[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050605] (nightly) (W98SE) {{ 1/ TB6417963K 6417963 0x020c56b3 b4fcd4c7 2005-06-05 17:02:33.0 MozillaOrgMozillaTrunkWin322005060505 Newly installed / with bfcache on... 0x020c56b3 nsSHEntry::~nsSHEntry [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp, line 100] }} {{ 2/ TB6418047M 6418047 MSVCRT.DLL + 0xcc2e (0x7800cc2e) ef74b579 2005-06-05 17:07:30.0 MozillaOrgMozillaTrunkWin322005060505 MSVCRT.DLL + 0xcc2e (0x7800cc2e) MSVCRT.DLL + 0xc6cd (0x7800c6cd) operator delete nsCSSDeclaration::~nsCSSDeclaration [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSDeclaration.cpp, line 105] 0x00700465 }} {{ 3/ TB6418228E 6418228 MSVCRT.DLL + 0xcc2e (0x7800cc2e) 704ff5c8 2005-06-05 17:17:44.0 MozillaOrgMozillaTrunkWin322005060505 Newly installed / with bfcache on ("again"). Next, I'll disable bfcache... MSVCRT.DLL + 0xcc2e (0x7800cc2e) MSVCRT.DLL + 0xc6cd (0x7800c6cd) PL_DHashFreeTable [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/ds/pldhash.c, line 69] 0x00700465 }} These crashes are new to me, and may have "regressed"/changed since [Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050531] (nightly) (W98SE) !!? These 3 crashes happened at different steps while navigating on the same site; that may explain why the involved code differs !? After desabling bfcache, the crashes seem to have stop.

what happened to "steps to reproduce" ?

(In reply to comment #1) > what happened to "steps to reproduce" ? None so far: the crashes happened while "playing" on <www.battle-arenas.net>, (need to create a (free) account to login), it's based on a frameset, CSS/HTML/JS (no Flash/XML/etc), ... and I'm going (way) back in the history session from times to times. I understand the three crashes/stacks may not be not very alike/helpful :-( What would help further ? To try and confirm/find a shorter regression timeframe !? To re-activate bfcache to get more talkback reports !?

(In reply to comment #2) > To re-activate bfcache to get more talkback reports !? Odd, today, after (re)boot, bfcache doesn't seem to cause any crash :-/

Happened again ... this stack could be more helpful !? {{ 4/ TB6478070K 6478070 MSVCRT.DLL + 0xd008 (0x7800d008) f621fa06 2005-06-07 17:45:32.0 MozillaOrgMozillaTrunkWin322005060505 bug 296760: bfcache back ON ... random crash again. MSVCRT.DLL + 0xd008 (0x7800d008) MSVCRT.DLL + 0xc928 (0x7800c928) CreateScopeTable [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsscope.c, line 122] js_SetProperty [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2936] InitArrayElements [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsarray.c, line 548] InitArrayObject [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsarray.c, line 571] Array [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsarray.c, line 1719] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1178] js_Interpret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3036] js_Execute [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1409] JS_EvaluateUCScriptForPrincipals [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 3793] nsJSContext::EvaluateString [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1037] nsScriptLoader::EvaluateScript [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsScriptLoader.cpp, line 723] nsScriptLoader::ProcessRequest [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsScriptLoader.cpp, line 629] nsScriptLoader::ProcessScriptElement [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsScriptLoader.cpp, line 575] nsHTMLScriptElement::MaybeProcessScript [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 662] nsHTMLScriptElement::BindToTree [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 455] nsGenericElement::AppendChildTo [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2718] HTMLContentSink::ProcessSCRIPTTag [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 4137] HTMLContentSink::AddLeaf [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 3003] CNavDTD::AddLeaf [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 3619] CNavDTD::HandleDefaultStartToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 1321] CNavDTD::HandleStartToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 1698] CNavDTD::HandleToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 950] CNavDTD::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 457] nsParser::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp, line 2094] }}

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050608] (nightly) (W98SE) {{ 5/ TB6577183M Incident ID: 6577183 Stack Signature MSVCRT.DLL + 0xcb79 (0x7800cb79) 5e152088 MSVCRT.DLL + 0xcb79 (0x7800cb79) MSVCRT.DLL + 0xc6cd (0x7800c6cd) operator delete 0x00700465 }} Much like 2/ and 3/ in comment 0. Possible(!?) hints: *my (network) cache seemed +/- full at the time: POSTed pages in the history (would have) needed resubmitting data to access them. *Maybe more related, I pressed Forward not long ago (but cancelled it due to POSTed page needing resubmitting).

