This crash showed up on 3/18...there was one incident with a build from that day. Then there were 14 crashes with builds from 3/20 and there have been single incidents in the last couple of days. There aren't any user comments, so hopefully we can figure out what's going on from the stack. Here's the latest from Talkback: nsAssignmentSet::GetAssignmentFor 16 96533 VERI DUPL mscott@netscape.com --- 2001-08-24 96282 VERI FIXE waterson@netscape.com mozilla0.9.4 2001-09-10 BBID range: 4192686 - 4332673 Min/Max Seconds since last crash: 80 - 10936 Min/Max Runtime: 116 - 17706 Crash data range: 2002-03-18 to 2002-03-21 Build ID range: 2002031809 to 2002032110 Keyword List : Stack Trace: nsAssignmentSet::GetAssignmentFor [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsRuleNetwork.cpp line 597] nsTemplateMatch::GetAssignmentFor [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsTemplateMatch.cpp line 52] nsXULTemplateBuilder::SubstituteTextReplaceVariable [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTemplateBuilder.cpp line 1168] nsXULTemplateBuilder::ParseAttribute [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTemplateBuilder.cpp line 1077] nsXULTemplateBuilder::SubstituteText [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTemplateBuilder.cpp line 1125] nsXULContentBuilder::BuildContentFromTemplate [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp line 783] nsXULContentBuilder::CreateTemplateContents [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp line 1380] nsXULContentBuilder::CreateTemplateAndContainerContents [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp line 1209] nsXULContentBuilder::CreateContents [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp line 1761] nsXULElement::EnsureContentsGenerated [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 3661] nsXULElement::ChildCount [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp line 2184] ChildIterator::Init [d:\builds\seamonkey\mozilla\layout\html\style\src\nsChildIterator.cpp line 74] nsCSSFrameConstructor::ProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp line 12208] nsCSSFrameConstructor::ConstructXULFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp line 5696] nsCSSFrameConstructor::ConstructFrameInternal [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp line 7209] nsCSSFrameConstructor::CreateTreeWidgetContent [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp line 13246] nsXULTreeGroupFrame::GetFirstTreeBox [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeGroupFrame.cpp line 329] nsTreeLayout::LazyRowCreator [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsTreeLayout.cpp line 363] nsTreeLayout::LazyRowCreator [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsTreeLayout.cpp line 374] nsXULTreeOuterGroupFrame::ReflowFinished [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp line 1351] PresShell::HandlePostedReflowCallbacks [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 4959] PresShell::ResizeReflow [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 2858] PresShell::ResizeReflow [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp line 6132] nsViewManager::SetWindowDimensions [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp line 589] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp line 1776] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp line 83] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 869] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 886] nsWindow::OnResize [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 4571] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 3831] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 1131] USER32.dll + 0x3a5f (0x77cf3a5f) USER32.dll + 0x9797 (0x77cf9797) USER32.dll + 0x5874 (0x77cf5874) USER32.dll + 0x962b (0x77cf962b) ntdll.dll + 0x108f (0x77f5108f) DocumentViewerImpl::SetBounds [d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp line 1653] nsDocShell::SetPositionAndSize [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp line 2696] nsWebShellWindow::HandleEvent [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp line 434] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 869] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 886] nsWindow::OnResize [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 4571] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 3831] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp line 1131] USER32.dll + 0x3a5f (0x77cf3a5f) USER32.dll + 0x9797 (0x77cf9797) USER32.dll + 0x5874 (0x77cf5874) USER32.dll + 0x962b (0x77cf962b) ntdll.dll + 0x108f (0x77f5108f) nsXULWindow::SetSize [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp line 528] nsXULWindow::LoadSizeFromXUL [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp line 1026] nsXULWindow::OnChromeLoaded [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsXULWindow.cpp line 876] nsWebShellWindow::OnStateChange [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsWebShellWindow.cpp line 1282] nsDocLoaderImpl::FireOnStateChange [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 1110] nsDocLoaderImpl::doStopDocumentLoad [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 750] nsDocLoaderImpl::DocLoaderIsEmpty [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 647] nsDocLoaderImpl::OnStopRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp line 578] nsLoadGroup::RemoveRequest [d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp line 531] nsJARChannel::OnStopRequest [d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp line 604] nsOnStopRequestEvent::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp line 213] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 591] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 524] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 1072] USER32.dll + 0x3c076 (0x77d2c076) Source File : http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/xul/templates/src/nsRuleNetwork.cpp line : 597 I wonder if some checkin on 3/18 caused this regression.

