265375 - crash (double caption?) [@ nsCSSFrameConstructor::GetFrameFor]

Status: RESOLVED DUPLICATE of bug 265181

(Core :: CSS Parsing and Computation, defect)

Description

[Thomas Stromberg]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.5 (KHTML, like Gecko) Safari/125.9
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a5) Gecko/20041020

I was doing some FireFox QA using iExploder - http://toadstool.se/software/iexploder - and stumbled 
upon this crash bug a few times. I can't make heads or tails of what HTML generates the issue, but in 
both of my test cases, the <caption> tag exists.


Reproducible: Always
Steps to Reproduce:




Talkback crash ID's: TB1431722W, TB143174K

Comment 1

[Thomas Stromberg]

Attachment: Test case 47179: caption's, iframes, and tables

Stack trace from this test case:

Thread 0 Crashed:
0   <<00000000>>	0x045f1360 0 + 0x45f1360
1   org.mozilla.firefox 	0x0031c034
nsCSSFrameConstructor::FindPrimaryFrameFor(nsPresContext*, nsFrameManager*,
nsIContent*, nsIFrame**, nsFindFrameHint*) + 0x90
2   org.mozilla.firefox 	0x0034e7f0
nsFrameManager::GetPrimaryFrameFor(nsIContent*) + 0x170
3   org.mozilla.firefox 	0x001fd050
PresShell::GetPrimaryFrameFor(nsIContent*, nsIFrame**) const + 0x1c
4   org.mozilla.firefox 	0x00319d1c
nsCSSFrameConstructor::CharacterDataChanged(nsPresContext*, nsIContent*, int) +
0x44
5   org.mozilla.firefox 	0x001fcb9c
PresShell::CharacterDataChanged(nsIDocument*, nsIContent*, int) + 0x20
6   org.mozilla.firefox 	0x002621bc
nsDocument::CharacterDataChanged(nsIContent*, int) + 0x84
7   org.mozilla.firefox 	0x00479abc
nsGenericDOMDataNode::AppendData(nsAString const&) + 0x164
8   org.mozilla.firefox 	0x0037883c SinkContext::FlushText(int*, int) +
0xe4
9   org.mozilla.firefox 	0x00377b40
SinkContext::CloseContainer(nsHTMLTag) + 0x24
10  org.mozilla.firefox 	0x00145f4c CNavDTD::CloseContainer(nsHTMLTag,
nsHTMLTag, int) + 0x1f0
11  org.mozilla.firefox 	0x00145ff4 CNavDTD::CloseContainersTo(int,
nsHTMLTag, int) + 0x90
12  org.mozilla.firefox 	0x0014126c CNavDTD::DidBuildModel(unsigned,
int, nsIParser*, nsIContentSink*) + 0x10c
13  org.mozilla.firefox 	0x00147dc4 nsParser::DidBuildModel(unsigned) +
0x78
14  org.mozilla.firefox 	0x00148d24 nsParser::ResumeParse(int, int, int)
+ 0x250
15  org.mozilla.firefox 	0x00149ed4 nsParser::OnStopRequest(nsIRequest*,
nsISupports*, unsigned) + 0xa8
16  org.mozilla.firefox 	0x00509544
nsDocumentOpenInfo::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 0x7c
17  org.mozilla.firefox 	0x000d86ac
nsFileChannel::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 0x50
18  org.mozilla.firefox 	0x000a304c nsInputStreamPump::OnStateStop() +
0xa0
19  org.mozilla.firefox 	0x000a2bd4
nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) + 0x80

Comment 2

[Thomas Stromberg]

Attachment: Test case 66937: Caption and Marquee

Thread 0 Crashed:
0   org.mozilla.firefox 	0x00315f04
nsCSSFrameConstructor::GetFrameFor(nsIPresShell*, nsPresContext*, nsIContent*)
+ 0x3c
1   org.mozilla.firefox 	0x00317608
nsCSSFrameConstructor::ContentAppended(nsPresContext*, nsIContent*, int) + 0xf8

2   org.mozilla.firefox 	0x001fcc88
PresShell::ContentAppended(nsIDocument*, nsIContent*, int) + 0x2c
3   org.mozilla.firefox 	0x002622f4
nsDocument::ContentAppended(nsIContent*, int) + 0x74
4   org.mozilla.firefox 	0x0037c800
HTMLContentSink::NotifyAppend(nsIContent*, unsigned) + 0x34
5   org.mozilla.firefox 	0x00377c70
SinkContext::CloseContainer(nsHTMLTag) + 0x154
6   org.mozilla.firefox 	0x00145f4c CNavDTD::CloseContainer(nsHTMLTag,
nsHTMLTag, int) + 0x1f0
7   org.mozilla.firefox 	0x00145ff4 CNavDTD::CloseContainersTo(int,
nsHTMLTag, int) + 0x90
8   org.mozilla.firefox 	0x0014126c CNavDTD::DidBuildModel(unsigned,
int, nsIParser*, nsIContentSink*) + 0x10c
9   org.mozilla.firefox 	0x00147dc4 nsParser::DidBuildModel(unsigned) +
0x78
10  org.mozilla.firefox 	0x00148d24 nsParser::ResumeParse(int, int, int)
+ 0x250
11  org.mozilla.firefox 	0x00149ed4 nsParser::OnStopRequest(nsIRequest*,
nsISupports*, unsigned) + 0xa8
12  org.mozilla.firefox 	0x00509544
nsDocumentOpenInfo::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 0x7c
13  org.mozilla.firefox 	0x000d86ac
nsFileChannel::OnStopRequest(nsIRequest*, nsISupports*, unsigned) + 0x50
14  org.mozilla.firefox 	0x000a304c nsInputStreamPump::OnStateStop() +
0xa0
15  org.mozilla.firefox 	0x000a2bd4
nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) + 0x80
16  libxpcom.dylib		0x0707ff64 0x7000000 + 0x7ff64
17  libxpcom.dylib		0x07040fa4 PL_HandleEvent + 0x24
18  libxpcom.dylib		0x07040ec8 PL_ProcessPendingEvents + 0x80
19  libxpcom.dylib		0x070413ac PL_IsQueueNative + 0x88
20  com.apple.HIToolbox 	0x927d1fc8 DispatchEventToHandlers + 0x150

Comment 3

[Thomas Stromberg]

I'm beginning to suspect the bug source is actually double captions. I've built some more test cases 
with double captions that have completely different back traces. 

Comment 4

[Boris Zbarsky [:bzbarsky]]

There's a good chance this is a duplicate of bug 265181 

Comment 5

[Asa Dotzler [:asa]]

bug 265583?

Comment 6

[Bernd]

both testcases cont crash with the patch in bug 265181

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

So this is a duplicate, right?

Comment 8

[Bernd]

I believe so, the patch is in , so tomorrows builds should have it

*** This bug has been marked as a duplicate of 265181 ***