84592 - endless loop and hang at page

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[Cesar Eduardo Barros]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.5 i686; en-US; rv:0.9.1+) Gecko/20010607
BuildID:    2001060708

After loading the page, mozilla goes into an endless reload loop (you can see
the cursor turning into a clock every half second, and the sheer amount of lines
in the console). It also seems to cause a crash.

Reproducible: Always
Steps to Reproduce:
1.Open the page
2. Wait a few iteractions of the endless reload loop cycle
3. Click in "The Story" in the right frame.

Actual Results:  Crashed.

Expected Results:  No 0-second refresh loop. At least no crashing.

I've tested it only three times; I've gotten TB31468235H, TB31468216H and
TB31468178M.

Comment 1

[Matthias Versen [:Matti]]

confirming with winwk build 20010608.. (CVS debug and opt).

The crash is bug 78504.
This bug (the loop) should go to network

Stack (a part) for the crash ->bug 78504:
nsWindowWatcher::OpenWindowJS(nsWindowWatcher * const 0x02d6e39c, nsIDOMWindow * 
0x043ceb14, const char * 0x00000000, const char * 0x041d8de0, const char * 
0x00000000, int 0, unsigned int 0, long * 0x00000000, nsIDOMWindow * * 
0x0012f688) line 513 + 62 bytes
nsWindowWatcher::OpenWindow(nsWindowWatcher * const 0x02d6e398, nsIDOMWindow * 
0x043ceb14, const char * 0x00000000, const char * 0x041d8de0, const char * 
0x00000000, nsISupports * 0x00000000, nsIDOMWindow * * 0x0012f688) line 436 + 48 
bytes

Comment 2

[neeti]

Doug,

this could be related to bug 78504 and bug 84572.

Comment 3

[neeti]

We are loading the frame urls in a loop. Reassigning to HTMLFrames for further 
triage.

0[482960]: nsDocShell[3858130]: loading http://niko-niko.net/mizuiro/index.html 
with flags 0x00000000
0[482960]: nsDocShell[3fbfe40]: loading http://niko-niko.net/mizuiro/green.html 
with flags 0x00000000
0[482960]: nsDocShell[3ff9d80]: loading http://niko-niko.net/mizuiro/blue.html 
with flags 0x00000000
0[482960]: nsDocShell[3ffc940]: loading http://niko-niko.net/mizuiro/logo.html 
with flags 0x00000000
0[482960]: nsDocShell[3fff4c0]: loading 
http://niko-niko.net/mizuiro/content.html with flags 0x00000000
0[482960]: nsDocShell[4001790]: loading http://niko-niko.net/mizuiro/navi.html 
with flags 0x00000000
0[482960]: nsDocShell[40042c0]: loading about:blank with flags 0x00000000
0[482960]: nsDocShell[4006dd0]: loading http://niko-niko.net/mizuiro/blue.html 
with flags 0x00000000
0[482960]: nsDocShell[40072e0]: loading http://niko-niko.net/mizuiro/green.html 
with flags 0x00000000
0[482960]: nsDocShell[3858130]: loading http://niko-niko.net/mizuiro/index.html 
with flags 0x00000000
0[482960]: nsDocShell[3fe8750]: loading http://niko-niko.net/mizuiro/green.html 
with flags 0x00000000
0[482960]: nsDocShell[4004600]: loading http://niko-niko.net/mizuiro/blue.html 
with flags 0x00000000
0[482960]: nsDocShell[4010c50]: loading http://niko-niko.net/mizuiro/logo.html 
with flags 0x00000000
0[482960]: nsDocShell[4025080]: loading 
http://niko-niko.net/mizuiro/content.html with flags 0x00000000
0[482960]: nsDocShell[4029dd0]: loading http://niko-niko.net/mizuiro/navi.html 
with flags 0x00000000
0[482960]: nsDocShell[402cdd0]: loading about:blank with flags 0x00000000
0[482960]: nsDocShell[4035520]: loading http://niko-niko.net/mizuiro/blue.html 
with flags 0x00000000
0[482960]: nsDocShell[404cb90]: loading http://niko-niko.net/mizuiro/green.html 
with flags 0x00000000
0[482960]: nsDocShell[3858130]: loading http://niko-niko.net/mizuiro/index.html 
with flags 0x00000000
0[482960]: nsDocShell[482fe80]: loading http://niko-niko.net/mizuiro/green.html 
with flags 0x00000000
0[482960]: nsDocShell[482a660]: loading http://niko-niko.net/mizuiro/blue.html 
with flags 0x00000000
0[482960]: nsDocShell[4836e10]: loading http://niko-niko.net/mizuiro/logo.html 
with flags 0x00000000
0[482960]: nsDocShell[4831ab0]: loading 
http://niko-niko.net/mizuiro/content.html with flags 0x00000000
0[482960]: nsDocShell[4833770]: loading http://niko-niko.net/mizuiro/navi.html 
with flags 0x00000000
0[482960]: nsDocShell[4844b20]: loading about:blank with flags 0x00000000
0[482960]: nsDocShell[48431d0]: loading http://niko-niko.net/mizuiro/blue.html 
with flags 0x00000000
0[482960]: nsDocShell[48469a0]: loading http://niko-niko.net/mizuiro/green.html 
with flags 0x00000000
0[482960]: nsDocShell[3858130]: loading http://niko-niko.net/mizuiro/index.html 
with flags 0x00000000
0[482960]: nsDocShell[439f5a0]: loading http://niko-niko.net/mizuiro/green.html 
with flags 0x00000000
0[482960]: nsDocShell[484ee80]: loading http://niko-niko.net/mizuiro/blue.html 
with flags 0x00000000
0[482960]: nsDocShell[4848d60]: loading http://niko-niko.net/mizuiro/logo.html 
with flags 0x00000000
0[482960]: nsDocShell[4807be0]: loading 
http://niko-niko.net/mizuiro/content.html with flags 0x00000000
0[482960]: nsDocShell[48065b0]: loading http://niko-niko.net/mizuiro/navi.html 
with flags 0x00000000
0[482960]: nsDocShell[48141a0]: loading about:blank with flags 0x00000000