Adding crash keywords and nominating for nsbeta1 since this has potential to be a major topcrasher. Also adding qawanted to see if anyone has crashed with this stack signature or is able to find steps to reproduce.

jpatel, Are we still seeing this crash in recent talkback reports?

Yes, there are still incidents showing up with recent MozillaTrunk builds. Here is the latest crash: Incident ID 4744170 Stack Signature nsAssignmentSet::GetAssignmentFor 54db780a Trigger Time 2002-04-02 11:55:20 Email Address URL visited Build ID 2002040110 Product ID MozillaTrunk Platform Operating System Win32 Module Trigger Reason Access violation User Comments 1. open History 2. ensure that you have grouped the entries by day 3. right-click on "3 days ago" select the first "unseen" entry. crash. Stack Trace nsAssignmentSet::GetAssignmentFor [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsRuleNetwork.cpp, line 596] nsTemplateMatch::GetAssignmentFor [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsTemplateMatch.cpp, line 52] nsXULTreeBuilder::GetResourceFor [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTreeBuilder.cpp, line 1541] nsXULTreeBuilder::ToggleOpenState [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTreeBuilder.cpp, line 857] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 106] XPCWrappedNative::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2027] XPC_WN_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 1267] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 790] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2746] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 806] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 881] JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3414] nsJSContext::CallEventHandler [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1019] nsJSEventListener::HandleEvent [d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 182] nsEventListenerManager::HandleEventSubType [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 1218] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 2210] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3461] PresShell::HandleDOMEventWithTarget [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6128] nsMenuFrame::Execute [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 1682] nsMenuFrame::HandleEvent [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsMenuFrame.cpp, line 466] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6097] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6003] nsViewManager::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2064] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 306] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1875] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 869] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 886] nsWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4712] ChildWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4962] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3629] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1131] KERNEL32.DLL + 0x363b (0xbff7363b) KERNEL32.DLL + 0x242e7 (0xbff942e7) 0x00648c16 And here are a couple crashes with comments I found in Talkback data: - 4651247 2002032010 MozillaTrunk Windows NT 5.0 build 2195 2002-03-30 18:22:38 nsAssignmentSet::GetAssignmentFor 209ed121 80 13641 ftp://elby.de/download/SetupCloneCD.exe Download of EXE file was failed. - 4626794 2002032010 MozillaTrunk Windows NT 5.0 build 2195 2002-03-29 20:33:33 nsAssignmentSet::GetAssignmentFor 209ed121 51 13108 http://www.ragnarok.co.kr/jp/r_patch.htm Downloaded(ftp) patch_izlude_j.exe from this page and saved it. Then Mozilla was died. This also appears to be a topcrasher for Netscape 6.22...and almost all the user comments for that release (Netscape6.22 2002031420) mention working with bookmards. Here is one of those incidents: Incident ID 4707618 Stack Signature nsAssignmentSet::GetAssignmentFor a64c6324 Trigger Time 2002-04-01 14:20:54 Email Address sbraun@birch.net URL visited Build ID 2002031420 Product ID Netscape6.22 Platform Operating System Win32 Module Trigger Reason Access violation User Comments I was editing bookmarks - cutting and pasting them when the program crashed. I installed 6.2 because 4.7 was constantly crashing. Stack Trace nsAssignmentSet::GetAssignmentFor [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsRuleNetwork.cpp, line 583] nsTemplateMatch::GetAssignmentFor [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsTemplateMatch.cpp, line 36] nsXULTemplateBuilder::SubstituteTextReplaceVariable [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTemplateBuilder.cpp, line 1156] nsXULTemplateBuilder::ParseAttribute [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTemplateBuilder.cpp, line 1065] nsXULTemplateBuilder::SubstituteText [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULTemplateBuilder.cpp, line 1113] nsXULContentBuilder::BuildContentFromTemplate [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp, line 758] nsXULContentBuilder::CreateTemplateContents [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp, line 1347] nsXULContentBuilder::CreateTemplateAndContainerContents [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp, line 1182] nsXULContentBuilder::CreateContents [d:\builds\seamonkey\mozilla\content\xul\templates\src\nsXULContentBuilder.cpp, line 1768] nsXULElement::EnsureContentsGenerated [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 4010] nsXULElement::ChildCount [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 2530] ChildIterator::ChildIterator [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 919] nsCSSFrameConstructor::ProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 11671] nsCSSFrameConstructor::ConstructXULFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 5961] nsCSSFrameConstructor::ConstructFrameInternal [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 7372] nsCSSFrameConstructor::CreateTreeWidgetContent [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 12700] nsXULTreeGroupFrame::GetFirstTreeBox [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeGroupFrame.cpp, line 304] nsTreeLayout::LazyRowCreator [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsTreeLayout.cpp, line 343] nsTreeLayout::LazyRowCreator [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsTreeLayout.cpp, line 354] nsXULTreeOuterGroupFrame::ReflowFinished [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp, line 1323] PresShell::HandlePostedReflowCallbacks [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4840] PresShell::ProcessReflowCommands [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6044] PresShell::FlushPendingNotifications [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4934] nsXULTreeOuterGroupFrame::InternalPositionChanged [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp, line 781] nsXULTreeOuterGroupFrame::InternalPositionChangedCallback [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp, line 695] nsScrollSmoother::Notify [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsXULTreeOuterGroupFrame.cpp, line 210] FireTimeout [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 78] KERNEL32.DLL + 0x2317 (0xbff72317) FireTimeout [d:\builds\seamonkey\mozilla\widget\timer\src\windows\nsTimer.cpp, line 51] USER32.DLL + 0x3bb5 (0xbff53bb5) 0x30860003 0x46890167

