These crashes poking around in pref panels were pretty easy to hit on M7 candidates from Saturday. Do we know want is going on there? Trigger Type: Program Crash Trigger Reason: Access violation Call Stack: (Signature = RDFElementImpl::AddScriptEventListener 46fa5bec) RDFElementImpl::AddScriptEventListener [d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp, line 2000] RDFElementImpl::SetAttribute [d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp, line 1950] RDFXULBuilderImpl::AddAttribute [d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFXULBuilder.cpp, line 2465] RDFXULBuilderImpl::CreateXULElement [d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFXULBuilder.cpp, line 2216] RDFXULBuilderImpl::CreateOrReuseElement [d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFXULBuilder.cpp, line 1872] RDFXULBuilderImpl::CreateRootContent [d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFXULBuilder.cpp, line 542] XULDocumentImpl::SetRootResource [d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 2361] XULContentSinkImpl::OpenTag [d:\builds\seamonkey\mozilla\rdf\datasource\src\nsXULContentSink.cpp, line 1373] XULContentSinkImpl::OpenContainer [d:\builds\seamonkey\mozilla\rdf\datasource\src\nsXULContentSink.cpp, line 592] CWellFormedDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 468] CWellFormedDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 254] nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 903] nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 852] nsParser::EnableParser [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 587] CSSLoaderImpl::Cleanup [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 613] CSSLoaderImpl::SheetComplete [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 683] CSSLoaderImpl::ParseSheet [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 718] CSSLoaderImpl::DidLoadStyle [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 748] DoneLoadingStyle [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 555] nsUnicharStreamLoader::OnStopBinding [d:\builds\seamonkey\mozilla\network\module\nsNetStreamLoader.cpp, line 158] nsDocumentBindInfo::OnStopBinding [d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1601] OnStopBindingProxyEvent::HandleEvent [d:\builds\seamonkey\mozilla\network\module\nsNetThread.cpp, line 594] StreamListenerProxyEvent::HandlePLEvent [d:\builds\seamonkey\mozilla\network\module\nsNetThread.cpp, line 474] PL_HandleEvent [plevent.c, line 492] PL_ProcessPendingEvents [plevent.c, line 453] _md_EventReceiverProc [plevent.c, line 881] KERNEL32.DLL + 0x3663 (0xbff73663) KERNEL32.DLL + 0x22894 (0xbff92894) 0x00768178 1984 RDFElementImpl::AddScriptEventListener(nsIAtom* aName, const nsString& aValue, REFNSIID aIID) 1985 hyatt 1.14 { 1986 waterson 1.16 if (! mDocument) 1987 return NS_OK; // XXX 1988 1989 nsresult ret = NS_OK; 1990 nsIScriptContext* context; 1991 nsIScriptContextOwner* owner; 1992 1993 owner = mDocument->GetScriptContextOwner(); 1994 hyatt 1.62 1995 nsAutoString tagStr; 1996 mTag->ToString(tagStr); 1997 1998 waterson 1.16 if (NS_OK == owner->GetScriptContext(&context)) { 1999 hyatt 1.62 if (tagStr == "window") { 2000 nsIDOMEventReceiver *receiver; 2001 nsIScriptGlobalObject *global = context->GetGlobalObject(); 2002 2003 if (nsnull != global && NS_OK == global->QueryInterface(kIDOMEventReceiverIID, (void**)&receiver)) { 2004 nsIEventListenerManager *manager; 2005 if (NS_OK == receiver->GetListenerManager(&manager)) { 2006 nsIScriptObjectOwner *mObjectOwner; 2007 if (NS_OK == global->QueryInterface(kIScriptObjectOwnerIID, (void**)&mObjectOwner)) { 2008 ret = manager->AddScriptEventListener(context, mObjectOwner, aName, aValue, aIID); 2009 NS_RELEASE(mObjectOwner); 2010 } 2011 NS_RELEASE(manager); 2012 } 2013 NS_RELEASE(receiver); 2014 } 2015 NS_IF_RELEASE(global); 2016 } 2017 else { 2018 waterson 1.16 nsIEventListenerManager *manager; 2019 if (NS_OK == GetListenerManager(&manager)) { 2020 nsIScriptObjectOwner* owner; 2021 if (NS_OK == QueryInterface(kIScriptObjectOwnerIID, 2022 (void**) &owner)) { 2023 ret = manager->AddScriptEventListener(context, owner, 2024 aName, aValue, aIID); 2025 NS_RELEASE(owner); 2026 } 2027 NS_RELEASE(manager); 2028 hyatt 1.14 } 2029 NS_RELEASE(context); 2030 hyatt 1.62 } 2031 waterson 1.16 } 2032 NS_RELEASE(owner); 2033 2034 return ret; 2035 hyatt 1.14 } 2036 waterson 1.1 Subject: C5.0-apprunner last 7 days Resent-Date: Sun, 20 Jun 1999 07:16:20 -0700 (PDT) Resent-From: seamonkey-tb-reports@netscape.com Date: Sun, 20 Jun 1999 07:13:27 -0700 From: Netscape Communications Corporation <feedbackagent@netscape.com> To: "seamonkey-tb-reports@netscape.com" <seamonkey-tb-reports@netscape.com> Latest C5.0 boxes from apprunner. 1 C5.0 boxes (1675 Incidents) Incident 1–50 of 1675 Incident Trigger Time (Day) Call Stack Signature Trigger Source File Name Build ID User Email Address User Comments 10179418 06/19/99 10:33AM RDFElementImpl::AddScriptEventListener 46fa5bec d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp 1999061909 chofmann@netscape.com click around on pref window from mail 10179417 06/19/99 10:25AM RDFElementImpl::AddScriptEventListener 46fa5bec d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp 1999061909 chofmann@netscape.com open up pref window and click around. 10179415 06/19/99 05:40AM RDFElementImpl::AddScriptEventListener 46fa5bec d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp 1999061808 chofmann@netscape.com just double click on top level navigator pref in pref pannel 10179414 06/19/99 05:36AM RDFElementImpl::AddScriptEventListener 46fa5bec d:\builds\seamonkey\mozilla\rdf\content\src\nsRDFElement.cpp 1999061808 chofmann@netscape.com bring up pref window, pick a few prefs, pick top level navigator pref. crash.

First off, we're not checking for a null pointer from GetScriptContentOwner(), which is bad. But there's something even more sinister going on here. Since this tree control has no "ondblclk" handler set up, a double click turns into two mouse clicks. Thanks to all of Simon's memory fixes, this triggers the same page to be loaded *twice* in rapid succession. It seems like this is the recipe for some kind of race condition; somebody is trying to set up a script event listener on the document that is about to get destroyed. Fixing this is _probably_ as simple as just checking each call to GetScriptContextOwner() for a null return value, and bailing if we find one (the rest of the tear-down code should take care of cleanup). John: you might also want to add some front-end JS to your "onclick" handler s.t. it checks to see if the page that got clicked is actually loaded before trying to re-load it.

Wouldn't adding ondblclick="" work around it, too?

In either case, who should own this?

waterson, dup of the fix you put in a few days ago? what extra work might be needed here?

This works for me now, so marking as FIXED.

Verified fixed on Win95 apprunner build 1999070908.

BULK MOVE: Changing component from XUL to XP Toolkit/Widgets: XUL. XUL component will be deleted.