Closed Bug 223775 Opened 21 years ago Closed 21 years ago

crash if I dynamically build <select>

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Windows 2000
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: kurni, Unassigned)

References

(
URL
)

Details

(Keywords: crash, stackwanted) 

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007

Mozilla 1.4 doesn't crash
IE 6.0.2800.1106 doesn't crash

Mozilla 1.5 crash when changing month / year of the 1st module. Sometimes need
to change month / years several times before crashing.

If I remove the drop-down generator from my javascript (i.e. the 2nd module),
Mozilla 1.5 doesn't crash.

The javascript code belongs to me, and my thorough test conclued that the
problem is not in my code.

Reproducible: Always

Steps to Reproduce:
1. Go to http://www.creativefactory.com.au/mozilla/dsp_Home.cfm
2. Click << or >> or change the drop-down value of the first module several time


Actual Results:  
Crash, mozilla closed aburptly.

Expected Results:  
Doesn't crash, like Mozilla 1.4 or IE 6.0.2800.1106
Could you please attach a talkback incident ID?  I cannot get a current trunk
build to crash on this page....
Sometimes mozilla 1.5 can handle the <select> building OK, if problem cannot be
reproduced, please close mozilla 1.5 and relaunch.
Hi Boris, sorry, could you please tell me how to obtain "talkback incident ID"?
Sure.  You use an installer build, make sure to install Talkback (Quality
Feedback Agent).  Then you get Mozilla to crash; the Talkback program should
come up and let you send in a crash report.  Then you run talkback.exe (in the
"components" directory of your Mozilla install) and look up the incident ID for
the talkback report you just sent in.  Put it in the status whiteboard of this bug.
Keywords: stackwanted
Reproduced on 1.5.(Talkback ID TB24802198H )
Also reproduced on 2003102504.(Talkback ID TB24802437M, note that the talkback
is from 1024 nightly as 1025 came w/o TB.)
Whiteboard: TB24802198H TB24802437M
caillon, could you get the stacks?
There are 47 records for the same problem as I tried my best to debug my
JavaScript or find a workaround of the problem. The last 5 are TB24801729Q,
TB24801476K, TB24800658X, TB24680020Q and TB24679984Q. The error message might
not be too helpful "mozilla.exe has generated errors and will be closed by
Windows. You will need to restart the program. An error log is being created." I
wonder where the error log is :(
Stack Signature  	nsCSSFrameConstructor::FindFrameWithContent 960e471a
Email Address 	fsu2usn99@yahoo.com
Product ID 	MozillaTrunk
Build ID 	2003100716
Trigger Time 	2003-10-26 18:07:54
Platform 	Win32
Operating System 	Windows NT 5.1 build 2600
Module 	gklayout.dll
URL visited 	http://www.creativefactory.com.au/mozilla/dsp_Home.cfm
User Comments 	Successfully reproduced bug 223775
http://bugzilla.mozilla.org/show_bug.cgi?id=223775
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
Trigger Line No. 	11244
Stack Trace 	
nsCSSFrameConstructor::FindFrameWithContent
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11244]
nsCSSFrameConstructor::FindPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11390]
StyleSetImpl::FindPrimaryFrameFor
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp, line 1727]
FrameManager::GetPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 651]
nsCSSFrameConstructor::FindPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11361]
StyleSetImpl::FindPrimaryFrameFor
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp, line 1727]
FrameManager::GetPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 651]
nsCSSFrameConstructor::FindPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11361]
StyleSetImpl::FindPrimaryFrameFor
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp, line 1727]
FrameManager::GetPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 651]
nsCSSFrameConstructor::FindPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11361]
StyleSetImpl::FindPrimaryFrameFor
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp, line 1727]
FrameManager::GetPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 651]
PresShell::GetPrimaryFrameFor
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5553]
nsElementSH::PostCreate
[c:/builds/seamonkey/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 4634]
XPCWrappedNative::GetNewOrUsed
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 427]
XPCConvert::NativeInterface2JSObject
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcconvert.cpp, line 1061]
nsXPConnect::WrapNative
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 564]
nsDOMClassInfo::WrapNative
[c:/builds/seamonkey/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 1028]
nsNodeSH::PreCreate
[c:/builds/seamonkey/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 4413]
XPCWrappedNative::GetNewOrUsed
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 300]
XPCConvert::NativeInterface2JSObject
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcconvert.cpp, line 1061]
nsXPConnect::WrapNative
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 564]
nsXBLProtoImpl::InitTargetObjects
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLProtoImpl.cpp, line 115]
nsXBLProtoImpl::InstallImplementation
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLProtoImpl.cpp, line 79]
nsXBLPrototypeBinding::InstallImplementation
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp, line 445]
nsXBLBinding::InstallImplementation
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLBinding.cpp, line 1029]
nsXBLService::LoadBindings
[c:/builds/seamonkey/mozilla/content/xbl/src/nsXBLService.cpp, line 651]
nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7130]
nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7087]
nsCSSFrameConstructor::CreateAnonymousFrames
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 5152]
nsCSSFrameConstructor::InitGfxScrollFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 6096]
nsCSSFrameConstructor::BeginBuildingScrollFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 5891]
nsCSSFrameConstructor::BuildScrollFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 6046]
nsCSSFrameConstructor::InitializeSelectFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 4302]
nsCSSFrameConstructor::ConstructSelectFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 4171]
nsCSSFrameConstructor::ConstructHTMLFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 4633]
nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7196]
nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7087]
nsCSSFrameConstructor::ProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11780]
nsCSSFrameConstructor::ConstructTableCellFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 2943]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3199]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3096]
nsCSSFrameConstructor::ConstructTableRowFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 2784]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3185]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3096]
nsCSSFrameConstructor::ConstructTableRowGroupFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 2672]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3179]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3096]
nsCSSFrameConstructor::ConstructTableFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 2548]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 6426]
nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7234]
nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7087]
nsCSSFrameConstructor::ContentAppended
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 8327]
StyleSetImpl::ContentAppended
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp, line 1631]
PresShell::ContentAppended
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5334]
nsDocument::ContentAppended
[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp, line 2060]
nsHTMLDocument::ContentAppended
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLDocument.cpp, line
1383]
nsGenericElement::doInsertBefore
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericElement.cpp, line 2693]
nsHTMLHeadingElement::AppendChild
[c:/builds/seamonkey/mozilla/content/html/content/src/nsHTMLHeadingElement.cpp]
nsGenericHTMLElement::SetInnerHTML
[c:/builds/seamonkey/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 933]
nsHTMLSpanElement::SetInnerHTML
[c:/builds/seamonkey/mozilla/content/html/content/src/nsHTMLSpanElement.cpp,
line 163]
nsGenericHTMLElementTearoff::SetInnerHTML
[c:/builds/seamonkey/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 211]
XPTC_InvokeByIndex
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
Assignee: general → other
Component: Browser-General → Layout
Keywords: stackwanted → crash
QA Contact: general → ian
Whiteboard: TB24802198H TB24802437M
Hrm... the line numbers in that stack have no bearing on reality (compared to
the nsCSSFrameConstructor from back then; there have been 9 revisions to that
file since).