Taking.

I suspect that this may have to do with bugs that occur when >1 row in the rdfliner has the same URL (e.g., two bookmarks to same page in different folders). I'm having a tough time reproducing it though (although I was able to find plenty of other bugs). claudius, ben, alecf: do you guys know of any bookmarks or history window crashers that occur with >1 page with the same URL in the tree?

first I've heard of such an issue, sorry

Historically, we have always had problems with the "two bookmarks to the same url" scenario, but amazingly, none of those were ever crashers(I believe). More to the point,in messing with this recently I haven't been able to generate any crashes.

Adding M1RC1 and M1BR to summary since this is also a topcrasher with Mozilla1.0 RC1 and on the Mozilla1.0 branch. It is also interesting to note that after a while of not seeing any crashes on the MozillaTrunk, there have been A LOT starting with 4/29 builds. But this time the comments mention downloading files: Source File : nsRuleNetwork.cpp line : 597 ==================================================================================================== Count Offset Real Signature [ 43 nsAssignmentSet::GetAssignmentFor f813596b - nsAssignmentSet::GetAssignmentFor ] Crash date range: 2002-04-29 to 2002-05-01 Min/Max Seconds since last crash: 12 - 69559 Min/Max Runtime: 12 - 70152 Keyword List : Count Platform List 18 Windows NT 5.0 build 2195 11 Windows NT 5.1 build 2600 7 Windows 98 4.90 build 73010104 7 Windows 98 4.10 build 67766446 Count Build Id List 12 2002042908 11 2002050104 10 2002043010 7 2002050108 2 2002043003 1 2002042903 No of Unique Users 22 Stack trace(Frame) nsAssignmentSet::GetAssignmentFor [nsRuleNetwork.cpp line 597] nsTemplateMatch::GetAssignmentFor [nsTemplateMatch.cpp line 52] nsXULTemplateBuilder::SubstituteTextReplaceVariable [nsXULTemplateBuilder.cpp line 1168] nsXULTemplateBuilder::ParseAttribute [nsXULTemplateBuilder.cpp line 1077] nsXULTemplateBuilder::SubstituteText [nsXULTemplateBuilder.cpp line 1125] nsXULContentBuilder::BuildContentFromTemplate [nsXULContentBuilder.cpp line 783] nsXULContentBuilder::CreateTemplateContents [nsXULContentBuilder.cpp line 1380] nsXULContentBuilder::CreateTemplateAndContainerContents [nsXULContentBuilder.cpp line 1209] nsXULContentBuilder::CreateContents [nsXULContentBuilder.cpp line 1760] nsXULElement::EnsureContentsGenerated [nsXULElement.cpp line 3668] nsXULElement::ChildCount [nsXULElement.cpp line 2189] nsXULElement::GetChildNodes [nsXULElement.cpp line 782] nsXULElement::GetElementsByTagName [nsXULElement.cpp line 3698] nsXULElement::GetElementsByTagName [nsXULElement.cpp line 3732] nsXULElement::GetElementsByTagName [nsXULElement.cpp line 3732] nsXULElement::GetElementsByTagName [nsXULElement.cpp line 3732] nsXULElement::GetElementsByTagName [nsXULElement.cpp line 1439] XPTC_InvokeByIndex [xptcinvoke.cpp line 106] XPCWrappedNative::CallMethod [xpcwrappednative.cpp line 1995] XPC_WN_CallMethod [xpcwrappednativejsops.cpp line 1267] js_Invoke [jsinterp.c line 790] js_Interpret [jsinterp.c line 2744] js_Invoke [jsinterp.c line 806] js_InternalInvoke [jsinterp.c line 