Comment 4

[Dan M]

The crash Matthias mentioned above has been fixed.

Comment 5

[Eric Pollmann]

This is a dup of bug 82498, which Harish already has a fix for, marking a dup.

*** This bug has been marked as a duplicate of 82498 ***

Comment 6

[Cesar Eduardo Barros]

I still see the endless loop (no crash) with 2001062508. bug 82498 was supposed
to have been fixed 2001-06-20.

Comment 7

[Blake Ross]

Milestone reality check.

Comment 8

[Kevin McCluskey (gone)]

Moving to Mozilla0.9.6

Comment 9

[Kevin McCluskey (gone)]

Bulk reassignin HTML FRAME/IFRAME bugs to Eric.

Comment 10

[Håkan Waara]

I suspect this is a parser problem. Here's a stacktrace:

nsHTMLFramesetFrame::Init(nsHTMLFramesetFrame * const 0x04cb0bb8, nsIPresContext
* 0x03ea5280, nsIContent * 0x03f13bb0, nsIFrame * 0x04cb0898, nsIStyleContext *
0x04cb0b24, nsIFrame * 0x00000000) line 322
nsCSSFrameConstructor::InitAndRestoreFrame(nsIPresContext * 0x03ea5280,
nsFrameConstructorState & {...}, nsIContent * 0x03f13bb0, nsIFrame * 0x04cb0898,
nsIStyleContext * 0x04cb0b24, nsIFrame * 0x00000000, nsIFrame * 0x04cb0bb8) line
6525 + 32 bytes
nsCSSFrameConstructor::ConstructFrameByTag(nsIPresShell * 0x03f13ca0,
nsIPresContext * 0x03ea5280, nsFrameConstructorState & {...}, nsIContent *
0x03f13bb0, nsIFrame * 0x04cb0898, nsIAtom * 0x00b0c8c0, int 3, nsIStyleContext
* 0x04cb0b24, nsFrameItems & {...}) line 4756
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x03f13ca0,
nsIPresContext * 0x03ea5280, nsFrameConstructorState & {...}, nsIContent *
0x03f13bb0, nsIFrame * 0x04cb0898, nsIAtom * 0x00b0c8c0, int 3, nsIStyleContext
* 0x04cb0b24, nsFrameItems & {...}, int 0) line 7080 + 49 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x03f13ca0, nsIPresContext
* 0x03ea5280, nsFrameConstructorState & {...}, nsIContent * 0x03f13bb0, nsIFrame
* 0x04cb0898, nsFrameItems & {...}) line 6994 + 56 bytes
nsCSSFrameConstructor::ProcessChildren(nsIPresShell * 0x03f13ca0, nsIPresContext
* 0x03ea5280, nsFrameConstructorState & {...}, nsIContent * 0x05c407f0, nsIFrame
* 0x04cb0898, int 1, nsFrameItems & {...}, int 1, nsTableCreator * 0x00000000)
line 11828 + 66 bytes
nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell * 0x03f13ca0,
nsIPresContext * 0x03ea5280, nsFrameConstructorState & {...}, nsIContent *
0x05c407f0, nsIFrame * 0x04cb0214, nsIStyleContext * 0x04cb05b8, nsIFrame * &
0x04cb0898) line 3383
nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x03eedcd0,
nsIPresContext * 0x03ea5280, nsIContent * 0x00000000, nsIContent * 0x05c407f0,
int 0, nsILayoutHistoryState * 0x00000000) line 8554
StyleSetImpl::ContentInserted(StyleSetImpl * const 0x03ee9970, nsIPresContext *