In a debug build, I do see a bunch of:

###!!! ASSERTION: frame was not removed from primary frame map before
destruction or was readded to map after being removed:
'!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsFrameManager.cpp,
line 1024

though I still can't reproduce the crash....
Keywords: stackwanted
<sigh> Bug 219936 sucks because I only get this crash on Windows nightlies.
</sigh>  
On my Linux build I get a pair of 

WARNING: empty damage rect: update caller to avoid fcn call overhead, file
../../../../../moz/mozilla/layout/html/base/src/nsFrame.cpp, line 2540

each time I click on << or >> in the top calendar. (When that's the first thing
you do after you load the page on a Windows nightly, the crash occurs.) 
Clicking on << or >> on the bottom calendar does not cause this warning to be
displayed.


FWIW, I just tried this on the build provided at
http://frederic.bezies.free.fr/weblog/mozilla/
(mozilla - trunk + calendar -O1 -G6 - 05-nov-2003.exe) 
and a crash still occurs.
 
That warning is not something that would cause crashes...
Bug Day: 1-13-2004

Bug doesn't seem present in Mozilla 1.6b.  I clicked << and >> MANY times and it
worked fine.
Seems to works fine in Mozilla 1.6; Mozilla/5.0 (Windows; U; Windows NT 5.0; 
en-US; rv:1.6) Gecko/20040113
Status: UNCONFIRMED → RESOLVED
Closed: 21 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.