881] JS_CallFunctionValue [jsapi.c line 3414] nsJSContext::CallEventHandler [nsJSEnvironment.cpp line 1019] nsJSEventListener::HandleEvent [nsJSEventListener.cpp line 184] nsXBLPrototypeHandler::ExecuteHandler [nsXBLPrototypeHandler.cpp line 447] nsXBLPrototypeHandler::BindingAttached [nsXBLPrototypeHandler.cpp line 495] nsXBLPrototypeBinding::BindingAttached [nsXBLPrototypeBinding.cpp line 440] nsXBLBinding::ExecuteAttachedHandler [nsXBLBinding.cpp line 1039] nsBindingManager::ProcessAttachedQueue [nsBindingManager.cpp line 913] nsCSSFrameConstructor::ContentInserted [nsCSSFrameConstructor.cpp line 8974] nsCSSFrameConstructor::ContentAppended [nsCSSFrameConstructor.cpp line 8254] StyleSetImpl::ContentAppended [nsStyleSet.cpp line 1515] PresShell::ContentAppended [nsPresShell.cpp line 5155] nsXULDocument::ContentAppended [nsXULDocument.cpp line 2276] nsXULContentBuilder::Rebuild [nsXULContentBuilder.cpp line 1739] nsXULContentBuilder::Rebuild [nsXULContentBuilder.cpp line 1748] XPTC_InvokeByIndex [xptcinvoke.cpp line 106] XPCWrappedNative::CallMethod [xpcwrappednative.cpp line 1995] XPC_WN_CallMethod [xpcwrappednativejsops.cpp line 1267] js_Invoke [jsinterp.c line 790] js_Interpret [jsinterp.c line 2744] js_Invoke [jsinterp.c line 806] js_InternalInvoke [jsinterp.c line 881] JS_CallFunctionValue [jsapi.c line 3414] nsJSContext::CallEventHandler [nsJSEnvironment.cpp line 1019] nsJSEventListener::HandleEvent [nsJSEventListener.cpp line 184] nsEventListenerManager::HandleEventSubType [nsEventListenerManager.cpp line 1220] nsEventListenerManager::HandleEvent [nsEventListenerManager.cpp line 1895] GlobalWindowImpl::HandleDOMEvent [nsGlobalWindow.cpp line 755] DocumentViewerImpl::LoadComplete [nsDocumentViewer.cpp line 1538] nsDocShell::EndPageLoad [nsDocShell.cpp line 3958] nsWebShell::EndPageLoad [nsWebShell.cpp line 731] nsDocShell::OnStateChange [nsDocShell.cpp line 3875] nsDocLoaderImpl::FireOnStateChange [nsDocLoader.cpp line 1105] nsDocLoaderImpl::doStopDocumentLoad [nsDocLoader.cpp line 744] nsDocLoaderImpl::DocLoaderIsEmpty [nsDocLoader.cpp line 642] nsDocLoaderImpl::OnStopRequest [nsDocLoader.cpp line 573] nsLoadGroup::RemoveRequest [nsLoadGroup.cpp line 531] imgRequestProxy::OnStopRequest [imgRequestProxy.cpp line 391] imgRequest::OnStopRequest [imgRequest.cpp line 645] ProxyListener::OnStopRequest [imgLoader.cpp line 692] (5836703) Comments: When downloading via ftp. (5813430) Comments: Do Save Link Target As...

This crash spiked a huge amount starting in the 2002-04-29-03 build. I'm guessing that's because download manager was turned on by default (see bug 137440), since many of the user comments refer to things that could trigger download manager. (I was just looking at this code, and it seems a little fishy. Does |ConstIterator|'s |mCurrent| need to be a strong pointer? If it doesn't, then why is it? If it does, then doesn't |operator++()| risk |Release|ing the whole list by releasing the current element before |AddRef|ing the next element? That said, I think there's no way it would cause a crash here because I think the answer is that it doesn't need to own a reference, but I'm a bit curious.)

