125404 - mozilla hangs on certain mathml pages

Status: RESOLVED FIXED

(Core :: MathML, defect)

Description

[Dawn Endico]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8+) Gecko/20020213

Mozilla hang for me when i follow several
of the links on this page
<http://pear.math.pitt.edu/Calculus/week3/3_1.mhtml>

in particular, these
http://pear.math.pitt.edu/Calculus/week3/3_1li9.xml#QQ1-10-9
http://pear.math.pitt.edu/Calculus/week3/3_1li10.xml#QQ1-11-10

I'm using today's nightly build on linux. I don't have
the mathml fonts installed. I was trying to find a good
example page that had lots of mathml but which look ok
for people without math fonts. I'd like to link from such
a page from the "what's new" section of the 0.9.9 
release notes.

I'm not able to get a trace yet.

Comment 1

[rbs]

The crash site:

void nsTableFrame::InsertCol(nsIPresContext&  aPresContext,
                             nsTableColFrame& aColFrame,
                             PRInt32          aColIndex)
{
>>mColFrames.InsertElementAt(&aColFrame, aColIndex); <============ crash
  [...]
}

The debugger showed that the vptr of mColFrames is null (i.e., the whole thing 
is invalid). Tracing, I noted that the problem is originating from the fact that 
the table frame construction code wasn't considering <mtr> as a table-row, and 
was instead creating a foreign foreign frame for it. Looking up in the style 
context of that <mtr>, I noted indeed that it was been resolved as an inline 
frame rather than as a table-row frame... 

Paul, do you have CSS rules in your stylesheet that apply and/or override <mtr>?

Here is a stack trace from visiting:
http://pear.math.pitt.edu/Calculus/week3/3_1li10.xml#QQ1-11-10

