Steps to reproduce: Steps to Reproduce: 1. Log into IMail: UserID='bugzilla@lowtech.net', pwd='bugzilla' 2. Click on "View Mail" near the top of the page 3. CRASH! The View Mail anchor calls a cgi script: <!--- View Mail Button ---> <TD width=17% align=center valign=middle nowrap class="Normal" onMouseOver="this.className='Mouseover'; self.status='Main Menu...'; return true" onMouseOut="this.className='Normal'; self.status=''; return true" onMouseDown="this.className='Click'" onClick="document.location.href='/Xa69a989d9d999ccbc8cb7aa68d69/readmail.28313.c gi?mbx=Main&msg=';"> <font face="Verdana, Arial, Helvetica"> &nbsp;&nbsp;<A HREF="/Xa69a989d9d999ccbc8cb7aa68d69/readmail.28313.cgi?mbx=Main&msg=" CLASS="button">View Mail</A>&nbsp;&nbsp;</TD>

I was using these builds at the site: 2001-05-09-17 WinNT nightly binary : no problem 2001-05-14 WinNT debug build : no problem 2001-05-17-10 WinNT nightly binary : CRASH!!! So this may be a recent regression -

Tested on linux build 2001-05-17-08-trunk.... first time nothing happened and I was about to write that down in this report, but after that every time I tried to access the mail box it crashed. The problem occurs actualy while opening the mailbox itself. I opened it in IE and then copied/pasted the url into Netscape 6, it crashed. But when I saved the page from IE and tried to open localy, it opened without crashing...

Looks like a duplicate *** This bug has been marked as a duplicate of 81282 ***

Sorry about that, Phil, didnt notice the last message in that bug.

reassigning

Moving to M0.9.1 per PDT.

Here's the stack. The child that is being returned has already been released, and the crash occurs on an ADDREF of the released content. nsGenericHTMLContainerElement::ChildAt(const nsGenericHTMLContainerElement * const 0x05d51c50, int 5, nsIContent * & 0x00000000) line 3551 + 9 bytes nsHTMLDocument::RegisterNamedItems(nsIContent * 0x05d51c50) line 3287 nsHTMLDocument::RegisterNamedItems(nsIContent * 0x05d51f80) line 3289 nsHTMLDocument::RegisterNamedItems(nsIContent * 0x05d4e990) line 3289 nsHTMLDocument::RegisterNamedItems(nsIContent * 0x05d4f1c0) line 3289 nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x05bd7a40, nsIContent * 0x05d25640, int 1) line 1173 HTMLContentSink::NotifyAppend(nsIContent * 0x05d25640, int 1) line 4288 SinkContext::FlushTags(int 1) line 1988 SinkContext::DidAddContent(nsIContent * 0x05d4f1c0, int 0) line 1255 SinkContext::CloseContainer(const nsIParserNode & {...}) line 1439 HTMLContentSink::CloseContainer(HTMLContentSink * const 0x05bdb040, const nsIParserNode & {...}) line 3098 + 18 bytes CNavDTD::CloseContainer(const nsCParserNode * 0x053db138, nsHTMLTag eHTMLTag_td, int 0) line 3521 + 31 bytes CNavDTD::CloseContainersTo(int 5, nsHTMLTag eHTMLTag_td, int 0) line 3557 + 20 bytes CNavDTD::CloseContainersTo(nsHTMLTag eHTMLTag_td, int 0) line 3708 + 20 bytes CNavDTD::HandleEndToken(CToken * 0x0555f938) line 1991 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x05c226c0, CToken * 0x0555f938, nsIParser * 0x05ba9d90) line 890 + 12 bytes CNavDTD::BuildModel(CNavDTD * const 0x05c226c0, nsIParser * 0x05ba9d90, nsITokenizer * 0x05c27fa0, nsITokenObserver * 0x00000000, nsIContentSink * 0x05bdb040) line 539 + 20 bytes nsParser::BuildModel() line 1990 + 34 bytes nsParser::ResumeParse(int 1, int 0) line 1871 + 11 bytes nsParser::OnDataAvailable(nsParser * const 0x05ba9d98, nsIRequest * 0x05bddc40, nsISupports * 0x00000000, nsIInputStream * 0x05c25480, unsigned int 44943, unsigned int 1208) line 2325 + 19 bytes nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x05bdcee0, nsIRequest * 0x05bddc40, nsISupports * 0x00000000, nsIInputStream * 0x05c25480, unsigned int 44943, unsigned int 1208) line 237 + 46 bytes nsStreamListenerTee::OnDataAvailable(nsStreamListenerTee * const 0x05bd7540, nsIRequest * 0x05bddc40, nsISupports * 0x00000000, nsIInputStream * 0x05bad590, unsigned int 44943, unsigned int 1208) line 56 + 51 bytes nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x05bddc44, nsIRequest * 0x05bad380, nsISupports * 0x00000000, nsIInputStream * 0x05bad590, unsigned int 44943, unsigned int 1208) line 2071 + 57 bytes nsOnDataAvailableEvent::HandleEvent() line 173 + 70 bytes nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x044e61b4) line 64 PL_HandleEvent(PLEvent * 0x044e61b4) line 590 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00af9390) line 520 + 9 bytes _md_EventReceiverProc(HWND__ * 0xa48a049e, unsigned int 49452, unsigned int 0,

