Closed Bug 37076 Opened 25 years ago Closed 24 years ago

Crashes on Back Button at nsHTMLInputElement::~nsHTMLInputElement 34afee55

Categories

(Core :: Layout, defect, P1)

defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: namachi, Assigned: talkback)

References

()

Details

(Keywords: crash, topcrash)

One of the top crash submitted by QFA.It seems the crash happens in cleanup code. User Comment :- Popular sites in which the back button are clicked :- -leaving cnn.com causes crash -going back from sharkyextreme.com/games to sharkyextreme.com -leaving www.cnn.com for developer.netscape.com ... -www.arstechnica.com Other Causes : -exiting .exe -Crasjing Exit Win 32 Navigator via File-->Quit -did a search on foobar in the search panel and clicked on one -closed browser while it was loading yahoo mail -On a slow connection if you close the Netscape Activation window before it finishes drawing the Browser Crashes.. Stack Trace :- ncident ID 9090138 nsHTMLInputElement::~nsHTMLInputElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp, line 213] nsHTMLInputElement::`scalar deleting destructor' nsHTMLInputElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp, line 258] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableRowElement::~nsHTMLTableRowElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, line 257] nsHTMLTableRowElement::`scalar deleting destructor' nsHTMLTableRowElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, line 261] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableSectionElement::~nsHTMLTableSectionElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c pp, line 121] nsHTMLTableSectionElement::`scalar deleting destructor' nsHTMLTableSectionElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c pp, line 125] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableElement::~nsHTMLTableElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, line 363] nsHTMLTableElement::`scalar deleting destructor' nsHTMLTableElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, line 367] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableRowElement::~nsHTMLTableRowElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, line 257] nsHTMLTableRowElement::`scalar deleting destructor' nsHTMLTableRowElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, line 261] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableSectionElement::~nsHTMLTableSectionElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c pp, line 121] nsHTMLTableSectionElement::`scalar deleting destructor' nsHTMLTableSectionElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c pp, line 125] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableElement::~nsHTMLTableElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, line 363] nsHTMLTableElement::`scalar deleting destructor' nsHTMLTableElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, line 367] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsBodyInner::~nsBodyInner [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLBodyElement.cpp, line 157] nsHTMLBodyElement::`scalar deleting destructor' nsHTMLTableColGroupElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableColGroupElement. cpp, line 115] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLHtmlElement::`scalar deleting destructor' nsHTMLMenuElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLMenuElement.cpp, line 109] nsDocument::~nsDocument [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 674] nsHTMLDocument::~nsHTMLDocument [d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 274] nsDocument::Release [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 803] nsXMLDocument::Release [d:\builds\seamonkey\mozilla\layout\xml\document\src\nsXMLDocument.cpp, line 194] nsCOMPtr_base::~nsCOMPtr_base [d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 50] DocumentViewerImpl::~DocumentViewerImpl [d:\builds\seamonkey\mozilla\layout\base\src\nsDocumentViewer.cpp, line 398] Code Around this area:- 20 nsHTMLInputElement::~nsHTMLInputElement() 207 { 208 karnaze 1.5 if (nsnull != mForm) { 209 // prevent mForm from decrementing its ref count on us 210 mForm->RemoveElement(this, PR_FALSE); 211 NS_RELEASE(mForm); 212 } 213 kipp 1.1 }
Keywords: topcrash
Summary: Crashes on Back Button at nsHTMLInputElement::~nsHTMLInputElement 34afee55 → Crashes on Back Button at nsHTMLInputElement::~nsHTMLInputElement 34afee55
Adding topcrash keyword
This crash also happens a lot while closing Netscape 6.
is this the same crash as #36451?
Buster, I think input elements is you
Assignee: troy → buster
It looks like aChild in nsFormControlList::RemoveElementFromTable() has already been deleted before this call. On top of that on the stack, mForm in nsHTMLInputElement::~nsHTMLInputElement() has already been deleted. So, maybe this is a ref counting bug on mForm? Reassigning to Rod. I can't take all the fun...
Assignee: buster → rods
Priority: P3 → P1
Target Milestone: --- → M16
Cc'ing Nisheeth. Buster's description sounds a lot like the problem that Nisheeth was looking at
Assignee: rods → pollmann
Re-assigning this to Eric Pollmann. He has code in his tree that cleans up the circular references between a form and its form controls.
Accepting. This is also being tracked as bug 36639. Keeping this open for a test case.
Status: NEW → ASSIGNED
OS: Windows NT → All
Hardware: PC → All
Nisheeth, your fix for this crash earlier seems to have stuck, can't reproduce this in today's builds.
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → WORKSFORME
Adding crash keyword
Keywords: crash
Works for me in the July 11th build.
Status: RESOLVED → VERIFIED
Moving all the Works For Me bugs to talkback user account for future reference.
Assignee: pollmann → talkback
Status: VERIFIED → NEW
We are gathering all the Resolved and WFM bugs which are happened to be topcrash bugs and assigning it to talkback. I am marking all of them as RESOLVED WFM.
Status: NEW → RESOLVED
Closed: 25 years ago24 years ago
v.wfm...haven't seen this crash anywhere in Talkback data recently.
You need to log in before you can comment on or make changes to this bug.