nsVoidArray::InsertElementAt(void * 0x035286f8, int 0) line 408 + 10 bytes
nsTableFrame::InsertCol(nsIPresContext & {...}, nsTableColFrame & {...}, int 0) 
line 804
nsTableColGroupFrame::AddColsToTable(nsTableColGroupFrame * const 0x03528684, 
nsIPresContext & {...}, int 0, int 1, nsIFrame * 0x035286f8, nsIFrame * 
0x035286f8) line 131
nsTableFrame::CreateAnonymousColFrames(nsIPresContext & {...}, 
nsTableColGroupFrame & {...}, int 1, nsTableColType eColAnonymousCell, int 1, 
nsIFrame * 0x00000000, nsIFrame * * 0x0012e130) line 1076
nsTableFrame::CreateAnonymousColFrames(nsIPresContext & {...}, int 1, 
nsTableColType eColAnonymousCell, int 1, nsIFrame * 0x00000000) line 984
nsTableFrame::InsertRows(nsIPresContext & {...}, nsTableRowGroupFrame & {...}, 
nsVoidArray & {...}, int 0, int 1) line 1231
nsTableFrame::InsertRowGroups(nsIPresContext & {...}, nsIFrame * 0x0350b944, 
nsIFrame * 0x0350b944) line 1407
nsTableFrame::AppendRowGroups(nsIPresContext & {...}, nsIFrame * 0x0350b944) 
line 1304
nsTableFrame::SetInitialChildList(nsTableFrame * const 0x034e10e4, 
nsIPresContext * 0x041a6730, nsIAtom * 0x00000000 {???}, nsIFrame * 0x0350b944) 
line 482
nsCSSFrameConstructor::ConstructTableFrame(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 
0x04551f20, nsIFrame * 0x034e0d38, nsIStyleContext * 0x034e0e48, nsTableCreator 
& {...}, int 0, nsFrameItems & {...}, nsIFrame * & 0x034e0e7c, nsIFrame * & 
0x034e10e4, int & 0) line 2327
nsCSSFrameConstructor::ConstructMathMLFrame(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 
0x04551f20, nsIFrame * 0x034e0bac, nsIAtom * 0x02362ee0 {"mtable"}, int 9, 
nsIStyleContext * 0x034e00dc, nsFrameItems & {...}) line 6630 + 62 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 
0x04551f20, nsIFrame * 0x034e0bac, nsIAtom * 0x02362ee0 {"mtable"}, int 9, 
nsIStyleContext * 0x034e00dc, nsFrameItems & {...}, int 0) line 7039 + 49 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x041aec70, nsIPresContext 
* 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 0x04551f20, nsIFrame 
* 0x034e0bac, nsFrameItems & {...}) line 6916 + 56 bytes
nsCSSFrameConstructor::ProcessChildren(nsIPresShell * 0x041aec70, nsIPresContext 
* 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 0x04557b80, nsIFrame 
* 0x034e0bac, int 1, nsFrameItems & {...}, int 0, nsTableCreator * 0x00000000) 
line 11997 + 66 bytes
nsCSSFrameConstructor::ConstructMathMLFrame(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 
0x04557b80, nsIFrame * 0x034b106c, nsIAtom * 0x02361bc0 {"math"}, int 9, 
nsIStyleContext * 0x034e00a8, nsFrameItems & {...}) line 6696 + 41 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 
0x04557b80, nsIFrame * 0x034b106c, nsIAtom * 0x02361bc0 {"math"}, int 9, 
nsIStyleContext * 0x034e00a8, nsFrameItems & {...}, int 0) line 7039 + 49 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x041aec70, nsIPresContext 
* 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 0x04557b80, nsIFrame 
* 0x034b106c, nsFrameItems & {...}) line 6916 + 56 bytes
nsCSSFrameConstructor::ProcessBlockChildren(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 
0x041cf3b0, nsIFrame * 0x034b106c, int 1, nsFrameItems & {...}, int 1) line 
13277 + 57 bytes
nsCSSFrameConstructor::ConstructBlock(nsIPresShell * 0x041aec70, nsIPresContext 
* 0x041a6730, nsFrameConstructorState & {...}, const nsStyleDisplay * 
0x034b0fd0, nsIContent * 0x041cf3b0, nsIFrame * 0x034b0e04, nsIStyleContext * 
0x034b0f9c, nsIFrame * 0x034b106c) line 13225 + 36 bytes
nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, const 
nsStyleDisplay * 0x034b0fd0, nsIContent * 0x041cf3b0, nsIFrame * 0x034b0e04, 
nsIStyleContext * 0x034b0f9c, nsFrameItems & {...}) line 6212 + 43 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 
0x041cf3b0, nsIFrame * 0x034b0e04, nsIAtom * 0x022d75c0 {"body"}, int 3, 
nsIStyleContext * 0x034b0f9c, nsFrameItems & {...}, int 0) line 7060 + 45 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x041aec70, nsIPresContext 
* 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 0x041cf3b0, nsIFrame 
* 0x034b0e04, nsFrameItems & {...}) line 6916 + 56 bytes
nsCSSFrameConstructor::ProcessChildren(nsIPresShell * 0x041aec70, nsIPresContext 
* 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 0x041cf460, nsIFrame 
* 0x034b0e04, int 1, nsFrameItems & {...}, int 1, nsTableCreator * 0x00000000) 
line 11997 + 66 bytes
nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell * 0x041aec70, 
nsIPresContext * 0x041a6730, nsFrameConstructorState & {...}, nsIContent * 
0x041cf460, nsIFrame * 0x0350b134, nsIStyleContext * 0x03397f44, nsIFrame * & 
0x034b0e04) line 3243
nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x041ac0a0, 
nsIPresContext * 0x041a6730, nsIContent * 0x00000000, nsIContent * 0x041cf460, 
int 0, nsILayoutHistoryState * 0x00000000, int 0) line 8554
StyleSetImpl::ContentInserted(StyleSetImpl * const 0x041ac170, nsIPresContext * 
0x041a6730, nsIContent * 0x00000000, nsIContent * 0x041cf460, int 0) line 1446
PresShell::InitialReflow(PresShell * const 0x041aec70, int 12735, int 7605) line 
2631
nsXMLContentSink::StartLayout() line 963
nsXMLContentSink::DidBuildModel(nsXMLContentSink * const 0x0419a170, int 0) line 
396
nsExpatDriver::DidBuildModel(nsExpatDriver * const 0x041a9f20, unsigned int 0, 
int 1, nsIParser * 0x0419a2a0, nsIContentSink * 0x0419a170) line 842 + 23 bytes
nsParser::DidBuildModel(unsigned int 0) line 1385 + 41 bytes
nsParser::ResumeParse(int 1, int 1, int 1) line 1906
nsParser::ContinueParsing() line 1495 + 19 bytes
CSSLoaderImpl::Cleanup(URLKey & {...}, SheetLoadData * 0x041bf600) line 813
CSSLoaderImpl::SheetComplete(nsICSSStyleSheet * 0x00000000, SheetLoadData * 
0x041bf600) line 920
CSSLoaderImpl::ParseSheet(nsIUnicharInputStream * 0x041b9d60, SheetLoadData * 
0x041bf600, int & 1, nsICSSStyleSheet * & 0x041bbec0) line 955
CSSLoaderImpl::DidLoadStyle(nsIStreamLoader * 0x041bf470, nsString * 0x041be820 
{" 
/* start css.sty */
.cmr-8{font-size:66%;}
.cmr-6{font-size:50%;}
.cmmi-12{font-style: italic;}
.cmmi-8{font-size:66%;font-s"}, SheetLoadData * 
0x041bf600, unsigned int 0) line 990 + 27 bytes
SheetLoadData::OnStreamComplete(SheetLoadData * const 0x041bf600, 
nsIStreamLoader * 0x041bf470, nsISupports * 0x00000000, unsigned int 0, unsigned 
int 2303, const char * 0x03502658) line 747
nsStreamLoader::OnStopRequest(nsStreamLoader * const 0x041bf474, nsIRequest * 
0x041bf170, nsISupports * 0x00000000, unsigned int 0) line 163
nsStreamListenerTee::OnStopRequest(nsStreamListenerTee * const 0x041ba640, 
nsIRequest * 0x041bf170, nsISupports * 0x00000000, unsigned int 0) line 25
nsHttpChannel::OnStopRequest(nsHttpChannel * const 0x041bf174, nsIRequest * 
0x041be1e4, nsISupports * 0x00000000, unsigned int 0) line 2454
nsOnStopRequestEvent::HandleEvent() line 213
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x041bc064) line 116
PL_HandleEvent(PLEvent * 0x041bc064) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x004a0aa0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00380916, unsigned int 49496, unsigned int 0, 
long 4852384) line 1071 + 9 bytes
USER32! 77e148dc()
USER32! 77e14aa7()
USER32! 77e266fd()
nsAppShellService::Run(nsAppShellService * const 0x004b5d40) line 308
main1(int 1, char * * 0x00444ea0, nsISupports * 0x00000000) line 1285 + 32 bytes
main(int 1, char * * 0x00444ea0) line 1625 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e992a6()

Comment 2

[rbs]

Works for me locally when I replace
   <?xml-stylesheet type="text/css" href="../mathml.css">
with a more recent mathml.css.

(The document is using the old way before the DOCTYPE standardization.)

Comment 3

[rbs]

Attachment: patch to bullet-proof the code against this type of crash

...also fixed an incorrect calling sequence of SetInitialChildList() on the
frames that wrap the table code to emulate the inline mtable. (The calling
sequence has to be made in a bottom-up manner to honor the nsIFrame API.)

Comment 4

[rbs]

r=karnaze? sr=attinasi?

Comment 5

[karnaze (gone)]

Comment on attachment 69487 [details] [diff] [review]
patch to bullet-proof the code against this type of crash

r=karnaze. rbs, Viewer's regression testing capability had been broken for
about 2 months and was fixed this morning after realizing that (bug 125426).

Comment 6

[Marc Attinasi]

Comment on attachment 69487 [details] [diff] [review]
patch to bullet-proof the code against this type of crash

sr=attinasi

Comment 7

[rbs]

Patch checked in. Now if mathml.css isn't being applied, <mtable> and its 
related tags will just be treated as inline frames, and the table code won't 
kick off.