Parameters and Local Variables in the crashed function. nsAssignmentSet::GetAssignmentFor this = Register variable - data not available aVariable = 5 (0x00000005) aValue = 0x0064cecc mType = 0 (0x00000000) mISupports = 0x0064d080 mString = 0x0064d080 (*mString) = 109 (0x006d) mInteger = 6606976 (0x0064d080) assignment = {nsAssignmentSet::ConstIterator} mCurrent = 0x6068502c (*mCurrent) = Data not available

This patch isn't a fix, but it should help to diagnose the crash. I think that either we're walking off the end of the content model without finding the template's `root' element, or we don't have a match in the content support map. If the former is true, this crash should move to somewhere in CreateTemplateContents. If the latter, then we should see the crash in BuildContentFromTemplate.

This second patch is wallpaper. I'd propose this for the mozilla-1.0 branch.

So, I'd like to check attachment 82531 [details] [diff] [review] in on the trunk to help isolate the real cause of the crash. For the branch, attachment 82532 [details] [diff] [review] is some wallpaper that should stop us from crashing altogether (albeit with other errors of omission, I'm sure).

Comment on attachment 82532 [details] [diff] [review] wallpaper sr=alecf

Comment on attachment 82531 [details] [diff] [review] crash isolation won't the while (1) cause an infinite loop if the template root is never encountered? (or is there some key break; outsite the scope of this patch?)

Yep. There's a `break' about ten lines above where the patch stops. :-) So, if we're actually walking off the end of the content model, we should crash dereferencing a null pointer.

Here's a bit more context (same patch as 82531).

->topcrash+

Comment on attachment 82539 [details] [diff] [review] crash isolation with context i'm still not sure I understand why this won't go into an infinite loop.. if it gets all the way to the top of the loop with element == null, then GetElementRefResource() will get a nsnull as a first parameter, but will that guarantee a crash? if not, I can't imagine resource will have a value, so the break; will never happen.. ? Sorry, still confused here :)

Comment on attachment 82532 [details] [diff] [review] wallpaper r=rjc

We'll crash when we call |element->GetParent|.

Comment on attachment 82539 [details] [diff] [review] crash isolation with context oh. heh. Duh. :) sr=alecf

Comment on attachment 82539 [details] [diff] [review] crash isolation with context r=rjc

Okay, attachment 82539 [details] [diff] [review] checked in on the trunk. With luck, we should soon see a different topcrash emerge. (Now WTF do I have to do to get the other patch on the branch?)

Adding adt1.0.0+ for checking the wallpaper patch into the Mozilla1.0 branch after getting a=drivers. In addition, please check the wallpaper patch into the Netscape PR1 branch tonight for inclusion in to Mach V Beta.

Please hold off on the Netscape PR1 branch checkin. If we have to respin, we'll reconsider it.

So, things are not as I thought they were. The changes on the trunk did _not_ move the crash, which indicates that the wallpaper will have little effect. Removing the `please put this on the branch' keywords until we have something that actually works.

Removing from meta-bugs, too, restoring [adt2] grafitti.

Ah, ok! Now we're getting somewhere. The most recent talkback trace shows that |aMatch| is actually zero! (It just ended up crashing in the same place.) So, we're finding the content node fine, but the match isn't in the content support map. With that in mind, I'll reverse myself and say that we probably ought to try the wallpaper on the branch.

so wall paper it is??? are we ready to squish this #39 RC2 topcrash today?

Updating summary with M1RC2 since this is a topcrasher with Mozilla 1.0 RC2.

Comment on attachment 82532 [details] [diff] [review] wallpaper a=chofmann,shaver,dbaron\ for the 1.0 branch. triple handshake completed.

Attachment 82532 [details] [diff] checked in on the branch.

ready to be marked fixed?

posthumus adt1.0.0+. Is this gonna be checked into the trunk?

I'm going to try to find the real problem on the trunk. Honest.

