Closed Bug 89358 Opened 23 years ago Closed 23 years ago

0.9.2 crashes trying to open a .html with charset=x-user-defined in the META field - M092 & Trunk [@ nsRenderingContextGTK::GetWidth]

Categories

(Core :: Layout, defect)

x86
Linux
defect
Not set
critical

Tracking

()

VERIFIED WORKSFORME

People

(Reporter: danchev, Assigned: bstell)

References

()

Details

(Keywords: crash, testcase, topcrash)

Crash Data

Attachments

(1 file)

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.2) Gecko/20010628
BuildID:    2001062823

Sometimes Mozilla crashes trying to open a html page with charset=x-user-defined
in the META field . Sometimes it may open the page , causing mashine load , but
crash on View/Page Source .  Appariently it up to how the browser's Preferences
are customized .

Reproducible: Sometimes
Steps to Reproduce:
1.Open the above link 
2. If success , then try Open/View Source 
3.

Actual Results:  causes Mozilla crash !

Expected Results:  even the html source is not correct Mozilla should stay alive . 

 crash is obviously caused by the specified charset value and  code in <PRE>
</PRE> . If one of those is missing you will not see the crash .
Confirmed on 0.9.2 Linux, but WFM on the trunk (cvs build, late 20010704).  Can
anyone see it not on the branch?
Severity: normal → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: crashes trying to open a .html with charset=x-user-defined in the META field → 0.9.2 crashes trying to open a .html with charset=x-user-defined in the META field
Posted a testcase as provided by danchev@spnet.net in the URL.  It features the
charset meta tag and a link within a PRE block -- if I change the link to
straight text, the crash doesn't occur.
Keywords: crash, testcase
The test does not crash me on today's linux mozilla trunk build 070506 (RH6.1) 
 If you are crashing in Mozilla and you want the bug to be fixed the best thing
you can do is to attach a stacktrace. If you're not building yourself you are
not out of luck.  Mozilla (thanks to a very cool donation from Netscape)
releases nightly and milestone builds with Full Circle's Talkback. Talkback
should catch most crashes and offer to send in a crash report. I can retrieve
that crash report and attach it to your bug report if you provide either the
Incident ID (you can get it by running the talkback program from
/components/talkback/) or you can let me know the email address you used to
submit the report and the time of sending. Thanks for your help in testing
Mozilla and reporting bugs.
talkback from reporter (via email):

Incident ID 32556999
Stack Signature nsRenderingContextGTK::GetWidth() c01c169a
Bug ID
Trigger Time 2001-07-05 10:40:51
User Comments trying to open this location using Mozilla-0.9.2 (build
2001062823), then Mozilla crashes
Build ID 2001062823
Product ID Netscape6.10
Platform ID LinuxIntel
Stack Trace
nsRenderingContextGTK::GetWidth()
nsTextFrame::ComputeWordFragmentWidth()
nsTextFrame::ComputeTotalWordWidth()
nsTextFrame::MeasureText()
nsTextFrame::Reflow()
nsLineLayout::ReflowFrame()
nsInlineFrame::ReflowInlineFrame()
nsInlineFrame::ReflowFrames()
nsInlineFrame::Reflow()
nsLineLayout::ReflowFrame()
nsBlockFrame::ReflowInlineFrame()
nsBlockFrame::DoReflowInlineFrames()
nsBlockFrame::DoReflowInlineFramesAuto()
nsBlockFrame::ReflowInlineFrames()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
CanvasFrame::Reflow()
nsBoxToBlockAdaptor::Reflow()
nsBoxToBlockAdaptor::DoLayout()
nsBox::Layout()
nsScrollBoxFrame::DoLayout()
nsBox::Layout()
nsContainerBox::LayoutChildAt()
nsGfxScrollFrameInner::LayoutBox()
nsGfxScrollFrameInner::Layout()
nsGfxScrollFrame::DoLayout()
nsBox::Layout()
nsBoxFrame::Reflow()
nsGfxScrollFrame::Reflow()
nsContainerFrame::ReflowChild()
ViewportFrame::Reflow()
nsHTMLReflowCommand::Dispatch()
PresShell::ProcessReflowCommand()
PresShell::ProcessReflowCommands()
PresShell::FlushPendingNotifications()
nsDocument::FlushPendingNotifications()
nsHTMLDocument::FlushPendingNotifications()
GlobalWindowImpl::FlushPendingNotifications()
GlobalWindowImpl::GetFrames()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_GetterSetter()
js_Invoke()
js_InternalInvoke()
js_GetProperty()
js_Interpret()
js_Invoke()
nsXPCWrappedJSClass::CallMethod()
nsXPCWrappedJS::CallMethod()
PrepareAndDispatch()
nsXPTCStubBase::Stub3()
nsEventListenerManager::HandleEventSubType()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleChromeEvent()
GlobalWindowImpl::HandleDOMEvent()
nsDocument::HandleDOMEvent()
nsEventStateManager::PreHandleEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchFocus()
nsWindow::DispatchSetFocusEvent()
nsWindow::SetFocus()
GlobalWindowImpl::Focus()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Execute()
JS_EvaluateUCScriptForPrincipals()
nsJSContext::EvaluateString()
nsScriptLoader::EvaluateScript()
nsScriptLoader::ProcessRequest()
nsScriptLoader::ProcessScriptElement()
nsHTMLScriptElement::SetDocument()
nsGenericHTMLContainerElement::AppendChildTo()


