125127 - M098 crashes editing pages in composer [@ FrameManager::GetPrimaryFrameFor]

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[greer]

M098 is showing crashes at this signature in the topcrash reports for Linux 
only. It is probably related to the issues in bug 117141. I have not been able 
to reproduce this on Windows.

User comments point to crashes resulting from selecting File -> Edit Page (or 
Ctrl+e).

FrameManager::GetPrimaryFrameFor   31 

         FrameManager::GetPrimaryFrameFor()
         GetPrimaryFrameFor()
         nsCSSFrameConstructor::RecreateFramesForContent()
         nsCSSFrameConstructor::ProcessRestyledFrames()
         PresShell::ReconstructStyleData()
         PresShell::StyleSheetDisabledStateChanged()
         nsDocument::SetStyleSheetDisabledState()
         nsHTMLEditor::ApplyDocumentOrOverrideStyleSheet()
         nsHTMLEditor::ApplyOverrideStyleSheet()
         nsEditorShell::PrepareDocumentForEditing()
         nsEditorShell::EndPageLoad()
         nsEditorShell::OnStateChange()
         nsDocLoaderImpl::FireOnStateChange()
         nsDocLoaderImpl::doStopDocumentLoad()
         nsDocLoaderImpl::DocLoaderIsEmpty()
         nsDocLoaderImpl::OnStopRequest()
         nsLoadGroup::RemoveRequest()
         imgRequestProxy::OnStopRequest()
         imgRequest::OnStopRequest()
         ProxyListener::OnStopRequest()
         nsStreamListenerTee::OnStopRequest()
         nsHttpChannel::OnStopRequest()
         nsOnStopRequestEvent::HandleEvent()
         nsARequestObserverEvent::HandlePLEvent()
         PL_HandleEvent()
         PL_ProcessPendingEvents()
         nsEventQueueImpl::ProcessPendingEvents()
         event_processor_callback()
         our_gdk_io_invoke()
         libglib-1.2.so.0 + 0xeeb0 (0x40376eb0)
         libglib-1.2.so.0 + 0x10578 (0x40378578)
         libglib-1.2.so.0 + 0x10b83 (0x40378b83)
         libglib-1.2.so.0 + 0x10d1c (0x40378d1c)
         libgtk-1.2.so.0 + 0x8d7f7 (0x402997f7)
         nsAppShell::Run()
         nsAppShellService::Run()
         main1()
         main()
         libc.so.6 + 0x1d6cf (0x404bc6cf)     (2801219) URL: www.cnn.com
     (2801219)  Comments: 1. Start Mozilla2. visit http://www.cnn.com3. From the 
File menu: "Edit Page"4. Crash at the end of the loading of the page
     (2801131)  URL: www.cnn.com
     (2801131)  Comments: 1. Open www.cnn.com and www.tnetarab.com2. From the 
File menue "Edit Page" on www.cnn.com3. Crash
     (2800966)  URL: www.haaretz.co.il
     (2800966)  Comments: 1. start Mozilla2. open www.haaretz.co.il3. wait for 
the page to finish
loading4. From the File menu: "Edit Page"5. Crash during the loading of the page