*** Bug 134111 has been marked as a duplicate of this bug. ***

I've seen a similar crash that's a side effect of a problem adding elements to the folder pane where we get duplicate entries for newly added containers and crash collapsing the second "fake" container - if you're having trouble finding a reproducible case for this, Chris, let me know. Here's the stack trace I see: nsAssignmentSet::List::AddRef() line 426 + 10 bytes ns_if_addref(nsAssignmentSet::List * 0xd8d8d8d8) line 122 + 14 bytes nsAssignmentSet::ConstIterator::ConstIterator(nsAssignmentSet::List * 0xd8d8d8d8) line 464 + 19 bytes nsAssignmentSet::First() line 509 + 21 bytes nsAssignmentSet::GetAssignmentFor(int 0x00000002, Value * 0x0012f198) line 596 + 12 bytes nsTemplateMatch::GetAssignmentFor(nsConflictSet & {...}, int 0x00000002, Value * 0x0012f198) line 51 + 19 bytes nsXULTreeBuilder::GetResourceFor(int 0x00000004) line 1541 nsXULTreeBuilder::IsContainerOpen(nsXULTreeBuilder * const 0x02008a10, int 0x00000004, int * 0x0012f248) line 585 + 22 bytes nsTreeBodyFrame::PrefillPropertyArray(int 0x00000004, nsTreeColumn * 0x00000000) line 1678 nsTreeBodyFrame::PaintRow(nsTreeBodyFrame * const 0x03cdabe8, int 0x00000004, const nsRect & {...}, nsIPresContext * 0x031f96b0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Underlay) line 2134 nsTreeBodyFrame::Paint(nsTreeBodyFrame * const 0x03cdabe8, nsIPresContext * 0x031f96b0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Underlay, unsigned int 0x00000000) line 2063 PresShell::Paint(PresShell * const 0x031fab0c, nsIView * 0x03ce2480, nsIRenderingContext & {...}, const nsRect & {...}) line 5816 + 36 bytes nsView::Paint(nsView * const 0x03ce2480, nsIRenderingContext & {...}, const nsRect & {...}, unsigned int 0x00000000, int & 0x0012f530) line 280

*** Bug 150832 has been marked as a duplicate of this bug. ***

*** Bug 150727 has been marked as a duplicate of this bug. ***

i think i found a reproducible test --see bug 150727. note, however, that i had seen this only on Mac OS X with that test. ymmv.

Is this crash related to downloading files ? I encounter this kind of problem (reproducible crash whan trying to download a file) with trunk, since 1.1alpha (latest I tested was 20020614, and it still crashes). I don't have this problem with 1.0 that I'm using on this computer.

