Closed Bug 119375 Opened 23 years ago Closed 23 years ago

browser crashes on rapid clicking of back button

Categories

(Core :: Layout, defect)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 118014
mozilla1.0

People

(Reporter: dvrsn, Assigned: attinasi)

References

()

Details

(Keywords: crash)

Attachments

(1 file)

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.7+) Gecko/20020110
BuildID:    2002011015

After navigating through several pages, rapidly clicking the back button several
times crashes the browser.

This can be tough to reproduce, but the given scenario seems to crash pretty
reliably for me.


Reproducible: Always
Steps to Reproduce:
1. go to www.mozilla.org
2. click on 'Tree status'
(http://tinderbox.mozilla.org/showbuilds.cgi?tree=SeaMonkey)
3. click on mozilla banner to go back to home page
4. click on 'Tree status' again
5. click on mozilla banner to go back to home page.
6. click back button 4 (or more) times quickly (I estimate within about .75
seconds; its likely something to do with clicking faster than it can display
previous pages.  My machine is a 1.6GHz pentium 4, so its not like its taking
eons to redisplay the pages)



Actual Results:  CRASH!

Expected Results:  browser navigates back 4 pages, possibly less if back button
is disabled while working.



Running mozilla -g, I was able to get the following stack trace:
[Switching to Thread 1024 (LWP 4051)]
__strtol_internal (nptr=0xbfffe61c "| N\211\bhåY\b", endptr=0x8894ea0,
base=140109160, group=144493320) at eval.c:36
    in eval.c
(gdb) where
#0  __strtol_internal (nptr=0xbfffe61c "| N\211\bhåY\b", endptr=0x8894ea0,
base=140109160, group=144493320) at eval.c:36
#1  0x410537bc in NSGetModule () from /u01/jeff/mozilla/components/libgkcontent.so
#2  0x411454f7 in NSGetModule () from /u01/jeff/mozilla/components/libgkcontent.so
#3  0x418bd6d6 in NSGetModule () from /u01/jeff/mozilla/components/libgklayout.so
#4  0x417c311c in NSGetModule () from /u01/jeff/mozilla/components/libgklayout.so
#5  0x417c3316 in NSGetModule () from /u01/jeff/mozilla/components/libgklayout.so
#6  0x417c3316 in NSGetModule () from /u01/jeff/mozilla/components/libgklayout.so
#7  0x417c343d in NSGetModule () from /u01/jeff/mozilla/components/libgklayout.so
#8  0x417f2c13 in NSGetModule () from /u01/jeff/mozilla/components/libgklayout.so
#9  0x417f2cc9 in NSGetModule () from /u01/jeff/mozilla/components/libgklayout.so
#10 0x410f87db in NSGetModule () from /u01/jeff/mozilla/components/libgkcontent.so
#11 0x4103aa1f in NSGetModule () from /u01/jeff/mozilla/components/libgkcontent.so
#12 0x41039f62 in NSGetModule () from /u01/jeff/mozilla/components/libgkcontent.so
#13 0x4103a1a0 in NSGetModule () from /u01/jeff/mozilla/components/libgkcontent.so
#14 0x4103a2fe in NSGetModule () from /u01/jeff/mozilla/components/libgkcontent.so
#15 0x410398fb in NSGetModule () from /u01/jeff/mozilla/components/libgkcontent.so
#16 0x4096d382 in NSGetModule () from /u01/jeff/mozilla/components/libnecko.so
#17 0x4099eaed in NSGetModule () from /u01/jeff/mozilla/components/libnecko.so
#18 0x409b2518 in NSGetModule () from /u01/jeff/mozilla/components/libnecko.so
#19 0x4095f5f4 in NSGetModule () from /u01/jeff/mozilla/components/libnecko.so
#20 0x40160c47 in PL_HandleEvent () at eval.c:41
#21 0x4016102b in PL_ProcessEventsBeforeID () at eval.c:41
#22 0x4083792f in NSGetModule () from /u01/jeff/mozilla/components/libwidget_gtk.so
#23 0x4013127b in nsVoidArray::EnumerateForwards () at eval.c:41
#24 0x40837969 in NSGetModule () from /u01/jeff/mozilla/components/libwidget_gtk.so
#25 0x4083dfec in NSGetModule () from /u01/jeff/mozilla/components/libwidget_gtk.so
#26 0x40357d7f in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
#27 0x4038a773 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#28 0x4038ad39 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#29 0x4038aeec in g_main_run () from /usr/lib/libglib-1.2.so.0
#30 0x402a6333 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#31 0x408376e4 in NSGetModule () from /u01/jeff/mozilla/components/libwidget_gtk.so
#32 0x408171de in fullsoft_copyright () from
/u01/jeff/mozilla/components/libnsappshell.so
#33 0x08050099 in main1 () at eval.c:41
#34 0x08050907 in main () at eval.c:41
#35 0x404d1507 in __libc_start_main (main=0x80507d8 <main>, argc=1,
ubp_av=0xbffff124, init=0x804be78 <_init>, fini=0x8051ca8 <_fini>,
rtld_fini=0x4000dc14 <_dl_fini>, stack_end=0xbffff11c) at
../sysdeps/generic/libc-start.c:129
(gdb) run

The workaround is obvious: don't be so hyper when clicking back.
various Talkback incident ids: TB1507114Q, TB1507072Q, TB1506666Q, TB1506087M
Severity: normal → critical
Keywords: crash, stackwanted
RuleProcessorData::RuleProcessorData()
StyleSetImpl::ResolveStyleFor()
nsPresContext::ResolveStyleContextFor()
FrameManager::ReResolveStyleContext()
FrameManager::ReResolveStyleContext()
FrameManager::ReResolveStyleContext()
FrameManager::ComputeStyleChangeFor()
PresShell::ReconstructStyleData()
PresShell::StyleSheetAdded()
nsDocument::InsertStyleSheetAt()
CSSLoaderImpl::InsertSheetInDoc()
CSSLoaderImpl::SheetComplete()
CSSLoaderImpl::ParseSheet()
CSSLoaderImpl::DidLoadStyle()
SheetLoadData::OnStreamComplete()
nsStreamLoader::OnStopRequest()
nsHttpChannel::OnStopRequest()
nsOnStopRequestEvent::HandleEvent()
nsARequestObserverEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessEventsBeforeID()
processQueue()
nsVoidArray::EnumerateForwards()
nsAppShell::ProcessBeforeID()
handle_gdk_event()
libgdk-1.2.so.0 + 0x17d7f (0x40357d7f)
libglib-1.2.so.0 + 0x11773 (0x4038a773)
libglib-1.2.so.0 + 0x11d39 (0x4038ad39)
libglib-1.2.so.0 + 0x11eec (0x4038aeec)
libgtk-1.2.so.0 + 0x94333 (0x402a6333)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1c507 (0x404d1507) 
-> Layout
Assignee: asa → attinasi
Status: UNCONFIRMED → NEW
Component: Browser-General → Layout
Ever confirmed: true
Keywords: stackwanted
QA Contact: doronr → petersen
This simple javascript page automates the crash reproduction.  Click 'prime'
and wait for the window to load, then click 'crash'.  Usually once will crash
mozilla, sometimes a second click is needed.

Using this script I am able to crash on win32 as well (build id 2002011003 -
Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.7+) Gecko/20020110)
Target Milestone: --- → mozilla1.0

*** This bug has been marked as a duplicate of 118014 ***
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: