131358 - Crashes at http://www.kicxfm.com/ [@ nsContainerFrame::Destroy ]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P1)

Description

[Dom Incollingo]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.9+)
Gecko/20020315
BuildID:    2002031503

Mozilla crashes at site http://www.kicxfm.com/ when the user clicks on the link
for Mindy McCready.

Reproducible: Always
Steps to Reproduce:
1.Navigate to site http://www.kicxfm.com/.
2.Click on the link for Hot Country Licks (left side of page).
3.Click on the link for Mindy McCready (in the section for Female Artists).
4.Click on the link for Mindy McCready (in the section for 'music artists').
5.Mozilla crashes.

Expected Results:  Mozilla should not crash.

Please refer to TalkBack incidents TB4094292H and TB4094131H.

The home page for http://www.kicxfm.com/ contains an applet, so the JVM is
running at the time of the crash.  I do not know if the applet has anything to
do with the crash.

I am running Win 2K with JRE 1.4.0-beta3.

Comment 1

[Dom Incollingo]

Attachment: Crash occurs when you click on the Mindy McCready link (in red) on this screen.

Comment 2

[[e-mail] (gone - use [e-mail] instead)]

0x00002ce2 
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
138] 
nsObjectFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 677] 
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 131] 
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
141] 
nsLineBox::DeleteLineList 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineBox.cpp, line 312] 
nsBlockFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 330] 
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 131] 
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
141] 
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 131] 
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
141] 
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 131] 
DestroyOverflowFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
1015] 
DestroyPropertyEnumerator 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 
2905] 
PL_DHashTableEnumerate [d:\builds\seamonkey\mozilla\xpcom\ds\pldhash.c, line 
601] 
FrameManager::PropertyList::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 
2915] 
FrameManager::DestroyPropertyList 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 
2590] 
FrameManager::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 537] 
PresShell::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1711] 
DocumentViewerImpl::Destroy 
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 1454

Comment 3

[Matthias Versen [:Matti]]

-> Layout

Comment 4

[Chris Petersen]

Peter, 

I can't crash this on either on Windows ME or OS X , but attinasi can crash
under Windows 2000 with the latest build. The page uses multiple applets and
flash content on the page ( in a frameset). Maybe plug-in issue ?

Comment 5

[Chris Petersen]

URL that points to large flash animation on the page.

http://www.capitol-nashville.com/index.cfm?method=home&CFID=477435&CFTOKEN=38864260

Comment 6

[Chris Petersen]

If I click on the link, it will load the page on Windows ME. But after clicking
on the various artists and navigating back, the browser will freeze.

Comment 7

[Peter Lubczynski]

http://www.kicxfm.com/ looks like a typical page generated by FrontPage with all
those fphover applets as hover links.

I can not reproduce on WinXP with either JRE 1.3 or 1.4. No crash, but I did
eventually get some sluggish behavior with JRE 1.4 that went away. Maybe we're
leaking some memory? cc:ing anthonyd

Does the crash happen with Java disabled or not installed? If not, then reassign
to OJI.

Comment 8

[Marc Attinasi]

When I load the link from comment #5 and click on the link for Mindy McWhatever,
I get these assertions:

1312[39d1928]: ###!!! ASSERTION: nsStandardURL not thread-safe: 'owningThread ==
NS_CurrentThread()', file s:\mozilla\xp
com\glue\nsDebug.cpp, line 528
###!!! ASSERTION: nsStandardURL not thread-safe: 'owningThread ==
NS_CurrentThread()', file s:\mozilla\xpcom\glue\nsDebu
g.cpp, line 528
1312[39d1928]: ###!!! ASSERTION: nsGenericElement not thread-safe: 'owningThread
== NS_CurrentThread()', file s:\mozilla
\xpcom\glue\nsDebug.cpp, line 528
###!!! ASSERTION: nsGenericElement not thread-safe: 'owningThread ==
NS_CurrentThread()', file s:\mozilla\xpcom\glue\nsD
ebug.cpp, line 528
1312[39d1928]: ###!!! ASSERTION: nsGenericElement not thread-safe: 'owningThread
== NS_CurrentThread()', file s:\mozilla
\xpcom\glue\nsDebug.cpp, line 528
###!!! ASSERTION: nsGenericElement not thread-safe: 'owningThread ==
NS_CurrentThread()', file s:\mozilla\xpcom\glue\nsD
ebug.cpp, line 528

BUT, I do not crash (this is using a Mozilla CVS build with some small mods in
it).  I tried clicking on the other country stars too, and no crashes.  I am
crashing with the latest NS build, however, but it is not a debug build.

Comment 9

[Chris Petersen]

Attachment: Updated frameset to include page containing the flash content

Problem with disabling java is that the applet is used to navigate. I changed
the original frameset so that it now loads the flash content. Now we checked
for this crash when java is disabled.

Comment 10

[rubydoo123]

Attachment: stack trace

the stack trace that I got was a bit different, attaching the stack trace that
I got.

Comment 11

[Dom Incollingo]

I tried clicking on various links on the same page (Trace Adkins, Chris LeDoux,
for example), and Mozilla crashed.   Now using build 2002031903.   Please refer
to TalkBack incident TB4235048Y.

Comment 12

[Dom Incollingo]

Attachment: Same site and link using Netscape 6.2.1.

FYI. This same site and link displays without a problem using NS6.2.1.

Comment 13

[Dom Incollingo]

This site works properly using 0.9.9 monthly build (Build Id 2002031104).

Comment 14

[Dom Incollingo]

Installed JRE 1.4.0 (final version, not beta) and Mozilla build 2002032916. 
Same result - Mozilla crashed at this site.  Talkback incident TB4672464X.

Comment 15

[Dom Incollingo]

Did someone fix this??  This site works fine using build 2002040503.  No more
crash or problems.  I am using the same version of the JRE.

Thank you.