60110 - crash on bugzilla params page

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Dawn Endico]

2000111408 trunk build as well as nov 6 build.

viewing the bugzilla parameters page crashes mozilla. Nov 6 builds
crashed instantly. Today's build can usually display the page but
then crashes later when I try to do something with the page like
scroll. 

After loading the page, the status bar says:
An unknown error has occurred (804b0005)

Comment 1

[Dawn Endico]

Attachment: params page that causes the crash (need simplified test case)

Comment 2

[Dawn Endico]

since the bugzilla params page is only viewable by a few people, i saved
the page and attached it here.

Comment 3

[Asa Dotzler [:asa]]

talkback gives this:
libc.so.6 + 0x5a12c (0x402a012c)
     libc.so.6 + 0x59fba (0x4029ffba)
     libnspr4.so + 0x10eb0 (0x40189eb0)
     nsMemoryImpl::Free()
     nsMemory::Free()
     nsStr::Free()
     nsStr::GrowCapacity()
     nsString::SetCapacity()
     nsString::SetLength()
     mozilla-bin + 0xa1b0 (0x080521b0)
     libhtmlpars.so + 0x51e33 (0x40f01e33)
     libhtmlpars.so + 0x2b05b (0x40edb05b)
     libhtmlpars.so + 0x161df (0x40ec61df)
     libhtmlpars.so + 0x145a0 (0x40ec45a0)
     libhtmlpars.so + 0x14edc (0x40ec4edc)
     libhtmlpars.so + 0x139ca (0x40ec39ca)
     libhtmlpars.so + 0x132b9 (0x40ec32b9)
     libhtmlpars.so + 0x26543 (0x40ed6543)
     libhtmlpars.so + 0x26385 (0x40ed6385)
     libhtmlpars.so + 0x26c9a (0x40ed6c9a)
     liburiloader.so + 0x38bf (0x40ad18bf)
     libnecko.so + 0x55b31 (0x40924b31)
     libnecko.so + 0x35f76 (0x40904f76)
     libnecko.so + 0x3085d (0x408ff85d)
     libnecko.so + 0x54bce (0x40923bce)
     libnecko.so + 0x11938 (0x408e0938)
     libnecko.so + 0x111d0 (0x408e01d0)
     PL_HandleEvent()
     PL_ProcessPendingEvents()
     nsEventQueueImpl::ProcessPendingEvents()
     libwidget_gtk.so + 0xce0f (0x40513e0f)
     libwidget_gtk.so + 0xcbcd (0x40513bcd)
     libglib-1.2.so.0 + 0xeaca (0x406abaca)
     libglib-1.2.so.0 + 0x10186 (0x406ad186)
     libglib-1.2.so.0 + 0x10751 (0x406ad751)
     libglib-1.2.so.0 + 0x108f1 (0x406ad8f1)
     libgtk-1.2.so.0 + 0x8c5b9 (0x405d55b9)
     libwidget_gtk.so + 0xd2fc (0x405142fc)
     libnsappshell.so + 0xcc0a (0x40451c0a)
     mozilla-bin + 0x6275 (0x0804e275)
     mozilla-bin + 0x6845 (0x0804e845)
     libc.so.6 + 0x189cb (0x4025e9cb)

Comment 4

[Asa Dotzler [:asa]]

another talkback report says this:
libgklayout.so + 0xe9712 (0x40bd8712)
     libgklayout.so + 0x143477 (0x40c32477)
     libgklayout.so + 0x1438b5 (0x40c328b5)
     libgklayout.so + 0x144d51 (0x40c33d51)
     libgklayout.so + 0x14780c (0x40c3680c)
     libhtmlpars.so + 0x17bc3 (0x40ea8bc3)
     libhtmlpars.so + 0x1452d (0x40ea552d)
     libhtmlpars.so + 0x15102 (0x40ea6102)
     libhtmlpars.so + 0x139ca (0x40ea49ca)
     libhtmlpars.so + 0x132b9 (0x40ea42b9)
     libhtmlpars.so + 0x26543 (0x40eb7543)
     libhtmlpars.so + 0x26385 (0x40eb7385)
     libhtmlpars.so + 0x26c9a (0x40eb7c9a)
     liburiloader.so + 0x38bf (0x40ab18bf)
     libnecko.so + 0x556a1 (0x408d86a1)
     libnecko.so + 0x35c46 (0x408b8c46)
     libnecko.so + 0x3058d (0x408b358d)
     libnecko.so + 0x5472e (0x408d772e)
     libnecko.so + 0x118f3 (0x408948f3)
     libnecko.so + 0x11174 (0x40894174)
     PL_HandleEvent()
     PL_ProcessPendingEvents()
     nsEventQueueImpl::ProcessPendingEvents()
     libwidget_gtk.so + 0xce0f (0x404a2e0f)
     libwidget_gtk.so + 0xcbcd (0x404a2bcd)
     libglib-1.2.so.0 + 0xeaca (0x40643aca)
     libglib-1.2.so.0 + 0x10186 (0x40645186)
     libglib-1.2.so.0 + 0x10751 (0x40645751)
     libglib-1.2.so.0 + 0x108f1 (0x406458f1)
     libgtk-1.2.so.0 + 0x8c5b9 (0x4056d5b9)
     libwidget_gtk.so + 0xd2fc (0x404a32fc)
     libnsappshell.so + 0xcc0a (0x40450c0a)
     mozilla-bin + 0x6275 (0x0804e275)
     mozilla-bin + 0x6845 (0x0804e845)
     libc.so.6 + 0x189cb (0x4025d9cb)
Over to Layout.

Comment 5

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Please triage.

Comment 6

[harishd]

Attachment: Reduced case....

Comment 7

[harishd]

Failing inside CNavDTD::CollectSkippedContent() on a call to nsString::Append()
method - if(mScratch.Length()>0){
            aMustConvertLinebreaks |= (mScratch[0] == kCR);
     -----> aNode.mSkippedContent->Append(mScratch);
          } -
Adding Scott for more input.

Comment 8

[Hixie (not reading bugmail)]

Upon managerial request, adding the "testcase" keyword to 84 open layout bugs that
do not have the "testcase" keyword and yet have an attachement with the word
"test" in the description field. Apologies for any mistakes.

Comment 9

[harishd]

I don't see this crash anymore. Anyone else?

Marking WFM for now.

Comment 10

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/5a6def05ccbc