2375 - webmonky.com crashes Gecko 011398

Status: VERIFIED DUPLICATE of bug 1355

(Core :: Layout, defect, P2)

Description

[andreww]

going to webmonkey.com crashes Gecko - build 011398.
It loads the frameset but crashes shortly after.

Comment 1

[troy]

Peter, here's the stack trace. It looks like NS_MakeAbsoluteURL is being used in
a way that's different from how it's intended. I don't know whether it changed
or whether that's always been the way it is

NS_MakeAbsoluteURL(nsIURL * 0x00000000, const nsString & {""}, const nsString &
{"/webmonkey/meta/toolbar/objects/clickRegion.gif"}, nsString & {""}) line 1088
+ 7 bytes
CSSParserImpl::ParseURL(int & 0x00000000, nsCSSValue & {...}) line 1937 + 28
bytes
CSSParserImpl::ParseVariant(int & 0x00000000, nsCSSValue & {...}, int
0x00060010, const int * 0x00000000, int & 0x00000000) line 1773 + 19 bytes
CSSParserImpl::ParseVariant(int & 0x00000000, nsICSSDeclaration * 0x0166bd80,
int 0x00000005, int 0x00060010, const int * 0x00000000, int & 0x00000000) line
1651 + 28 bytes
CSSParserImpl::ParseProperty(int & 0x00000000, nsICSSDeclaration * 0x0166bd80,
int 0x00000005) line 2068 + 31 bytes
CSSParserImpl::ParseProperty(int & 0x00000000, nsICSSDeclaration * 0x0166bd80,
int 0x00000005, int & 0x00000003) line 2041
CSSParserImpl::ParseDeclaration(int & 0x00000000, nsICSSDeclaration *
0x0166bd80, int 0x00000000, int & 0x00000003) line 1401 + 24 bytes
CSSParserImpl::ParseDeclarationBlock(int & 0x00000000, int 0x00000000) line 1260
+ 24 bytes
CSSParserImpl::ParseDeclarations(CSSParserImpl * const 0x0166a2b0, const
nsString & {"position: absolute; left: 130; top: 0; width: 12px; height: 722px;
background-color:blue; margin: 0; background-image: url(/we"}, nsIURL *
0x00000000, nsIStyleRule * & 0x0012fb88) line 387 + 14 bytes
nsGenericHTMLElement::SetAttribute(int 0x00000003, nsIAtom * 0x00f40990
{"STYLE"}, const nsString & {"position: absolute; left: 130; top: 0; width:
12px; height: 722px; background-color:blue; margin: 0; background-image:
url(/we"}, int 0x00000000) line 459 + 22 bytes
nsHTMLDivElement::SetAttribute(nsHTMLDivElement * const 0x016697dc, int
0x00000003, nsIAtom * 0x00f40990 {"STYLE"}, const nsString & {"position:
absolute; left: 130; top: 0; width: 12px; height: 722px; background-color:blue;
margin: 0; background-image: url(/we"}, int 0x00000000) line 67 + 30 bytes
AddAttributes(const nsIParserNode & {...}, nsIHTMLContent * 0x016697dc,
nsIScriptContextOwner * 0x00f9898c) line 478
SinkContext::OpenContainer(const nsIParserNode & {...}) line 965 + 17 bytes
HTMLContentSink::OpenContainer(HTMLContentSink * const 0x00f9c560, const
nsIParserNode & {...}) line 1826
CNavDTD::OpenContainer(const nsIParserNode & {...}, int 0x00000001) line 2124 +
22 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x01664de0, nsHTMLTag eHTMLTag_div,
nsIParserNode & {...}) line 773 + 14 bytes
CNavDTD::HandleStartToken(CToken * 0x01664de0) line 870 + 23 bytes
NavDispatchTokenHandler(CToken * 0x01664de0, nsIDTD * 0x0161c720) line 261 + 12
bytes
CTokenHandler::operator()(CToken * 0x01664de0, nsIDTD * 0x0161c720) line 80 + 14
bytes
CNavDTD::HandleToken(CNavDTD * const 0x0161c720, CToken * 0x01664de0, nsIParser
* 0x00f9c670) line 548 + 18 bytes
CNavDTD::BuildModel(CNavDTD * const 0x0161c720, nsIParser * 0x00f9c670) line 478
+ 20 bytes
nsParser::BuildModel() line 717 + 16 bytes
nsParser::ResumeParse(nsIDTD * 0x00000000) line 673 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x00f9c674, nsIURL * 0x00f99f60,
nsIInputStream * 0x00f9b390, unsigned int 0x00000cb2) line 868
nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x00f98060,
nsIURL * 0x00f99f60, nsIInputStream * 0x00f9b390, unsigned int 0x00000cb2) line
1682 + 24 bytes
OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const
0x00fac0c0) line 626
StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x00fac0c4) line 465 + 12
bytes
PL_HandleEvent(PLEvent * 0x00fac0c4) line 395 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00ebfd00) line 357 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0076052e, unsigned int 0x0000c101, unsigned int
0x00000000, long 0x00ebfd00) line 675 + 9 bytes
USER32! 77e71250()
00ebfd

Comment 2

[Peter Linss]

The problem is that the CSS parser is trying to compute a URL as relative to the
document's bsae URL, but the attribute parsing code never bothered to give the
CSS parser the document's URL.
Already fixed in my tree, checking in within minutes.

*** This bug has been marked as a duplicate of 1355 ***