Opening DOM Inspector (while viewing e.g. http://www.squarefree.com/start/) crashes :( I'm using a Mac debug trunk build. ###!!! ASSERTION: QueryInterface needed: 'query_result.get() == mRawPtr', file ../../../../dist/include/xpcom/nsCOMPtr.h, line 594 /Users/admin/trunk/mozilla/fx-debug-shared-gcc401/dist/MinefieldDebug.app/Contents/MacOS/run-mozilla.sh: line 451: 652 Bus error "$prog" ${1+"$@"} Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000083 Thread 0 Crashed: 0 libgklayout.dylib 0x0c6f2aec nsDocument::SetSubDocumentFor(nsIContent*, nsIDocument*) + 516 (nsDocument.cpp:1599) 1 libinspector.dylib 0x25d15070 inLayoutUtils::GetSubDocumentFor(nsIDOMNode*) + 268 (inLayoutUtils.cpp:170) 2 libinspector.dylib 0x25d0a538 inDOMView::GetChildNodesFor(nsIDOMNode*, nsCOMArray<nsIDOMNode>&) + 1076 (inDOMView.cpp:1218) 3 libinspector.dylib 0x25d0a688 inDOMView::CreateNode(nsIDOMNode*, inDOMViewNode*) + 160 (inDOMView.cpp:944) 4 libinspector.dylib 0x25d0a7d8 inDOMView::ExpandNode(int) + 240 (inDOMView.cpp:1040) 5 libinspector.dylib 0x25d0a934 inDOMView::ToggleOpenState(int) + 152 (inDOMView.cpp:540) 6 libxpcom_core.dylib 0x013a927c _XPTC_InvokeByIndex + 216 (xptcstubsdef.inc:256) 7 libxpcom_core.dylib 0x013a8934 XPTC_InvokeByIndex + 56 (xptcinvoke_ppc_rhapsody.cpp:144) 8 libxpconnect.dylib 0x02a559ac XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 5172 (xpcwrappednative.cpp:2146) 9 libxpconnect.dylib 0x02a5f3c0 XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*, long*) + 464 (xpcwrappednativejsops.cpp:1445) 10 libmozjs.dylib 0x01068050 js_Invoke + 4928 (jsinterp.c:1328) 11 libmozjs.dylib 0x0107d564 js_Interpret + 76608 (jsinterp.c:3982) 12 libmozjs.dylib 0x010680e8 js_Invoke + 5080 (jsinterp.c:1347) 13 libmozjs.dylib 0x01068550 js_InternalInvoke + 444 (jsinterp.c:1422) 14 libmozjs.dylib 0x010689d8 js_InternalGetOrSet + 888 (jsinterp.c:1482) 15 libmozjs.dylib 0x010a41f8 js_SetProperty + 1280 (jsobj.c:3285) 16 libmozjs.dylib 0x0107af2c js_Interpret + 66824 (jsinterp.c:3734) 17 libmozjs.dylib 0x010680e8 js_Invoke + 5080 (jsinterp.c:1347) 18 libxpconnect.dylib 0x02a4fbbc nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) + 5128 (xpcwrappedjsclass.cpp:1380) 19 libxpconnect.dylib 0x02a46618 nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) + 164 (xpcwrappedjs.cpp:465) 20 libxpcom_core.dylib 0x013a8f3c PrepareAndDispatch + 1516 (xptcstubs_ppc_rhapsody.cpp:184) 21 libxpcom_core.dylib 0x013a9abc SharedStub + 112 (xptcstubsdef.inc:256) 22 libgklayout.dylib 0x0c78a0dc nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsISupports*, unsigned, unsigned) + 728 (nsEventListenerManager.cpp:1631) 23 libgklayout.dylib 0x0c78d408 nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsISupports*, unsigned, nsEventStatus*) + 1432 (nsEventListenerManager.cpp:1734) 24 libgklayout.dylib 0x0c7b9ba0 nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned) + 284 (nsEventDispatcher.cpp:335) 25 libgklayout.dylib 0x0c7b9e44 nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned, nsDispatchingCallback*) + 608 (nsEventDispatcher.cpp:455) 26 libgklayout.dylib 0x0c7ba30c nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 548 (nsEventDispatcher.cpp:401) 27 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 28 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 29 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 30 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 31 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 32 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 33 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 34 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 35 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 36 libgklayout.dylib 0x0c7ba2a8 nsEventTargetChainItem::CreateChainAndHandleEvent(nsEventChainPreVisitor&, nsDispatchingCallback*) + 448 (nsEventDispatcher.cpp:392) 37 libgklayout.dylib 0x0c7ba768 nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, int) + 1008 (nsEventDispatcher.cpp:575) 38 libgklayout.dylib 0x0c429304 DocumentViewerImpl::LoadComplete(unsigned) + 668 (nsDocumentViewer.cpp:1064) 39 libdocshell.dylib 0x0b6bb474 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, unsigned) + 216 (nsDocShell.cpp:4860) 40 libdocshell.dylib 0x0b6c439c nsWebShell::EndPageLoad(nsIWebProgress*, nsIChannel*, unsigned) + 336 (nsWebShell.cpp:873) 41 libdocshell.dylib 0x0b6a6054 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned, unsigned) + 1692 (nsDocShell.cpp:4774) 42 libdocshell.dylib 0x0b6d820c nsDocLoader::FireOnStateChange(nsIWebProgress*, nsIRequest*, int, unsigned) + 616 (nsDocLoader.cpp:1198) 43 libdocshell.dylib 0x0b6d863c nsDocLoader::doStopDocumentLoad(nsIRequest*, unsigned) + 156 (nsDocLoader.cpp:848) 44 libdocshell.dylib 0x0b6d884c nsDocLoader::DocLoaderIsEmpty() + 464 (nsDocLoader.cpp:745) 45 libdocshell.dylib 0x0b6d961c nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 1452 (nsDocLoader.cpp:662) 46 libnecko.dylib 0x0380ad14 nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, unsigned) + 860 (nsLoadGroup.cpp:685) 47 libimglib2.dylib 0x0c03d26c imgRequestProxy::RemoveFromLoadGroup(int) + 132 (imgRequestProxy.cpp:163) 48 libimglib2.dylib 0x0c03d434 imgRequestProxy::OnStopRequest(nsIRequest*, nsISupports*, unsigned, int) + 384 (imgRequestProxy.cpp:500) 49 libimglib2.dylib 0x0c03a670 imgRequest::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 856 (imgRequest.cpp:762) 50 libimglib2.dylib 0x0c033ccc ProxyListener::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 164 (imgLoader.cpp:866) 51 libjar50.dylib 0x05f8aa00 nsJARChannel::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 284 (nsJARChannel.cpp:750) 52 libnecko.dylib 0x03801078 nsInputStreamPump::OnStateStop() + 392 (nsInputStreamPump.cpp:567) 53 libnecko.dylib 0x03801218 nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) + 224 (nsInputStreamPump.cpp:391) 54 libxpcom_core.dylib 0x01429870 nsInputStreamReadyEvent::Run() + 196 (nsStreamUtils.cpp:112) 55 libxpcom_core.dylib 0x0138f6d8 nsThread::ProcessNextEvent(int, int*) + 796 (nsThread.cpp:483) 56 libxpcom_core.dylib 0x0130cff8 NS_ProcessNextEvent_P(nsIThread*, int) + 172 (nsThreadUtils.cpp:225) 57 libwidget_mac.dylib 0x061ae5d4 nsBaseAppShell::Run() + 156 (nsBaseAppShell.cpp:152) 58 libtoolkitcomps.dylib 0x06d3a0a0 nsAppStartup::Run() + 220 (nsAppStartup.cpp:171) 59 XUL 0x0020fcfc XRE_main + 8740 (nsAppRunner.cpp:2343) 60 org.mozilla.firefox 0x00002c78 main + 56 (nsBrowserApp.cpp:61) 61 org.mozilla.firefox 0x00002498 _start + 340 (crt.c:272) 62 org.mozilla.firefox 0x00002340 start + 60

