In some talkback data analysis reporting tools I'm working on I see a collection of 11 crashes in nsDocument::GetPrincipal in what appears to be branch builds of the last couple of days. 2000031806,2000032116,2000032106.... Several of these crashes are around startup, but not all. The crashes occur around around line 877 of http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp here is the code fragment around where we end up crashing in source from the trunk. I don't think this code has changed on the branch but I'm tracking this down.. 868 vidur 3.75 NS_IF_RELEASE(mListenerManager); 869 NS_IF_RELEASE(mDOMStyleSheets); 870 871 NS_IF_RELEASE(mNameSpaceManager); 872 nisheeth 3.99 873 warren 3.129 (void)aChannel->GetURI(&mDocumentURL); 874 warren 3.147 nsCOMPtr<nsISupports> owner; 875 aChannel->GetOwner(getter_AddRefs(owner)); 876 if (owner) 877 pp 3.179 owner->QueryInterface(NS_GET_IID(nsIPrincipal), (void**)&mPrincipal); 878 rpotts 3.151 879 mDocumentLoadGroup = getter_AddRefs(NS_GetWeakReference(aLoadGroup)); 880 buster 3.161 // there was an assertion here that aLoadGroup was not null. This is no longer valid 881 // nsWebShell::SetDocument does not create a load group, and it works just fine. 882 nisheeth 3.99 883 if (NS_OK == rv) { 884 rv = NS_NewNameSpaceManager(&mNameSpaceManager); 885 } In general here is what the stack traces are looking like. Incident ID 7290613 nsDocument::GetPrincipal [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 887] PSMGLUE.DLL + 0x3700 (0x01683700) PSMGLUE.DLL + 0x3579 (0x01683579) PSMGLUE.DLL + 0x2f78 (0x01682f78) nsWebShell::OnStartDocumentLoad [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2626] nsDocLoaderImpl::FireOnStartDocumentLoad [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 531] nsDocLoaderImpl::OnStartRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 407] nsLoadGroup::AddChannel [d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 452] nsHTTPChannel::Open [d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPChannel.cpp, line 1102] nsHTTPChannel::AsyncRead [d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPChannel.cpp, line 283] nsDocumentOpenInfo::Open [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 247] nsURILoader::OpenURIVia [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 592] nsURILoader::OpenURI [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 511] nsWebShell::DoLoadURL [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 1526] nsWebShell::LoadURI [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 1727] nsWebShell::LoadURL [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2012] nsWebShell::HandleLinkClickEvent [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2465] OnLinkClickEvent::HandleEvent [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2351] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 557] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 520] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1013] KERNEL32.DLL + 0x363b (0xbff7363b) KERNEL32.DLL + 0x24407 (0xbff94407) 0x00688bda Here are some details about the standing of this crash within recent crashes and some additional information about the builds it has been observed in, and addional platform, configuration, and user comments where they are avaible. Can you have a look to see if any recent branch checkin's have created a regression or exposed an old problem? Top crash data from Netscape6 builds Total blackboxes received 245 N6datasample Total unique users 91 Top crashes 17 il_PermitLoad 15 0x00000000 11 nsDocument::GetPrincipal 9 nsCString::SetCapacity 8 nsGenericElement::HandleDOMEvent 7 MSVCRT.DLL 7 6 GKHTML.DLL 6 0x61ba61b8 5 IMGLUE.DLL 4 nsHistoryEntry::Load 4 il_PermitLoad() 4 gkwidget.dll 4 0xffc10000 4 0x00000008 3 nsHTTPChannel::SetResponse 3 nsBlockReflowState::~nsBlockReflowState 3 gkhtml.dll 3 StyleSetImpl::CantRenderReplacedElement 3 KERNEL32.DLL nsDocument::GetPrincipal nsDocument::GetPrincipal a785b594 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000031806 CrashDate: 2000-03-18 UptimeMinutes: 15 Total: 15 OS Windows 98 4.10 build 67766222 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4bf6f747 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032116 CrashDate: 2000-03-21 UptimeMinutes: 0 Total: 0 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4c80ca82 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 0 Total: 0 OS Windows NT 4.0 build 1381 ->More data in blackbox id 6982438 nsDocument::GetPrincipal de50e61b http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 1 Total: 13 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 0abb6fc1 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 2 Total: 15 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4dd30361 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 11 Total: 11 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 8c891c0c http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 76502a96 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 76502a96 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 3a5295f3 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 2 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 3a5295f3 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 1 Total: 1 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal nsDocument::GetPrincipal a785b594 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000031806 CrashDate: 2000-03-18 UptimeMinutes: 15 Total: 15 OS Windows 98 4.10 build 67766222 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4bf6f747 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032116 CrashDate: 2000-03-21 UptimeMinutes: 0 Total: 0 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4c80ca82 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 0 Total: 0 OS Windows NT 4.0 build 1381 ->More data in blackbox id 6982438 nsDocument::GetPrincipal de50e61b http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 1 Total: 13 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 0abb6fc1 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 2 Total: 15 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4dd30361 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 11 Total: 11 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 8c891c0c http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 76502a96 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 76502a96 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 3a5295f3 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 2 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 3a5295f3 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 1 Total: 1 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 Incident ID 7290613 nsDocument::GetPrincipal [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 887] PSMGLUE.DLL + 