Looks like bug 88486 which should be fixed in current nightly builds.
---------------------strace------------------------------------debian:# pidof mozilla-bin29018 29017 29016 29014debian:# /usr/bin/strace -p 29018--- SIGRT_0 (Real-time signal 0) ---sigreturn()                             = ? (mask now [])rt_sigprocmask(SIG_BLOCK, [ALRM], [32], 8) = 0gettimeofday({994355302, 533953}, NULL) = 0getpid()                                = 29018open("/etc/resolv.conf", O_RDONLY)      = 33fstat64(33, {st_mode=S_IFREG|0644, st_size=153, ...}) = 0old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x407a2000read(33, "search ns.spnet.net # GNOME-PPP "..., 4096) = 153read(33, "", 4096)                      = 0close(33)                               = 0munmap(0x407a2000, 4096)                = 0socket(PF_UNIX, SOCK_STREAM, 0)         = 33connect(33, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory)close(33)                               = 0open("/usr/local/mozilla092/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)open("/usr/local/mozilla092/plugins/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)open("/etc/ld.so.cache", O_RDONLY)      = 33fstat64(33, {st_mode=S_IFREG|0644, st_size=69700, ...}) = 0old_mmap(NULL, 69700, PROT_READ, MAP_PRIVATE, 33, 0) = 0x4146a000close(33)                               = 0open("/lib/libnss_files.so.2", O_RDONLY) = 33read(33, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200$\0"..., 1024) = 1024fstat64(33, {st_mode=S_IFREG|0644, st_size=34760, ...}) = 0old_mmap(NULL, 38088, PROT_READ|PROT_EXEC, MAP_PRIVATE, 33, 0) = 0x4147c000mprotect(0x41485000, 1224, PROT_NONE)   = 0old_mmap(0x41485000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 33, 0x8000) = 0x41485000close(33)                               = 0munmap(0x4146a000, 69700)               = 0open("/etc/host.conf", O_RDONLY)        = 33fstat64(33, {st_mode=S_IFREG|0644, st_size=28, ...}) = 0old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x407a2000read(33, "order hosts , bind\nmulti on\n", 4096) = 28read(33, "", 4096)                      = 0close(33)                               = 0munmap(0x407a2000, 4096)                = 0open("/etc/hosts", O_RDONLY)            = 33fcntl64(0x21, 0x1, 0, 0x1)              = 0fcntl64(0x21, 0x2, 0x1, 0x2)            = 0fstat64(33, {st_mode=S_IFREG|0644, st_size=291, ...}) = 0old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x407a2000read(33, "127.0.0.1\tdebian\tlocalhost debil"..., 4096) = 291read(33, "", 4096)                      = 0close(33)                               = 0munmap(0x407a2000, 4096)                = 0open("/usr/local/mozilla092/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)open("/usr/local/mozilla092/plugins/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)open("/etc/ld.so.cache", O_RDONLY)      = 33fstat64(33, {st_mode=S_IFREG|0644, st_size=69700, ...}) = 0old_mmap(NULL, 69700, PROT_READ, MAP_PRIVATE, 33, 0) = 0x4146a000close(33)                               = 0open("/lib/libnss_dns.so.2", O_RDONLY)  = 33read(33, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\20\0\000"..., 1024) = 1024fstat64(33, {st_mode=S_IFREG|0644, st_size=55380, ...}) = 0old_mmap(NULL, 68192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 33, 0) = 0x4148a000mprotect(0x41497000, 14944, PROT_NONE)  = 0old_mmap(0x41497000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 33, 0xc000) = 0x41497000old_mmap(0x41499000, 6752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x41499000close(33)                               = 0munmap(0x4146a000, 69700)               = 0socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 33connect(33, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.50.0.10")}}, 28) = 0send(33, "\374\376\1\0\0\1\0\0\0\0\0\0\6elemag\nvirtualave\3n"..., 39, 0) = 39gettimeofday({994355303, 42571}, NULL)  = 0poll([{fd=33, events=POLLIN, revents=POLLIN}], 1, 5000) = 1recvfrom(33, "\374\376\201\200\0\1\0\1\0\2\0\2\6elemag\nvirtualave\3"..., 1024, 0, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.50.0.10")}}, [16]) = 135close(33)                               = 0rt_sigprocmask(SIG_SETMASK, [32], NULL, 8) = 0gettimeofday({994355303, 212811}, NULL) = 0write(10, "8", 1)                       = 1kill(29017, SIGRT_0)                    = 0rt_sigprocmask(SIG_SETMASK, NULL, [32], 8) = 0rt_sigsuspend([] <unfinished ...>--- SIGRT_0 (Real-time signal 0) ---<... rt_sigsuspend resumed> )           = -1 EINTR (Interrupted system call)sigreturn()                             = ? (mask now [])rt_sigprocmask(SIG_SETMASK, NULL, [32], 8) = 0rt_sigsuspend([] <unfinished ...>--- SIGRT_0 (Real-time signal 0) ---<... rt_sigsuspend resumed> )           = -1 EINTR (Interrupted system call)sigreturn()                             = ? (mask now [])rt_sigprocmask(SIG_BLOCK, [ALRM], [32], 8) = 0socket(PF_UNIX, SOCK_STREAM, 0)         = 39connect(39, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory)close(39)                               = 0open("/etc/hosts", O_RDONLY)            = 39fcntl64(0x27, 0x1, 0, 0x1)              = 0fcntl64(0x27, 0x2, 0x1, 0x2)            = 0fstat64(39, {st_mode=S_IFREG|0644, st_size=291, ...}) = 0old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x407b6000read(39, "127.0.0.1\tdebian\tlocalhost debil"..., 4096) = 291read(39, "", 4096)                      = 0close(39)                               = 0munmap(0x407b6000, 4096)                = 0socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 39connect(39, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.50.0.10")}}, 28) = 0send(39, "\374\377\1\0\0\1\0\0\0\0\0\0\5click\6go2net\3com\0\0\1"..., 34, 0) = 34gettimeofday({994355313, 823470}, NULL) = 0poll([{fd=39, events=POLLIN, revents=POLLIN}], 1, 5000) = 1recvfrom(39, "\374\377\201\200\0\1\0\2\0\2\0\2\5click\6go2net\3com\0"..., 1024, 0, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("212.50.0.10")}}, [16]) = 143close(39)                               = 0rt_sigprocmask(SIG_SETMASK, [32], NULL, 8) = 0kill(29017, SIGRT_0)                    = 0rt_sigprocmask(SIG_SETMASK, NULL, [32], 8) = 0rt_sigsuspend([] <unfinished ...>+++ killed by SIGKILL +++debian:# 
George Danchev, can you test this in a build from today and see if it still
crashes you.  If it does not then this is proabably a duplicate of bug 88486.
Thanks.
I picked up build 070508 and the problem does not appear when trying to open
this page . So the problem is solved ! But something strange happend to my
address bar : the url text moves right after clicking on the addres bar leaving
      