In today's build, I don't see the first crash, but instead see many assertions followed by a crash leaving the page. I was seeing the same assertions/crash leaving page yesterday sometimes too. Attached above are the testcase that causes this, and stack traces of the assertions and crash. Handing this to Layout people who will hopefully have seen this before (i have seen the asserts occasionally the past few days when running jrgm's performance tests).

I've seen those assertions before also, but I'm not seeing them with a 5/23/1 build. I'm getting the following assertion when leaving the page and then the follow crash. Reassigning to jst. nsFocusController::UpdateCommands(nsFocusController * const 0x01343220, const nsAString & {...}) line 132 + 18 bytes nsFocusController::SetSuppressFocus(nsFocusController * const 0x01343220, int 0, char * 0x01654cc0) line 416 + 29 bytes nsDocShell::SetupNewViewer(nsDocShell * const 0x01317d30, nsIContentViewer * 0x025e67d0) line 3932 nsWebShell::SetupNewViewer(nsWebShell * const 0x01317d30, nsIContentViewer * 0x025e67d0) line 347 + 13 bytes nsDocShell::Embed(nsDocShell * const 0x01317d54, nsIContentViewer * 0x025e67d0, const char * 0x0165a050, nsISupports * 0x00000000) line 3459 + 23 bytes nsWebShell::Embed(nsWebShell * const 0x01317d54, nsIContentViewer * 0x025e67d0, const char * 0x0165a050, nsISupports * 0x00000000) line 376 nsDocShell::CreateContentViewer(nsDocShell * const 0x01317d30, const char * 0x0012fcfc, nsIRequest * 0x026c43c0, nsIStreamListener * * 0x0012fd4c) line 3738 + 32 bytes nsDSURIContentListener::DoContent(nsDSURIContentListener * const 0x01317a20, const char * 0x0012fcfc, int 0, nsIRequest * 0x026c43c0, nsIStreamListener * * 0x0012fd4c, int * 0x0012fce0) line 119 + 33 bytes nsDocumentOpenInfo::DispatchContent(nsIRequest * 0x026c43c0, nsISupports * 0x00000000) line 350 + 93 bytes nsDocumentOpenInfo::OnStartRequest(nsDocumentOpenInfo * const 0x026c3970, nsIRequest * 0x026c43c0, nsISupports * 0x00000000) line 219 + 16 bytes nsResChannel::OnStartRequest(nsResChannel * const 0x026c43c8, nsIRequest * 0x026c31e0, nsISupports * 0x00000000) line 532 nsFileChannel::OnStartRequest(nsFileChannel * const 0x026c31e8, nsIRequest * 0x026c0ae4, nsISupports * 0x00000000) line 453 + 37 bytes nsOnStartRequestEvent::HandleEvent() line 108 + 53 bytes nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x026c7bc4) line 64 PL_HandleEvent(PLEvent * 0x026c7bc4) line 590 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x01314f00) line 520 + 9 bytes _md_EventReceiverProc(HWND__ * 0x000f0522, unsigned int 49548, unsigned int 0, long 20008704) line 1071 + 9 bytes USER32! 77e148dc() USER32! 77e14aa7() USER32! 