Steps to reproduce: (1) seamonkey -browser (my default page is http://www.mozilla.org/start/) (2) CTRL+N (3) CTRL+Q If one slows down in shutting down (closing one window at a time manually, with a slight pause), then the assertion doesn't happen. I think this assertion comes from goQuitApplication() running quickly: http://lxr.mozilla.org/seamonkey/source/xpfe/global/resources/content/globalOverlay.js#1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060118 SeaMonkey/1.5a Quite possibly this affects Firefox as well. Stack: NTDLL! 7c901230() nsDebugImpl::Assertion(nsDebugImpl * const 0x002a8510, const char * 0x01c88ac8, const char * 0x01c88ac0, const char * 0x01c88a78, int 0x00000596) line 266 NSGlue_Assertion(const char * 0x01c88a78, int 0x00000596) line 111 nsXULContentBuilder::GetElementsForResource(nsIRDFResource * 0x034bc348, nsISupportsArray * 0x033e9738) line 1430 + 38 bytes nsXULContentBuilder::RemoveMember(nsIContent * 0x02a8f6a0, nsIRDFResource * 0x034bc348, int 0x00000001) line 1030 + 21 bytes nsXULContentBuilder::ReplaceMatch(nsIRDFResource * 0x034bc348, const nsTemplateMatch * 0x034bc990, nsTemplateMatch * 0x00000000) line 1602 nsXULTemplateBuilder::Retract(nsIRDFResource * 0x01ec11e0, nsIRDFResource * 0x01f06110, nsIRDFNode * 0x034bc348) line 536 nsXULTemplateBuilder::OnUnassert(nsXULTemplateBuilder * const 0x02cd5400, nsIRDFDataSource * 0x02cd5c30, nsIRDFResource * 0x01ec11e0, nsIRDFResource * 0x01f06110, nsIRDFNode * 0x034bc348) line 577 CompositeDataSourceImpl::OnUnassert(CompositeDataSourceImpl * const 0x02cd5c34, nsIRDFDataSource * 0x01ec1458, nsIRDFResource * 0x01ec11e0, nsIRDFResource * 0x01f06110, nsIRDFNode * 0x034bc348) line 1494 InMemoryDataSource::Unassert(InMemoryDataSource * const 0x01ec1458, nsIRDFResource * 0x01ec11e0, nsIRDFResource * 0x01f06110, nsIRDFNode * 0x034bc348) line 1541 nsWindowDataSource::Unassert(nsWindowDataSource * const 0x01ec1070, nsIRDFResource * 0x01ec11e0, nsIRDFResource * 0x01f06110, nsIRDFNode * 0x034bc348) line 470 + 38 bytes RDFContainerImpl::RemoveElement(RDFContainerImpl * const 0x01ec20a0, nsIRDFNode * 0x034bc348, int 0x00000001) line 288 + 38 bytes nsWindowDataSource::OnCloseWindow(nsWindowDataSource * const 0x01ec1078, nsIXULWindow * 0x03511ac8) line 276 notifyCloseWindow(nsISupports * 0x01ec1078, void * 0x0012d3ac) line 856 nsSupportsArray::EnumerateForwards(nsSupportsArray * const 0x01ec2620, int (nsISupports *, void *)* 0x020e51c0 notifyCloseWindow(nsISupports *, void *), void * 0x0012d3ac) line 627 + 20 bytes nsWindowMediator::UnregisterWindow(nsWindowMediator * const 0x01ec2510, nsWindowInfo * 0x034bc300) line 174 nsWindowMediator::UnregisterWindow(nsWindowMediator * const 0x01ec2510, nsIXULWindow * 0x03511ac8) line 154 + 16 bytes nsAppShellService::UnregisterTopLevelWindow(nsAppShellService * const 0x01ef5928, nsIXULWindow * 0x03511ac8) line 516 nsXULWindow::Destroy(nsXULWindow * const 0x03511ac0) line 462 nsWebShellWindow::Destroy(nsWebShellWindow * const 0x03511ac0) line 842 + 9 bytes nsChromeTreeOwner::Destroy(nsChromeTreeOwner * const 0x034bc034) line 354 nsGlobalWindow::ReallyCloseWindow() line 4636 nsGlobalWindow::CloseWindow(nsISupports * 0x034bc420) line 5874 nsJSContext::ScriptEvaluated(int 0x00000001) line 2054 + 17 bytes nsJSContext::CallEventHandler(JSObject * 0x041325c0, JSObject * 0x041325d0, unsigned int 0x00000001, long * 0x0012d6d8, long * 0x0012d6d4) line 1456 nsJSEventListener::HandleEvent(nsJSEventListener * const 0x041eb638, nsIDOMEvent * 0x02c764f8) line 186 + 54 bytes nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventReceiver * 0x041eae10, nsIDOMEvent * 0x02c764f8) line 507 nsXBLWindowHandler::WalkHandlersInternal(nsIDOMEvent * 0x02c764f8, nsIAtom * 0x009d4ef8, nsXBLPrototypeHandler * 0x040e5870) line 304 + 24 bytes nsXBLWindowKeyHandler::WalkHandlers(nsXBLWindowKeyHandler * const 0x03628438, nsIDOMEvent * 0x02c764f8, nsIAtom * 0x009d4ef8) line 198 nsXBLWindowKeyHandler::KeyPress(nsXBLWindowKeyHandler * const 0x03628438, nsIDOMEvent * 0x02c764f8) line 251 DispatchToInterface(nsIDOMEvent * 0x02c764f8, nsIDOMEventListener * 0x03628438, unsigned int (nsIDOMEvent *)* 0x017f3b20 `vcall'(nsIDOMEvent *), const nsID & {...