0x03ea5280, nsIContent * 0x00000000, nsIContent * 0x05c407f0, int 0) line 1421
PresShell::InitialReflow(PresShell * const 0x03f13ca0, int 15360, int 9090) line
2648
HTMLContentSink::StartLayout() line 3966
HTMLContentSink::CloseFrameset(HTMLContentSink * const 0x05c41790, const
nsIParserNode & {...}) line 3403
CNavDTD::CloseFrameset(const nsIParserNode * 0x04928460) line 3327 + 31 bytes
CNavDTD::CloseContainer(const nsCParserNode * 0x04928460, nsHTMLTag
eHTMLTag_frameset, int 0) line 3524 + 12 bytes
CNavDTD::CloseContainersTo(int 1, nsHTMLTag eHTMLTag_frameset, int 0) line 3575
+ 20 bytes
CNavDTD::CloseContainersTo(nsHTMLTag eHTMLTag_frameset, int 0) line 3731 + 20 bytes
CNavDTD::HandleEndToken(CToken * 0x04921098) line 1986 + 14 bytes
CNavDTD::HandleToken(CNavDTD * const 0x03f11240, CToken * 0x04921098, nsIParser
* 0x05c419e0) line 887 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x03f11240, nsIParser * 0x05c419e0,
nsITokenizer * 0x03f111c0, nsITokenObserver * 0x00000000, nsIContentSink *
0x05c41790) line 520 + 20 bytes
nsParser::BuildModel() line 1978 + 34 bytes
nsParser::ResumeParse(int 1, int 0) line 1844 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x05c419e4, nsIRequest * 0x05c36f10,
nsISupports * 0x00000000, nsIInputStream * 0x05c497d0, unsigned int 0, unsigned
int 1614) line 2467 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x05c34090,
nsIRequest * 0x05c36f10, nsISupports * 0x00000000, nsIInputStream * 0x05c497d0,
unsigned int 0, unsigned int 1614) line 241 + 46 bytes
nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x05c36f14, nsIRequest *
0x05c37344, nsISupports * 0x00000000, nsIInputStream * 0x05c497d0, unsigned int
0, unsigned int 1614) line 2353 + 57 bytes
nsOnDataAvailableEvent::HandleEvent() line 193 + 70 bytes
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x05ca46c4) line 116
PL_HandleEvent(PLEvent * 0x05ca46c4) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00aa7e50) line 520 + 9 bytes

Comment 11

[harishd]

The problem markup is 
<body onLoad="if(parent.frames.length!=0)top.location='index.html';">.
Why would anyone need a body in a frameset document? Anyway, it looks like we need
to disable onLoad somehow or we should just ignore the body tag after frameset.

Comment 12

[harishd]

Attachment: patch v1.0 [ ignore body after frameset ]

Comment 13

[Johnny Stenback (:jst)]

Comment on attachment 60355 [details] [diff] [review]
patch v1.0 [ ignore body after frameset ]

sr=jst

Comment 14

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Comment on attachment 60355 [details] [diff] [review]
patch v1.0 [ ignore body after frameset ]

r=heikki

Comment 15

[harishd]

FIXED.

Comment 16

[Cesar Eduardo Barros]

Seems to work fine for me. Verifying.