0x3700 (0x01683700) PSMGLUE.DLL + 0x3579 (0x01683579) PSMGLUE.DLL + 0x2f78 (0x01682f78) nsWebShell::OnStartDocumentLoad [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2626] nsDocLoaderImpl::FireOnStartDocumentLoad [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 531] nsDocLoaderImpl::OnStartRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 407] nsLoadGroup::AddChannel [d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 452] nsHTTPChannel::Open [d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPChannel.cpp, line 1102] nsHTTPChannel::AsyncRead [d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPChannel.cpp, line 283] nsDocumentOpenInfo::Open [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 247] nsURILoader::OpenURIVia [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 592] nsURILoader::OpenURI [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 511] nsWebShell::DoLoadURL [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 1526] nsWebShell::LoadURI [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 1727] nsWebShell::LoadURL [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2012] nsWebShell::HandleLinkClickEvent [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2465] OnLinkClickEvent::HandleEvent [d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 2351] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 557] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 520] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1013] KERNEL32.DLL + 0x363b (0xbff7363b) KERNEL32.DLL + 0x24407 (0xbff94407) 0x00688bda p,nisheeth,warren,scc, In some talkback data analysis reporting tools I'm working on I see a collection of 11 crashes in nsDocument::GetPrincipal in what appears to be branch builds of the last couple of days. 2000031806,2000032116,2000032106.... Several of these crashes are around startup, but not all. The crashes occur around around line 877 of http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp here is the code fragment around where we end up crashing in source from the trunk. I don't think this code has changed on the branch but I'm tracking this down.. 868 vidur 3.75 NS_IF_RELEASE(mListenerManager); 869 NS_IF_RELEASE(mDOMStyleSheets); 870 871 NS_IF_RELEASE(mNameSpaceManager); 872 nisheeth 3.99 873 warren 3.129 (void)aChannel->GetURI(&mDocumentURL); 874 warren 3.147 nsCOMPtr<nsISupports> owner; 875 aChannel->GetOwner(getter_AddRefs(owner)); 876 if (owner) 877 pp 3.179 owner->QueryInterface(NS_GET_IID(nsIPrincipal), (void**)&mPrincipal); 878 rpotts 3.151 879 mDocumentLoadGroup = getter_AddRefs(NS_GetWeakReference(aLoadGroup)); 880 buster 3.161 // there was an assertion here that aLoadGroup was not null. This is no longer valid 881 // nsWebShell::SetDocument does not create a load group, and it works just fine. 882 nisheeth 3.99 883 if (NS_OK == rv) { 884 rv = NS_NewNameSpaceManager(&mNameSpaceManager); 885 } Here are some details about the standing of this crash within recent crashes and some additional information about the builds it has been observed in, and addional platform, configuration, and user comments where they are avaible. Can you have a look to see if any recent branch checkin's have created a regression or exposed an old problem? Thanks chris h. Chris Hofmann wrote: Top crash data from Netscape6 builds Total blackboxes received 245 N6datasample Total unique users 91 Top crashes 17 il_PermitLoad 15 0x00000000 11 nsDocument::GetPrincipal 9 nsCString::SetCapacity 8 nsGenericElement::HandleDOMEvent 7 MSVCRT.DLL 7 6 GKHTML.DLL 6 0x61ba61b8 5 IMGLUE.DLL 4 nsHistoryEntry::Load 4 il_PermitLoad() 4 gkwidget.dll 4 0xffc10000 4 0x00000008 3 nsHTTPChannel::SetResponse 3 nsBlockReflowState::~nsBlockReflowState 3 gkhtml.dll 3 StyleSetImpl::CantRenderReplacedElement 3 KERNEL32.DLL nsDocument::GetPrincipal nsDocument::GetPrincipal a785b594 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000031806 CrashDate: 2000-03-18 UptimeMinutes: 15 Total: 15 OS Windows 98 4.10 build 67766222 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4bf6f747 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032116 CrashDate: 2000-03-21 UptimeMinutes: 0 Total: 0 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4c80ca82 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 0 Total: 0 OS Windows NT 4.0 build 1381 ->More data in blackbox id 6982438 nsDocument::GetPrincipal de50e61b http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 1 Total: 13 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 0abb6fc1 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 2 Total: 15 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4dd30361 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 11 Total: 11 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 8c891c0c http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 76502a96 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 76502a96 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 3a5295f3 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 2 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 3a5295f3 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 1 Total: 1 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal nsDocument::GetPrincipal a785b594 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000031806 CrashDate: 2000-03-18 UptimeMinutes: 15 Total: 15 OS Windows 98 4.10 build 67766222 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4bf6f747 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032116 CrashDate: 2000-03-21 UptimeMinutes: 0 Total: 0 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4c80ca82 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 0 Total: 0 OS Windows NT 4.0 build 1381 ->More data in blackbox id 6982438 nsDocument::GetPrincipal de50e61b http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 1 Total: 13 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 0abb6fc1 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 2 Total: 15 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 4dd30361 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032106 CrashDate: 2000-03-21 UptimeMinutes: 11 Total: 11 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 8c891c0c http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 76502a96 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 76502a96 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 3 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 3a5295f3 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 0 Total: 2 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438 nsDocument::GetPrincipal 3a5295f3 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/src/nsDocument.c pp line 887 Build: 2000032206 CrashDate: 2000-03-22 UptimeMinutes: 1 Total: 1 OS Windows 98 4.10 build 67766446 ->More data in blackbox id 6982438