*** Bug 152533 has been marked as a duplicate of this bug. ***

Dup bug 152533 gives a test case that reliably crashes BuildID 2002061717 (trunk) on Linux for me (and reporter of that bug claims it crashes for him under both Windows and Linux). To reproduce: 1) Go to the above URL (http://www.fanqiang.com/a3/b2/20010419/153800.html), 2) Copy some of the text from the page. 3) File -> Save page as. 4) Paste the text copied in (2) as file name and click on "Save". Note that if I just use a normal ASCII filename, it does not crash. Also, it writes the file out before crashing (but does not bring up the d/l manager window, unless I use a non-crashing ASCII filename). (gdb) bt #0 0x411e71f7 in nsAssignmentSet::GetAssignmentFor () from /usr/lib/mozilla/components/libgkcontent.so #1 0x411e8a1c in nsTemplateMatch::GetAssignmentFor () from /usr/lib/mozilla/components/libgkcontent.so #2 0x41201388 in nsXULTemplateBuilder::SubstituteTextReplaceVariable () from /usr/lib/mozilla/components/libgkcontent.so #3 0x41200d0b in nsXULTemplateBuilder::ParseAttribute () from /usr/lib/mozilla/components/libgkcontent.so #4 0x412011b2 in nsXULTemplateBuilder::SubstituteText () from /usr/lib/mozilla/components/libgkcontent.so #5 0x411eb67f in nsXULContentBuilder::BuildContentFromTemplate () from /usr/lib/mozilla/components/libgkcontent.so #6 0x411ed2c1 in nsXULContentBuilder::CreateTemplateContents () from /usr/lib/mozilla/components/libgkcontent.so #7 0x411ecb89 in nsXULContentBuilder::CreateTemplateAndContainerContents () from /usr/lib/mozilla/components/libgkcontent.so #8 0x411ee82e in nsXULContentBuilder::CreateContents () from /usr/lib/mozilla/components/libgkcontent.so #9 0x411b80f8 in nsXULElement::EnsureContentsGenerated () from /usr/lib/mozilla/components/libgkcontent.so #10 0x411b3da0 in nsXULElement::ChildCount () from /usr/lib/mozilla/components/libgkcontent.so #11 0x411b0e8b in nsXULElement::GetChildNodes () from /usr/lib/mozilla/components/libgkcontent.so #12 0x411b8223 in nsXULElement::GetElementsByTagName () from /usr/lib/mozilla/components/libgkcontent.so #13 0x411b8620 in nsXULElement::GetElementsByTagName () from /usr/lib/mozilla/components/libgkcontent.so #14 0x411b8620 in nsXULElement::GetElementsByTagName () from /usr/lib/mozilla/components/libgkcontent.so #15 0x411b8620 in nsXULElement::GetElementsByTagName () from /usr/lib/mozilla/components/libgkcontent.so #16 0x411b246a in nsXULElement::GetElementsByTagName () from /usr/lib/mozilla/components/libgkcontent.so #17 0x401a5e0c in XPTC_InvokeByIndex () from /usr/lib/libxpcom.so #18 0x4073c14e in XPCWrappedNative::CallMethod () from /usr/lib/mozilla/components/libxpconnect.so #19 0x40742500 in XPC_WN_CallMethod () from /usr/lib/mozilla/components/libxpconnect.so #20 0x400a1a1f in js_Invoke () from /usr/lib/libmozjs.so #21 0x400a9f95 in js_Interpret () from /usr/lib/libmozjs.so #22 0x400a1a80 in js_Invoke () from /usr/lib/libmozjs.so #23 0x400a1c82 in js_InternalInvoke () from /usr/lib/libmozjs.so #24 0x40081462 in JS_CallFunctionValue () from /usr/lib/libmozjs.so #25 0x41017f80 in nsJSContext::CallEventHandler () from /usr/lib/mozilla/components/libjsdom.so #26 0x41049248 in nsJSEventListener::HandleEvent () from /usr/lib/mozilla/components/libjsdom.so #27 0x4121931b in nsXBLPrototypeHandler::ExecuteHandler () from /usr/lib/mozilla/components/libgkcontent.so #28 0x412195c6 in nsXBLPrototypeHandler::BindingAttached () from /usr/lib/mozilla/components/libgkcontent.so #29 0x4120b054 in nsXBLPrototypeBinding::BindingAttached () from /usr/lib/mozilla/components/libgkcontent.so #30 0x41207b3b in nsXBLBinding::ExecuteAttachedHandler () from /usr/lib/mozilla/components/libgkcontent.so #31 0x41225677 in nsBindingManager::ProcessAttachedQueue () from /usr/lib/mozilla/components/libgkcontent.so #32 0x41a19ff3 in nsCSSFrameConstructor::ContentInserted () from /usr/lib/mozilla/components/libgklayout.so #33 0x41a181e5 in nsCSSFrameConstructor::ContentAppended () from /usr/lib/mozilla/components/libgklayout.so #34 0x41292961 in StyleSetImpl::ContentAppended () from /usr/lib/mozilla/components/libgkcontent.so #35 0x419c7ed5 in PresShell::ContentAppended () from /usr/lib/mozilla/components/libgklayout.so #36 0x411cd55a in nsXULDocument::ContentAppended () from /usr/lib/mozilla/components/libgkcontent.so #37 0x411ee78c in nsXULContentBuilder::Rebuild () from /usr/lib/mozilla/components/libgkcontent.so #38 0x411ee7ef in