some space blank  in the beginning and sometimes in the end .
Looks like : |<blank><url_text><blank>|
I deleted the stalled config file of mozilla in $HOME directiry , but  still
keep experience such behaviour of the text within the address bar . Not sure if
it is a new feature ... but it does not bother me anyway .
Thanks for fixing this crash of Mozilla !
reporter: stacktrace is aka backtrace ('bt' in gdb) from |./mozilla -g|

I hoped this was bug 88486, but someone claimed that crash was trunk only.
Assignee: asa → bstell
Component: Browser-General → Layout
I experienced the crash using build 062823 , but was told to try build from
today - 070508  . It is ok , and I do not get  that  crash anymore visiting such
pages like http://elemag.virtualave.net/testing.html
Address bar issue is a new prolem which i see in  070508 , but it works for me
anyway .
Sorry for the bad 'paste' of strace . I will consider using gdb's  bt  next time .  
I believe this is a dup of bug 88486.

Please reopen if there is still any issues about crashing in GetWidth().



*** This bug has been marked as a duplicate of 88486 ***
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → DUPLICATE
timeless: bug 88486 was one the trunk not the branch
*shrug* it looked like a good dupe, but this report continuously indicated 092 
...
Status: RESOLVED → VERIFIED
Still see the crash when tried to verified bug 88486.

Talkback ID 34444507, 34444918.

Not sure if crashed same place, please reassign if belongs to different component.
Status: VERIFIED → REOPENED
Resolution: DUPLICATE → ---
I cannot reproduce a crash in my current build.
Can not reproduce it today, maybe it's crashed on different place depends on 
the page info.  Mark it as WorksForMe now.
Status: REOPENED → RESOLVED
Closed: 23 years ago23 years ago
Resolution: --- → WORKSFORME
Verified.
Status: RESOLVED → VERIFIED
Sorry for the spam.  Adding topcrash keyword and M092 & Trunk [@
nsRenderingContextGTK::GetWidth] to summary for future reference, since bug
88473 was marked a dup via bug 88496.  I can double verify this worksforme,
since there are only 4 incidents of this crash in teh Talkback database for the
past 30 days across all of our releases.
Keywords: topcrash
Summary: 0.9.2 crashes trying to open a .html with charset=x-user-defined in the META field → 0.9.2 crashes trying to open a .html with charset=x-user-defined in the META field - M092 & Trunk [@ nsRenderingContextGTK::GetWidth]
Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/5a6def05ccbc
Flags: in-testsuite+
Crash Signature: [@ nsRenderingContextGTK::GetWidth]
You need to log in before you can comment on or make changes to this bug.