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050610] (nightly) (W98SE) {{ 6/ TB6577807Y Incident ID: 6577807 Stack Signature MSVCRT.DLL + 0xd011 (0x7800d011) 7ea4a8f1 MSVCRT.DLL + 0xd011 (0x7800d011) MSVCRT.DLL + 0xc730 (0x7800c730) MSVCRT.DLL + 0x12d7 (0x780012d7) nsIOService::NewURI [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsIOService.cpp, line 422] NS_NewURI [../../dist/include/necko/nsNetUtil.h, line 121] CSSParserImpl::ParseURL [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSParser.cpp, line 3896] CSSParserImpl::ParseVariant [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSParser.cpp, line 3674] CSSParserImpl::ParseSingleValueProperty [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSParser.cpp, line 4656] CSSParserImpl::ParseProperty [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSParser.cpp, line 4199] CSSParserImpl::ParseDeclaration [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSParser.cpp, line 3147] CSSParserImpl::ParseDeclarationBlock [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSParser.cpp, line 2712] CSSParserImpl::ParseStyleAttribute [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSParser.cpp, line 738] nsGenericHTMLElement::ParseStyleAttribute [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 2648] nsGenericHTMLElement::ParseAttribute [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 2191] nsHTMLDivElement::ParseAttribute [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLDivElement.cpp, line 128] nsGenericHTMLElement::SetAttr [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1715] HTMLContentSink::AddAttributes [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 831] SinkContext::OpenContainer [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 1216] HTMLContentSink::OpenContainer [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2904] CNavDTD::HandleDefaultStartToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 1321] CNavDTD::HandleStartToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 1698] CNavDTD::HandleToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 950] CNavDTD::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 457] nsParser::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp, line 2094] }} More related to 4/ in comment 4. I did try to test/use Forward much more often: it crashed after clicking on a link; just before I had successfully used 1 Forward then 1 Back; BUT a moment before 2 attempts at using Back worked but failed to activate the Forward button. (that was a frame changing in a frameset) I wonder if something(Forward !?) could corrupt something at some time, which would cause the crash later ? Could I get a debug ("Win98SE") build somewhere, which may help ??

Serge, you seem to be the only person crashing with this stack on trunk.... Can you run FF in -safe-mode to rule out the involvement of any extension ?

(In reply to comment #7) > Serge, you seem to be the only person crashing with this stack on trunk.... > Can you run FF in -safe-mode to rule out the involvement of any extension ? No FireFox, No extension :-> I guess "Win98SE / MozillaAS / bcf ON" is not a common setup :-/ (Well, given the +/- randomness of the crashes, I'm a little less sure about the need of bfc ON, and it could even be something gone wrong on my computer ... Yet, for now, this is my best guess by far.)

bah, this is Seamonkey

So far, I have yet to get -0604 to crash... (looking for a possible regression timeframe)

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050604] (nightly) (W98SE) I have no reproductible steps, so I can't be sure, but -0604 seems unaffected, after trying "hard" today to make it crash. Likely timeframe would be between -0604 and -0605...

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050611] (nightly) (W98SE) {{ 7/ TB6601710M Incident ID: 6601710 Stack Signature MSVCRT.DLL + 0xcc2e (0x7800cc2e) 704ff5c8 MSVCRT.DLL + 0xcc2e (0x7800cc2e) MSVCRT.DLL + 0xc6cd (0x7800c6cd) PL_DHashFreeTable [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/ds/pldhash.c, line 69] 0x00700465 }} Same as 3/ in comment 0.