nsXULContentBuilder::Rebuild () from /usr/lib/mozilla/components/libgkcontent.so #39 0x401a5e0c in XPTC_InvokeByIndex () from /usr/lib/libxpcom.so #40 0x4073c14e in XPCWrappedNative::CallMethod () from /usr/lib/mozilla/components/libxpconnect.so #41 0x40742500 in XPC_WN_CallMethod () from /usr/lib/mozilla/components/libxpconnect.so #42 0x400a1a1f in js_Invoke () from /usr/lib/libmozjs.so #43 0x400a9f95 in js_Interpret () from /usr/lib/libmozjs.so #44 0x400a1a80 in js_Invoke () from /usr/lib/libmozjs.so #45 0x400a1c82 in js_InternalInvoke () from /usr/lib/libmozjs.so #46 0x40081462 in JS_CallFunctionValue () from /usr/lib/libmozjs.so #47 0x41017f80 in nsJSContext::CallEventHandler () from /usr/lib/mozilla/components/libjsdom.so #48 0x41049248 in nsJSEventListener::HandleEvent () from /usr/lib/mozilla/components/libjsdom.so #49 0x410b692a in nsEventListenerManager::HandleEventSubType () from /usr/lib/mozilla/components/libgkcontent.so #50 0x410b86a8 in nsEventListenerManager::HandleEvent () from /usr/lib/mozilla/components/libgkcontent.so #51 0x4101c889 in GlobalWindowImpl::HandleDOMEvent () from /usr/lib/mozilla/components/libjsdom.so #52 0x41240ae4 in DocumentViewerImpl::LoadComplete () from /usr/lib/mozilla/components/libgkcontent.so #53 0x40ded9fb in nsDocShell::EndPageLoad () from /usr/lib/mozilla/components/libdocshell.so #54 0x40df89fc in nsWebShell::EndPageLoad () from /usr/lib/mozilla/components/libdocshell.so #55 0x40ded6e1 in nsDocShell::OnStateChange () from /usr/lib/mozilla/components/libdocshell.so #56 0x40d8dcfc in nsDocLoaderImpl::FireOnStateChange () from /usr/lib/mozilla/components/liburiloader.so #57 0x40d8d2e1 in nsDocLoaderImpl::doStopDocumentLoad () from /usr/lib/mozilla/components/liburiloader.so #58 0x40d8d1a3 in nsDocLoaderImpl::DocLoaderIsEmpty () from /usr/lib/mozilla/components/liburiloader.so #59 0x40d8d00c in nsDocLoaderImpl::OnStopRequest () from /usr/lib/mozilla/components/liburiloader.so #60 0x40787806 in nsLoadGroup::RemoveRequest () from /usr/lib/mozilla/components/libnecko.so #61 0x4091169a in nsCachedChromeChannel::HandleStopLoadEvent () from /usr/lib/mozilla/components/libchrome.so #62 0x4018d6a2 in PL_HandleEvent () from /usr/lib/libxpcom.so #63 0x4018d589 in PL_ProcessPendingEvents () from /usr/lib/libxpcom.so #64 0x4018e73d in nsEventQueueImpl::ProcessPendingEvents () from /usr/lib/libxpcom.so #65 0x4083f556 in event_processor_callback () from /usr/lib/mozilla/components/libwidget_gtk.so #66 0x4083f285 in our_gdk_io_invoke () from /usr/lib/mozilla/components/libwidget_gtk.so #67 0x403aef9e in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0 #68 0x403b0773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0 #69 0x403b0d39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0 #70 0x403b0eec in g_main_run () from /usr/lib/libglib-1.2.so.0 #71 0x402cb333 in gtk_main () from /usr/lib/libgtk-1.2.so.0 #72 0x4083f9b9 in nsAppShell::Run () from /usr/lib/mozilla/components/libwidget_gtk.so #73 0x4081e902 in nsAppShellService::Run () from /usr/lib/mozilla/components/libnsappshell.so #74 0x08053055 in getCountry () #75 0x0805399b in main () #76 0x4050e647 in __libc_start_main (main=0x8053850 <main>, argc=1, ubp_av=0xbffed9c4, init=0x804cc4c <_init>, fini=0x8055220 <_fini>, rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbffed9bc) at ../sysdeps/generic/libc-start.c:129

Using download manager with non ASCII path, I get assertions at NS_ConvertUTF8toUCS2 because the input string is not actually UTF-8. The result is an empty string returned and that can be related to the crash.

*** Bug 154760 has been marked as a duplicate of this bug. ***

*** Bug 153732 has been marked as a duplicate of this bug. ***

*** Bug 153093 has been marked as a duplicate of this bug. ***

*** Bug 151818 has been marked as a duplicate of this bug. ***

*** Bug 153312 has been marked as a duplicate of this bug. ***

*** Bug 152153 has been marked as a duplicate of this bug. ***

*** Bug 155557 has been marked as a duplicate of this bug. ***

Bah. I just moved the branch patch onto the trunk.

*** Bug 156159 has been marked as a duplicate of this bug. ***

talkback data for 0701-0703 showed 25 crash reports per day before this fix was checked in. In the last three days, 0704-0706, this is now zero. verified fixed.

*** Bug 144322 has been marked as a duplicate of this bug. ***

*** Bug 140705 has been marked as a duplicate of this bug. ***