0.9.5. Adding M095 to summary and instead of filling this bug up with lots of Talkback data, I attached the topcrash report this time.

I'm running Milestone 0.9.5 on Windows 98 (Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.5) Gecko/20011011), and I am unable to reproduce the bug using the instructions in the comments

I can't repro either (2001101808/Linux)... but, then again, this is the first I've tested since I filed the bug so it may've been working for me ever since the bug was first marked fixed.

First I've tested since I verifyed the bug as fixed, that is :-\

See duplicate Bug 102144 for a way to reproduce this problem -- it's always worked for me. I suspect that lots of people are inadventantly reproducing it, seeing as how this is a topcrash bug! ;-)

So here's what's happening, at least at a very low level. There nsXULWindow::ContentShellAdded. Going in, the mContentShells array contains: true content-primary 0x88002bc false content 0x89c0404 and coming out it contains: true content-primary (nil) false content 0x88002bc so in this state GetPrimaryContentShell will crash. What *should* ContentShellAdded be doing? (BTW, while I was looking at that code I did a little string-use cleanup in it as well.)

This fixes the crash, but we then promptly crash in layout. There's a gaping architectural problem here, which is that iframes that are being torn down call Stop() on the docshell, which causes the page to attempt to display what it's got so far. WHen a docshell is being destroyed, this is ridiculous. We waste time firing onload, the parser calls DidBuildModel, we lay out and reflow, etc. etc. I'm happy to put my patch in, since it's a good fix anyway, but someone is going to need to look at the more serious architectural problem here.

Comment on attachment 54565 [details] [diff] [review] Patch to fix content shell crash r=dbaron

Fixed. hewitt was the sr.

*** Bug 106200 has been marked as a duplicate of this bug. ***

*** Bug 106660 has been marked as a duplicate of this bug. ***

no longer a problem. vrfy'd fixed using 2001.11.28.0x-comm bits on linux rh7.2, mac os 10.1.1 and winnt.