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050611] (nightly) (W98SE) {{ 8/ TB6601943G Incident ID: 6601943 Stack Signature MSVCRT.DLL + 0xcfa2 (0x7800cfa2) 933c4ca0 MSVCRT.DLL + 0xcfa2 (0x7800cfa2) MSVCRT.DLL + 0x1160b (0x7801160b) nsStringBuffer::Realloc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/string/src/nsSubstring.cpp, line 223] nsCSubstring::Replace [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/string/src/nsTSubstring.cpp, line 447] nsCSubstring::Replace [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/string/src/nsTSubstring.cpp, line 496] nsCacheService::CreateRequest [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheService.cpp, line 761] nsCacheService::OpenCacheEntry [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheService.cpp, line 888] nsCacheSession::OpenCacheEntry [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/cache/src/nsCacheSession.cpp, line 98] imgCache::Get [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/modules/libpr0n/src/imgCache.cpp, line 314] imgLoader::LoadImage [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/modules/libpr0n/src/imgLoader.cpp, line 312] nsContentUtils::LoadImage [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsContentUtils.cpp, line 1881] nsImageLoadingContent::ImageURIChanged [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsImageLoadingContent.cpp, line 475] nsHTMLImageElement::BindToTree [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLImageElement.cpp, line 604] nsGenericElement::AppendChildTo [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2721] nsHTMLFragmentContentSink::AddLeaf [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLFragmentContentSink.cpp, line 598] CNavDTD::AddLeaf [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 3619] CNavDTD::HandleStartToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 1698] CNavDTD::HandleToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 950] CNavDTD::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 457] nsParser::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp, line 2094] }} New stack trace !? Did not use Forward at all; jumped back a "lot" of session entries, just before clicking a link... (Disabling bcf again for now)

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050611] (nightly) (W98SE) (confirmation) I had no crash with bfcache OFF. [Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050613] (nightly) (W98SE) (with bfcache ON) {{ 9/ TB6800891G Incident ID: 6800891 Stack Signature nsImageLoader::Destroy b36ad7db nsImageLoader::Destroy [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsImageLoader.cpp, line 90] nsHashtable::Enumerate [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/ds/nsHashtable.cpp, line 319] nsPresContext::~nsPresContext [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresContext.cpp, line 215] }}

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050613] (nightly) (W98SE) {{ 10/ TB6801078M Incident ID: 6801078 Stack Signature MSVCRT.DLL + 0xcfa2 (0x7800cfa2) ff7863ec MSVCRT.DLL + 0xcfa2 (0x7800cfa2) MSVCRT.DLL + 0xc730 (0x7800c730) MSVCRT.DLL + 0x12d7 (0x780012d7) nsCSubstring::Assign [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/string/src/nsTSubstring.cpp, line 306] nsCSubstring::Assign [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/string/src/nsTSubstring.cpp, line 367] nsHttpConnectionInfo::SetOriginServer [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpConnectionInfo.cpp, line 46] nsHttpConnectionInfo::nsHttpConnectionInfo [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpConnectionInfo.h, line 69] nsHttpHandler::NewProxiedChannel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpHandler.cpp, line 1488] nsIOService::NewChannelFromURI [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsIOService.cpp, line 489] NS_NewChannel [../../dist/include/necko/nsNetUtil.h, line 170] CSSLoaderImpl::LoadSheet [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSLoader.cpp, line 1287] CSSLoaderImpl::LoadStyleLink [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSLoader.cpp, line 1646] nsStyleLinkElement::UpdateStyleSheet [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsStyleLinkElement.cpp, line 331] HTMLContentSink::ProcessLINKTag [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 3782] HTMLContentSink::AddLeaf [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2988] HTMLContentSink::AddHeadContent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2954] CNavDTD::AddHeadLeaf [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 3656] CNavDTD::HandleToken [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 950] CNavDTD::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 457] nsParser::BuildModel [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp, line 2094] }} I hdd not used 'forward' in the two later reports. (Disabling bcf again for now)

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050619] (nightly) (W98SE) I had no crash with -0619 ... this bug may have been fixed after -0613 !? Moving to -0625...

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050701] (nightly) (W98SE) No recent crash: let's assume R.Fixed.

If you don't know the code change that fixed this then it should be resolved as WFM.