     (2800960)  URL: www.officedepot.co.il
     (2800960)  Comments: 1. Start mozilla 2. open 
http://www.officedepot.co.il3. wait for the page to finish loading4. from the 
File menu: "Edit Page"5. wait for the page to finish loading6. Crash - just 
before the loading was finished
     (2800953)  URL: www.officedepot.co.il
     (2800953)  Comments: 1. start Mozilla2. open http://www.officedepot.co.il3. 
Edit page4. Crash
     (2736980)  Comments: editing html file
     (2734844)  URL: http://www.assafir.com
     (2680510)  URL: http://www.sun.de/
     (2680510)  Comments: loading this page in the editor 
     (2620055)  Comments: composer 
     (2600638)  URL: Somewhere within hotmail.com (yuck!)
     (2600638)  Comments: I tried to edit a page (Ctrl+E) and Composer opened up 
and seemed to be
busy loading the page  and next thing you know I'm configuring my Talkback 
agent. :-)
     (2577038)  Comments: I just tried opening an html file in the composer  I 
would send the file alongif I could but there isn't any attach feature.
     (2576912)  URL: 
http://builder.cnet.com/webbuilding/pages/Authoring/CSS/table.html?tag=st.bl.388
0.ref_l.bl_table
     (2576912)  Comments: I tried File->Edit Page (Ctrl-E)
     (2576870)  URL: 
http://builder.cnet.com/webbuilding/pages/Authoring/CSS/table.html?tag=st.bl.388
0.ref_l.bl_table
     (2576870)  Comments: I chose File->Edit Page (Ctrl-E)
     (2571194)  URL: http://www.heise.de/newsticker
     (2571194)  Comments: Started composer  File->Recent Pages->1 heise online: 
7-Tage-News [http://www.heise.de/newsticker]The page starts to load and is being 
displayed  after having loadedthings for a few seconds Mozilla just crashes. 
Note that I didn't do anything at all 
     (2571194)  Comments:  the page was just loading. Note further that this is 
reproducible at least with the version of the above page current as of this 
writing.
     (2557873)  Comments: Trying to open an HTML file with Composer
     (2551608)  Comments: Well  I attempted to edit a local page I was viewing 
in the browser. I hadthe same page open in vim at the same time. I saw the 
changelognotice that said something about
editing files simultaneously  but Ifigured I could at least goof around with it 
in
     (2551608)  Comments:  Mozilla; I mean how couldMozilla know about vim? 
Anyway...You guys ROCK!!Thanks a million!!!
     (2524448)  URL: http://www.heise.de/newsticker
     (2524448)  Comments: I wanted to press STRG-R  but pressed STRG-E. Then the 
Composer window came up and i pushed immediatly on the <X> to close the window. 
And the whole browser died

