15253 - Crash on restoring frame state

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P1)

Description

[Stephen P. Morse]

Go to a form.  The one I used was the Amazon sample under the menu item
edit/wallet/samples.  Fill in some field.  Submit the form.  You get a server
error (that's normal).  Hit the back button.  Form reappears.  Surprisingly the
field you filled in is still filled in (I guess the cache must have just been
implemented).  Then hit the reload button.  You crash with the stack trace shown
below.

FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e310e0, nsILayoutHistoryState * 0x02e70a70) line 1105 + 21 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e31cd0, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e31b80, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e34110, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e2c330, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e2ad60, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e2d890, nsILayoutHistoryState * 0x02e70a70) line 1123 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e2cd80, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e2b580, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e22720, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e227b0, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e230a0, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e23cb0, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e243a0, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e24ef0, nsILayoutHistoryState * 0x02e70a70) line 1130 + 20 bytes
FrameManager::RestoreFrameState(FrameManager * const 0x02e181b0, nsIFrame *
0x02e1b1c0, nsILayoutHistoryState * 0x02e70a70) line 1123 + 20 bytes
PresShell::ContentAppended(PresShell * const 0x02e19718, nsIDocument *
0x02e97e80, nsIContent * 0x02e1e79c, int 8) line 1735
nsDocument::ContentAppended(nsDocument * const 0x02e97e80, nsIContent *
0x02e1e79c, int 8) line 1574
nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x02e97e80, nsIContent *
0x02e1e79c, int 8) line 1044
HTMLContentSink::NotifyBody() line 276
HTMLContentSink::CloseBody(HTMLContentSink * const 0x02e97490, const
nsIParserNode & {...}) line 2026
CNavDTD::CloseBody(const nsIParserNode & {...}) line 2347 + 31 bytes
CNavDTD::CloseContainer(const nsIParserNode & {...}, nsHTMLTag eHTMLTag_body,
int 0) line 2628 + 12 bytes
CNavDTD::CloseContainersTo(int 1, nsHTMLTag eHTMLTag_body, int 0) line 2681 + 26
bytes
CNavDTD::CloseContainersTo(nsHTMLTag eHTMLTag_body, int 0) line 2703 + 20 bytes
CNavDTD::DidBuildModel(CNavDTD * const 0x02e19ee0, unsigned int 0, int 1,
nsIParser * 0x02e976b0, nsIContentSink * 0x02e97490) line 510
nsParser::DidBuildModel(unsigned int 0) line 547 + 55 bytes
nsParser::ResumeParse(nsIDTD * 0x00000000, int 1) line 966
nsParser::OnStopRequest(nsParser * const 0x02e976b4, nsIChannel * 0x02e52f50,
nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000)
line 1396 + 19 bytes
nsDocumentBindInfo::OnStopRequest(nsDocumentBindInfo * const 0x02e530d0,
nsIChannel * 0x02e52f50, nsISupports * 0x00000000, unsigned int 0, const
unsigned short * 0x00000000) line 1413 + 34 bytes
nsChannelListener::OnStopRequest(nsChannelListener * const 0x02e3fa90,
nsIChannel * 0x02e52f50, nsISupports * 0x00000000, unsigned int 0, const
unsigned short * 0x00000000) line 1590 + 42 bytes
nsHTTPResponseListener::OnStopRequest(nsHTTPResponseListener * const 0x02e930c0,
nsIChannel * 0x02e91810, nsISupports * 0x02e52f50, unsigned int 0, const
unsigned short * 0x00000000) line 249 + 45 bytes
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x02e58fd0) line
283
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x02e5b780) line 152 + 12 bytes
PL_HandleEvent(PLEvent * 0x02e5b780) line 541 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00cfa310) line 500 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x002102dc, unsigned int 49374, unsigned int 0,
long 13607696) line 970 + 9 bytes
USER32! 77e71268()
00cfa310()

Comment 1

[Eric Pollmann]

Radha, this looks and sounds like it might be a DUP of your recent bug.  Is this
crasher fixed with your change?

Comment 2

[Eric Pollmann]

The bug I was referring to was bug 14967.  :)

Comment 3

[Eric Pollmann]

I just checked, it is not fixed by your recent bugfix.  The problem is probably
very similar though, an extra release somewhere...

Comment 4

[Radha on family leave (not reading bugmail)]

*** Bug 15369 has been marked as a duplicate of this bug. ***

Comment 5

[Radha on family leave (not reading bugmail)]

I can't reproduce this. Can someone verify

Comment 6

[Stephen P. Morse]

Yep, appears to be fixed now.  It no longer crashes for me.

Comment 7

[Chris Petersen]

This problem is not happening in the Oct 21 build.