77e266fd() main(int 1, char * * 0x00635fc0) line 157 + 11 bytes mainCRTStartup() line 338 + 17 bytes nsFocusController::UpdateCommands(nsFocusController * const 0x01343220, const nsAString & {...}) line 132 + 18 bytes nsFocusController::SetSuppressFocus(nsFocusController * const 0x01343220, int 0, char * 0x01654cc0) line 416 + 29 bytes nsDocShell::SetupNewViewer(nsDocShell * const 0x01317d30, nsIContentViewer * 0x02de7610) line 3932 nsWebShell::SetupNewViewer(nsWebShell * const 0x01317d30, nsIContentViewer * 0x02de7610) line 347 + 13 bytes nsDocShell::Embed(nsDocShell * const 0x01317d54, nsIContentViewer * 0x02de7610, const char * 0x0165a050, nsISupports * 0x00000000) line 3459 + 23 bytes nsWebShell::Embed(nsWebShell * const 0x01317d54, nsIContentViewer * 0x02de7610, const char * 0x0165a050, nsISupports * 0x00000000) line 376 nsDocShell::CreateContentViewer(nsDocShell * const 0x01317d30, const char * 0x0012fcfc, nsIRequest * 0x02de63f0, nsIStreamListener * * 0x0012fd4c) line 3738 + 32 bytes nsDSURIContentListener::DoContent(nsDSURIContentListener * const 0x01317a20, const char * 0x0012fcfc, int 0, nsIRequest * 0x02de63f0, nsIStreamListener * * 0x0012fd4c, int * 0x0012fce0) line 119 + 33 bytes nsDocumentOpenInfo::DispatchContent(nsIRequest * 0x02de63f0, nsISupports * 0x00000000) line 350 + 93 bytes nsDocumentOpenInfo::OnStartRequest(nsDocumentOpenInfo * const 0x02de4fd0, nsIRequest * 0x02de63f0, nsISupports * 0x00000000) line 219 + 16 bytes nsResChannel::OnStartRequest(nsResChannel * const 0x02de63f8, nsIRequest * 0x02de6180, nsISupports * 0x00000000) line 532 nsFileChannel::OnStartRequest(nsFileChannel * const 0x02de6188, nsIRequest * 0x02de58f4, nsISupports * 0x00000000) line 453 + 37 bytes nsOnStartRequestEvent::HandleEvent() line 108 + 53 bytes nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x02de50a4) line 64 PL_HandleEvent(PLEvent * 0x02de50a4) line 590 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x01314f00) line 520 + 9 bytes _md_EventReceiverProc(HWND__ * 0x00100538, unsigned int 49548, unsigned int 0, long 20008704) line 1071 + 9 bytes USER32! 77e148dc() USER32! 77e14aa7() USER32! 77e266fd() main(int 1, char * * 0x00635fc0) line 157 + 11 bytes mainCRTStartup() line 338 + 17 bytes

FWIW, the last stack trace reported by karnaze begins by two same lines as the stack in bug 82569

And this bug was probably fixed by bug 82141 (same stack)

Yup, looks like the same problem. *** This bug has been marked as a duplicate of 82141 ***

verified dups

I'm disabling the e-mail account used for testing... If bug 82141 is reopened for any reason and anyone wants the account back for more testing, just post a comment. Thanks.