One of the top crash submitted by QFA.It seems the crash happens in cleanup code. User Comment :- Popular sites in which the back button are clicked :- -leaving cnn.com causes crash -going back from sharkyextreme.com/games to sharkyextreme.com -leaving www.cnn.com for developer.netscape.com ... -www.arstechnica.com Other Causes : -exiting .exe -Crasjing Exit Win 32 Navigator via File-->Quit -did a search on foobar in the search panel and clicked on one -closed browser while it was loading yahoo mail -On a slow connection if you close the Netscape Activation window before it finishes drawing the Browser Crashes.. Stack Trace :- ncident ID 9090138 nsHTMLInputElement::~nsHTMLInputElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp, line 213] nsHTMLInputElement::`scalar deleting destructor' nsHTMLInputElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp, line 258] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableRowElement::~nsHTMLTableRowElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, line 257] nsHTMLTableRowElement::`scalar deleting destructor' nsHTMLTableRowElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, line 261] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableSectionElement::~nsHTMLTableSectionElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c pp, line 121] nsHTMLTableSectionElement::`scalar deleting destructor' nsHTMLTableSectionElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c pp, line 125] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableElement::~nsHTMLTableElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, line 363] nsHTMLTableElement::`scalar deleting destructor' nsHTMLTableElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, line 367] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableRowElement::~nsHTMLTableRowElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, line 257] nsHTMLTableRowElement::`scalar deleting destructor' nsHTMLTableRowElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, line 261] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableSectionElement::~nsHTMLTableSectionElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c pp, line 121] nsHTMLTableSectionElement::`scalar deleting destructor' nsHTMLTableSectionElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c pp, line 125] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLTableElement::~nsHTMLTableElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, line 363] nsHTMLTableElement::`scalar deleting destructor' nsHTMLTableElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, line 367] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsBodyInner::~nsBodyInner [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLBodyElement.cpp, line 157] nsHTMLBodyElement::`scalar deleting destructor' nsHTMLTableColGroupElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableColGroupElement. cpp, line 115] nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 2863] nsHTMLHtmlElement::`scalar deleting destructor' nsHTMLMenuElement::Release [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLMenuElement.cpp, line 109] nsDocument::~nsDocument [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 674] nsHTMLDocument::~nsHTMLDocument [d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 274] nsDocument::Release [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 803] nsXMLDocument::Release [d:\builds\seamonkey\mozilla\layout\xml\document\src\nsXMLDocument.cpp, line 194] nsCOMPtr_base::~nsCOMPtr_base [d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 50] DocumentViewerImpl::~DocumentViewerImpl [d:\builds\seamonkey\mozilla\layout\base\src\nsDocumentViewer.cpp, line 398] Code Around this area:- 20 nsHTMLInputElement::~nsHTMLInputElement() 207 { 208 karnaze 1.5 if (nsnull != mForm) { 209 // prevent mForm from decrementing its ref count on us 210 mForm->RemoveElement(this, PR_FALSE); 211 NS_RELEASE(mForm); 212 } 213 kipp 1.1 }

Adding topcrash keyword

This crash also happens a lot while closing Netscape 6.

is this the same crash as #36451?

Buster, I think input elements is you

It looks like aChild in nsFormControlList::RemoveElementFromTable() has already been deleted before this call. On top of that on the stack, mForm in nsHTMLInputElement::~nsHTMLInputElement() has already been deleted. So, maybe this is a ref counting bug on mForm? Reassigning to Rod. I can't take all the fun...

Cc'ing Nisheeth. Buster's description sounds a lot like the problem that Nisheeth was looking at

Re-assigning this to Eric Pollmann. He has code in his tree that cleans up the circular references between a form and its form controls.

Accepting. This is also being tracked as bug 36639. Keeping this open for a test case.

Nisheeth, your fix for this crash earlier seems to have stuck, can't reproduce this in today's builds.

Adding crash keyword

Works for me in the July 11th build.

Moving all the Works For Me bugs to talkback user account for future reference.

We are gathering all the Resolved and WFM bugs which are happened to be topcrash bugs and assigning it to talkback. I am marking all of them as RESOLVED WFM.

v.wfm...haven't seen this crash anywhere in Talkback data recently.