Comment 1

[Kevin McCluskey (gone)]

Marking nsbeta1+

Comment 2

[Jay Patel [:jay]]

adding qawanted keyword to see if we can narrow this down to a reproducible
testcase.

Comment 3

[Chris Petersen]

With the Feb 19th build (2002-02-19-06) , I can't reproduce the crash as
described. I loaded each url into Composer using 'Edit Page' command. Page
opened in Composer without crashing.

Comment 4

[Chris Petersen]

Tested under Linux Red hat 6.2.

Comment 5

[Marc Attinasi]

no repro case --> P2 for now.  Please help get this higher priority by finding a
repro case! Thanks!!!

Comment 6

[Chris Petersen]

I have been able to crash the application when editing the following page:

www.officedepot.co.il


Steps to reproduce:

1) Open url
2) Select Edit Page from File menu
3) After page is displayed, begin to click in different areas of page with cursor.
4) After a few seconds, the application crashes

Tested with the Feb 25 th Linux build (2002-02-25-08). 

Comment 7

[Chris Petersen]

Here is what I get from talkback:

nsSelection::GetPrevNextBidiLevels()
nsCaret::SetupDrawingFrameAndOffset()
nsCaret::DrawCaret()
nsCaret::StartBlinking()
nsCaret::NotifySelectionChanged()
nsTypedSelection::NotifySelectionListeners()
nsSelection::NotifySelectionListeners()
nsSelection::TakeFocus()
nsSelection::HandleClick()
nsSelection::HandleDrag()
nsFrame::HandleDrag()
nsFrame::HandleEvent()
nsBlockFrame::HandleEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsViewManager::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWidget::OnMotionNotifySignal()
nsWindow::HandleGDKEvent()
dispatch_superwin_event()
handle_gdk_event()
libgdk-1.2.so.0 + 0x174db (0x403414db)
libglib-1.2.so.0 + 0x10186 (0x40371186)
libglib-1.2.so.0 + 0x10751 (0x40371751)
libglib-1.2.so.0 + 0x10804 (0x40371804)
nsAppShell::DispatchNativeEvent()
nsXULWindow::ShowModal()
nsWebShellWindow::ShowModal()
nsContentTreeOwner::ShowAsModal()
nsWindowWatcher::OpenWindowJS()
GlobalWindowImpl::OpenInternal()
GlobalWindowImpl::OpenDialog()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
nsXPCWrappedJSClass::CallMethod()
nsXPCWrappedJS::CallMethod()
PrepareAndDispatch()
nsXPTCStubBase::Stub5()
nsControllerCommandManager::DoCommand()
nsComposerController::DoCommand()
nsEditorShell::DoControllerCommand()
nsEditorShell::HandleMouseClickOnElement()
nsEditorShellMouseListener::MouseDown()
nsEventListenerManager::HandleEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
nsGenericElement::HandleDOMEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsViewManager::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWidget::OnButtonPressSignal()
nsWindow::HandleGDKEvent()
dispatch_superwin_event()
handle_gdk_event()
libgdk-1.2.so.0 + 0x174db (0x403414db)
libglib-1.2.so.0 + 0x10186 (0x40371186)
libglib-1.2.so.0 + 0x10751 (0x40371751)
libglib-1.2.so.0 + 0x108f1 (0x403718f1)
libgtk-1.2.so.0 + 0x8c5b9 (0x402955b9)
nsAppShell::Run()
nsAppShellService::Run()
netscape-bin + 0x7e89 (0x0804fe89)
netscape-bin + 0x86d7 (0x080506d7) 

Comment 8

[greer]

Chris, that stack looks pretty different. Talkback data currently shows you are
the only one who has been able to crash at that particular signature. Maybe a
different bug under Bidi Hebrrew & Arabic, considering the site and the
signature. I'm removing the 'testcase' keyword for now.

Comment 9

[Marc Attinasi]

Chris, that stack looks very different - can you open a new bug on that (since
greer has suggested that is a unique stack so far)?  Thanks, and keep trying to
get this one reproduced too!

Comment 10

[Jay Patel [:jay]]

This hasn't happened on the MozillaTrunk since 3/1.  If we can't reproduce this
one and it doesn't show up as a topcrasher in Mozilla 0.9.9 perhaps we can mark
it worksforme?

Comment 11

[Jay Patel [:jay]]

Also wanted to note that M099 data is showing a couple of crashes with this
stack signature, but looking at the stack...it looks like it might be a
different bug.  

Comment 12

[Marc Attinasi]

Yes, I looked at the branch talkbacks with this sig
(FrameManager::GetPrimaryFrameFor) and the rest of the stack looks different. 
Fortunately, the last trunk talkback for this was on 3/1 - anyway, I'll keep
monitoring the talkbacks and hope this has 'just gone away'

Comment 13

[Marc Attinasi]

Looking at the talkbacks for this sig (FrameManager::GetPrimaryFrameFor) I am
seeing all stack overflows, mostly dealing with checkbox state restoration.  The
last one on the trunk was on 03/07, which was the date that jkeiser checked in a
fix for checkbox state restoration (bug 108308).

There is another stack (for talkback report 3990111 at
http://climate.netscape.com/reports/incidenttemplate.cfm?bbid=3990111) that
looks like a know problem with handling onBlur (bug 125906). This was fixed very
recently, but was probably a pretty rare case because it required specific
script on the page.

Since there have been no new reports of this crash on the trunk, and the cause
of most of the stacks is well known and has been fixed on the trunk already, I'm
closing this as FIXED.

If this stack crops up again, we should probably open a new bug - hopefully we
will look at the rest of the stack and the cause of the crash (segfault vs.
stack overflow) before assuming that they are all the same problem too.

Comment 14

[Marc Attinasi]

See also bug 125437 - related bug on checkbox setting.

Comment 15

[Madhur Bhatia]

marking verified