Seen while running Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a5pre) Gecko/20100423 Minefield/3.7a5pre and reported by Bret Reckard. Does not occur using the Windows 7 trunk nightly. STR: 1. Load Pandora in a tab. 2. Tear away that tab. 3. Crash http://crash-stats.mozilla.com/report/index/bp-528c2a98-053c-45f1-b23e-587772100423 Frame Module Signature [Expand] Source 0 XUL -[ChildView updatePluginTopLevelWindowStatus:] widget/src/cocoa/nsChildView.mm:2274 1 XUL -[ChildView windowResignedMain:] widget/src/cocoa/nsChildView.mm:2296 2 Foundation _nsnote_callback 3 CoreFoundation __CFXNotificationPost 4 CoreFoundation _CFXNotificationPostNotification 5 Foundation -[NSNotificationCenter postNotificationName:object:userInfo:] 6 Foundation -[NSNotificationCenter postNotificationName:object:] 7 AppKit -[NSWindow resignMainWindow] 8 AppKit -[NSWindow _changeKeyAndMainLimitedOK:] 9 AppKit -[NSWindow makeKeyWindow] 10 AppKit -[NSWindow _makeKeyRegardlessOfVisibility] 11 AppKit -[NSWindow makeKeyAndOrderFront:] 12 XUL nsCocoaWindow::Show widget/src/cocoa/nsCocoaWindow.mm:709 13 XUL nsXULWindow::SetVisibility xpfe/appshell/src/nsXULWindow.cpp:802 14 XUL nsXULWindow::OnChromeLoaded xpfe/appshell/src/nsXULWindow.cpp:1021 15 XUL nsWebShellWindow::OnStateChange xpfe/appshell/src/nsWebShellWindow.cpp:585 16 XUL nsDocLoader::FireOnStateChange uriloader/base/nsDocLoader.cpp:1317 17 XUL nsDocLoader::DocLoaderIsEmpty uriloader/base/nsDocLoader.cpp:940 18 XUL nsDocLoader::DocLoaderIsEmpty uriloader/base/nsDocLoader.h:205 19 XUL nsDocLoader::OnStopRequest uriloader/base/nsDocLoader.cpp:700 20 XUL nsLoadGroup::RemoveRequest netwerk/base/src/nsLoadGroup.cpp:680 21 XUL nsDocument::UnblockOnload content/base/src/nsDocument.cpp:7275 22 XUL nsDocument::DispatchContentLoadedEvents content/base/src/nsDocument.cpp:4141 23 XUL nsRunnableMethod<nsDocument, void>::Run nsThreadUtils.h:282 24 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:527 25 XUL NS_ProcessPendingEvents_P nsThreadUtils.cpp:200 26 XUL nsBaseAppShell::NativeEventCallback widget/src/xpwidgets/nsBaseAppShell.cpp:125 27 XUL nsAppShell::ProcessGeckoEvents widget/src/cocoa/nsAppShell.mm:394 28 CoreFoundation __CFRunLoopDoSources0 29 CoreFoundation __CFRunLoopRun 30 CoreFoundation CFRunLoopRunSpecific 31 CoreFoundation CFRunLoopRunInMode 32 HIToolbox RunCurrentEventLoopInMode 33 HIToolbox ReceiveNextEventCommon 34 HIToolbox BlockUntilNextEventMatchingListInMode 35 AppKit _DPSNextEvent 36 AppKit -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 37 XUL nsAppShell::ProcessNextNativeEvent widget/src/cocoa/nsAppShell.mm:676 38 XUL nsBaseAppShell::OnProcessNextEvent widget/src/xpwidgets/nsBaseAppShell.cpp:155 39 XUL nsAppShell::OnProcessNextEvent widget/src/cocoa/nsAppShell.mm:834 40 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:508 41 XUL NS_ProcessPendingEvents_P nsThreadUtils.cpp:200 42 XUL nsBaseAppShell::NativeEventCallback widget/src/xpwidgets/nsBaseAppShell.cpp:125 43 XUL nsAppShell::ProcessGeckoEvents widget/src/cocoa/nsAppShell.mm:394 44 CoreFoundation __CFRunLoopDoSources0 45 CoreFoundation __CFRunLoopRun 46 CoreFoundation CFRunLoopRunSpecific 47 CoreFoundation CFRunLoopRunInMode 48 HIToolbox RunCurrentEventLoopInMode 49 HIToolbox ReceiveNextEventCommon 50 HIToolbox BlockUntilNextEventMatchingListInMode 51 AppKit _DPSNextEvent 52 AppKit -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 53 AppKit -[NSApplication run] 54 XUL nsAppShell::Run widget/src/cocoa/nsAppShell.mm:747 55 XUL nsAppStartup::Run toolkit/components/startup/src/nsAppStartup.cpp:182 56 XUL XRE_main toolkit/xre/nsAppRunner.cpp:3536 57 firefox-bin main browser/app/nsBrowserApp.cpp:158 58 firefox-bin firefox-bin@0xbf5 59 @0x0

I can work on hunting down a regression range for this bug.

Regression range is: Works-> Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a5pre) Gecko/20100420 Minefield/3.7a5pre Crashes-> Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a5pre) Gecko/20100421 Minefield/3.7a5pre http://tinyurl.com/286nsvu links to the checkins.

This is a recent plugin crash regression, Josh, can you have a look here or reassign as appropriate?

Judging by the regression range and the stack, I think this is most likely to be fallout from Josh's patch for bug 555290 (http://hg.mozilla.org/mozilla-central/rev/d50740efad39).

These crashes all result from dereferencing a NULL mGeckoChild pointer. So the fix is very simple. But when I went to write a patch, I found someone (Josh) had already beaten me to it :-) What should be the fix for this bug is included is Josh's patch for bug 550758 (http://hg.mozilla.org/mozilla-central/rev/3de70a10af21), which landed yesterday. This crash is a topcrasher on the trunk. But I notice that none of the crashes reported there are on builds later than 20100425031012. So Marcia, please test with today's and subsequent Minefield nightlies.

> What should be the fix for this bug is included is Josh's patch for > bug 550758 (http://hg.mozilla.org/mozilla-central/rev/3de70a10af21), > which landed yesterday. bug 559758

Using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a5pre) Gecko/20100427 Minefield/3.7a5pre, I no longer get the crash tearing away the Pandora tab.