290400 - <Shift>+<tab> triggers application crash - Trunk [@ nsPlaceholderFrame::GetRealFrameFor]

Status: VERIFIED FIXED

(SeaMonkey :: General, defect)

Description

[Gérard Talbot]

I have crashed 5 times so far in 10 min. just by trying to <Shift>+<tab>
through/within links with Mozilla 1.8b2 build 2005041411 under XP Pro SP2.

5 talkback incident have been sent with 3 of them having "hift>+<tab>" in the
user comment field. Because of a bug (I think 210251 or so), I can not know if
the crash data was received appropriately.

Minimal/reduced testcase coming

Comment 1

[Gérard Talbot]

Attachment: Minimal testcase to reproduce

Instructions: <shift>+<tab> among links of this reduced testcase

Comment 2

[Gérard Talbot]

Finally got 1 in (it's the first crash):

TB5096137M

I suspect this is a Product: Core issue but I can't find any component for this.

Comment 3

[Gérard Talbot]

2 other Talkback incident ID: 
TB5096666H
TB5096790E

Comment 4

[Gérard Talbot]

and 5096800

Comment 5

[Gérard Talbot]

Attachment: Minimal and valid testcase to reproduce

Instructions: <shift>+<tab> among links of this reduced testcase 
(previous testcase was missing a start tag)

Comment 6

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050329
crash with Build ID 2005041411

All your Talkbacks: Stack Signature	 nsPlaceholderFrame::GetRealFrameFor
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsPlaceholderFrame%3A%3AGetRealFrameFor&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 7

[Adam Hauner]

It looks like Firefox is also affected, see bug 290419.

Comment 8

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050412 Firefox/1.0+
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050413 Firefox/1.0+
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050413 Firefox/1.0+
BuildID 1.8b2: 2005041306
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050414 Firefox/1.0+
1.8b2: 2005041406

My crash  with Build ID 2005041411 in comment 6 was on Win98, these tests here
are on Win98SE. Firefox BuildIds from Windows explorer 

Comment 9

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050410

So regression happened somewhere between 1.8b2: 2005041005 and 1.8b2: 2005041411 

Can´t test using 1.8b2: 2005041106 and 1.8b2: 2005041107 as they don´t live long
enough to load anything, and after that there were no windows builds.

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=5105608

Bug 290419 is about Firefox Tinderbox builds, 
Bug 290419 Comment #2 states that the bug isn´t seen on a zip build of the
current nightly. I´m also using zip builds, maybe that´s why I didn´t see the
bug on Firefox.

To get Talkback working on zip builds, you´ve got to delete compreg.dat or load
about:plugins and restart the browser.	  
	 

Comment 10

[Hermann Schwab]

looking for the timeframe of regression:
Mozilla Bug 290400 wfm 1.8b2: 2005041005 and 1.8b2: 2005041411 regressed
Firefox Bug 290419 started as tinderbox bug, nightlies with the same product
version did work, see Bug 290419 comment 3 and Bug 290419 comment 6.

Mozilla currently 19 Talkbacks, oldest 2005041411
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsPlaceholderFrame%3A%3AGetRealFrameFor&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Firefox currently 4 Talkbacks, Trunk 2005041406 
and one Branch 2005031812 with different stack
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsFrameConstructorState%3A%3APushAbsoluteContainingBlock&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 11

[Gérard Talbot]

FWIW, I crashed again with the testcase with build 2005041506, even with a new
profile. 4 talkback incident ID are:

TB5113811K <-(new profile)
TB5113863M
TB5113990Q
TB5114065Q

Comment 12

[Gérard Talbot]

There are chances this bug was caused by a recent patch in bug 276954. Setting
dependency accordingly

Comment 13

[Boris Zbarsky [:bzbarsky]]

Yeah, this is definitely caused by the patch in bug 276954; the followup patch
there should fix this.

Comment 14

[Boris Zbarsky [:bzbarsky]]

Check tomorrow's (Saturday's) builds?  This should be gone.

Comment 15

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050416

marking fixed (by the patch in bug 276954)

Comment 16

[Jay Patel [:jay]]

Verified Fixed per Talkback data.  No crashes since 4/15 (after the fix for bug
276954 went in).