}, int * 0x0012e030) line 143 + 11 bytes nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x0356ce28, nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, nsIDOMEventTarget * 0x0342d054, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1750 + 38 bytes nsDocument::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 4330 nsXULElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1911 + 63 bytes nsXULElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1905 + 57 bytes nsXULElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1905 + 57 bytes nsXULElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1905 + 57 bytes nsXULElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1905 + 57 bytes nsXULElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1905 + 57 bytes nsXULElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1905 + 57 bytes nsXULElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1905 + 57 bytes nsXULElement::HandleChromeEvent(nsXULElement * const 0x033c8034, nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 2545 + 35 bytes nsGlobalWindow::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1616 nsGlobalWindow::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 1480 + 94 bytes nsDocument::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000202, nsEventStatus * 0x0012f4e4) line 4339 nsGenericElement::HandleDOMEvent(nsPresContext * 0x0413d2c8, nsEvent * 0x0012f710, nsIDOMEvent * * 0x0012f30c, unsigned int 0x00000207, nsEventStatus * 0x0012f4e4) line 2188 + 40 bytes PresShell::HandleEventInternal(nsEvent * 0x0012f710, nsIView * 0x0413e528, unsigned int 0x00000001, nsEventStatus * 0x0012f4e4) line 6056 + 52 bytes PresShell::HandleEvent(PresShell * const 0x0414c410, nsIView * 0x0413e528, nsGUIEvent * 0x0012f710, nsEventStatus * 0x0012f4e4, int 0x00000001, int & 0x00000001) line 5857 + 25 bytes nsViewManager::HandleEvent(nsView * 0x0413e528, nsPoint {...}, nsGUIEvent * 0x0012f710, int 0x00000000) line 2504 nsViewManager::DispatchEvent(nsViewManager * const 0x0413e480, nsGUIEvent * 0x0012f710, nsEventStatus * 0x0012f660) line 2237 + 37 bytes HandleEvent(nsGUIEvent * 0x0012f710) line 176 nsWindow::DispatchEvent(nsWindow * const 0x0413e5fc, nsGUIEvent * 0x0012f710, nsEventStatus & nsEventStatus_eIgnore) line 1164 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f710) line 1185 nsWindow::DispatchKeyEvent(unsigned int 0x00000083, unsigned short 0x0071, unsigned int 0x00000000, long 0x00000000, unsigned int 0x00000000) line 3374 + 15 bytes nsWindow::OnChar(unsigned int 0x00000000, unsigned int 0x00000000) line 3619 + 31 bytes nsWindow::OnKeyDown(unsigned int 0x00000051, unsigned int 0x00000010, long 0x00100001) line 3466 + 16 bytes nsWindow::ProcessMessage(unsigned int 0x00000100, unsigned int 0x00000051, long 0x00100001, long * 0x0012fc8c) line 4455 + 38 bytes nsWindow::WindowProc(HWND__ * 0x003302ae, unsigned int 0x00000100, unsigned int 0x00000051, long 0x00100001) line 1353 + 27 bytes USER32! 77d48734() USER32! 77d48816() USER32! 77d489cd() USER32! 77d48a10() nsAppShell::Run(nsAppShell * const 0x01ec2c48) line 135 nsAppStartup::Run(nsAppStartup * const 0x01ec2860) line 208 main1(int 0x00000002, char * * 0x002a2c48, nsISupports * 0x00a6afe0) line 1248 + 32 bytes main(int 0x00000002, char * * 0x002a2c48) line 1736 + 37 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! 7c

Is the document actually not a XUL document? Or is it just null?

xuldoc is null.

Digging a little deeper, mRoot looks like a nsXULElement. It looks like we're referring to a menu element, which makes the intended document a XUL document.

I realize xuldoc is null. Hence the assert. What's the actual document, though? How are we getting the document in this case? Is the problem just that we're running this code after we've already torn down the document?

I can't prove it (I still suck at C++ debugging), but the evidence I can see indicates that.

So presumably someone should be "turning off" the template builder or something. Where does that happen now?

nsXULTemplateBuilder::DocumentWillBeDestroyed should be called which sets mRoot to null (which will crash if nsXULContentBuilder::GetElementsForResource is called later) Looks like the window mediator gets rid of the window before the document goes away, so it fires an unassert

DocumentWillBeDestroyed is called when the document object is actually about to be destroyed. The current document is unset in all elements much earlier than that... perhaps the problem is that we're getting called in between those two happening?

We could just remove the assertion and return success, since removing mRoot from a document isn't really an error. There are several other similar places where the document is checked that could be changed also. Also, we should have a bug that the builder should be unattached from the document (XULDocument::mTemplateBuilderTable) when the root element gets removed.

Sounds like a reasonable plan to me.

Should be fixed now