I crash with a similar stack inspecting 3pane or a message in tbird; linux opt and debug. Regressed between 2006-05-31-16Z / 2006-05-31-20Z

http://bonsai.mozilla.org/cvsquery.cgi?date=explicit&mindate=2006-05-31+09&maxdate=2006-05-31+14 bug 336699, I guess

Doesn't seem likely -- I can't reproduce this with my build that has the patch for bug 336699 in it. So here's the interesting part. inLayoutUtils::GetSubDocumentFor does NOT call nsDocument::SetSubDocumentFor. So either all these stacks are bogus, or _something_ weird is going on (e.g. inspector building without MOZILLA_INTERNAL_API?). So can someone who _can_ reproduce this figure out what's going on with the callstack?

I saw this crash too yesterday, though there was something strange happening. According to gdb inDOMView.cpp was somewhere under extensions/inspector, but that file didn't even exist. 'make distclean & ...' seemed to help, after that the right version of file was compiled (Some files were moved in Bug 325100).

Hmmm... Do people have stale inspector libs sitting around? What bug 336699 _did_ do was change the IID of nsIDocument and change the vtable by inserting a virtual function. So code compiled against the old nsIDocument but running against the new one would indeed end up calling SetSubDocumentFor (and passing in random data for the doc) when it tries to call GetSubDocumentFor. If you do have a stale inspector lib lying around that's compiled against the old nsIDocument but ends up running in a current build, then you'll see something like this bug.

WFM after clobbering, so sounds like bz's guess is right. Is there a broken makefile somewhere that's causing DOM Inspector to not be rebuilt when nsIDocument changes?

I don't really know what the new inspector setup is... the object files are in layout, but extensions/inspector/build/src/nsInspectorModule.cpp has the XPCOM constructors and extensions/inspector/build/src/Makefile.in links the inspector module? What's the separation between the two, if any?

extensions/inspector doesn't build any binary bits any more (nsInspectorModule.cpp is dead code that I thought I had removed)... the inspector module constructors are in nsLayoutModule.cpp

OK, sounds like this is invalid (stale object files left in dist/bin, basically).