trudelle is the owner of some of these crashes.

The crash in il_PermitLoad in the talk-back data above has nothing to do with the beta1 branch. It was due to a regression that was checked into the trunk (and not the branch) over the week-end and promptly fixed on Monday morning. It is in no way related to the GetPrincipal crash on the beta1 branch (which is what this bug report is all about).

I can't think of why PSM would be calling nsDocument::GetPrincipal. There are recent changes in the tip for signed scripts that mstoltz added, but I believe even there the calls are from mozilla code and not PSM. Could it be there is a mismatch of binaries? nsDocument::GetPrincipal is next to nsDocument::GetDocumentURL. If a virtual function was removed anywhere in nsDocument or its base classes but PSM was not recompiled, then calls from PSM to nsDocument::GetDocumentURL would call nsDocument::GetPrincipal instead and that would likely result in a crash.

This looks weird to me too. I did check in a minor change to nsDocument::GetPrincipal last night, but this crash has apparently been happening for a while, and I know of no place where psmglue interacts with nsDocument. In my code, psmglue only interacts with nsJAR, which isn't being used here. I agree with Norris that this looks like a binary mismatch. I'll keep a lookout for this crash, though.

Putting on PDT- radar for beta1.

The line that causes the crash is an NS_ADDREF(...). It is surely crashing because the argument is null. The defensive coding fix is to change the line to NS_IF_ADREF(...) (i.e., three safe characters, that can *only* stop a crash, and can't impact the code semantics). Mstoltz checked in code in the trunk that was intended to stop this crash, but that checkin appears to have a typo (i.e., the trunk needs to be similarly fixed). The above fix (adding "_IF" was reviewed by markt. IF we are respinning, I'd take this fix.

I should have been clear in that last comment: In my opinion, if we respin, we *should* take this fix. I would need to get closure from other folks before landing the fix (or approving a landing on the branch).

Phil and I agreed to PDT+ this bug. We need to be sure we can run *some* test case that exercises this codepath before we would approve landing the 3 character fix on the beta1 branch.

I have no idea where the fix you're taking about should go. If you want me to approve this, then provide more data, please.

I'm now convinced that I was mistaken, the defensive coding effort (line 886 of nsDocument.c, just prior to the return) would not help, and that the stack is indeed at least partially corrupt. I am convinced that the null that I was arguing at "defending against" cannot appear (in the course of running the function in standard flow). Note that the bug report (above) shows the nsDocument file around line 877 (rather than 887, where the crash took place). The fact that the stack is always corrupt with this consistent stack makes me curious about scenarios for which the method (that we see on the tail end of the crashing stack) could *ever* get called. As Norris noted, it is difficult to understand how the GetPrincipal() method can ever be deliberately called by any PSM code as would be indicated by the crashing stack traces. Waterson was more than helpful in trying to look at this more carefully, and helping me understand more of the flow. He noted that it would be helpful to have pointers to a) the black boxes; b) a link map to at least look at the PSM methods that do occupy the stack. Since I no longer believe that my defensive coding would help, I'm restoring this bug to PDT- (just like it was when I began chasing), and I'm going to go home and get some sleep.

Tom -- please take a look into this nasty bug.

Moving to m16 due to severity

Adding crash keyword.

Marking this nsbeta2, so that it comes on the beta 2 radar.

Putting on [nsbeta2+] radar for beta2 fix.

Re-assigning to myself as part of the XML/DOM bug distribution discussion.

Shiva, here's the bug that I left you a voice mail about. I installed PSM on an NT debug commercial build today and visited a couple of SSL sites. Everything worked fine. Please see if this crash has been reported in recent Talkback logs. If it isn't we should close out this bug or at least lower its priority. Thanks!

There's been a great deal of turnover in the surrounding code since this bug was filed. i agree that if recent Talkback logs don't show this crash, the bug should be closed.

This is NOT seen on the recent builds. There is a possibility it might have been fixed with other PSMGLUE related crash bugs. I am marking it as VERIFIED and WORKSFORME. I will watch in nsbeta2 release for a possible re-producible case.

Marking Verified.