9698 - [PP]mac crash when I go to http://www.herring.com/mag/issue67/news-editor.html

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[(not reading, please use [e-mail] instead)]

here's the stack trace:

#0  0x40e3e32f in nsCSSFrameConstructor::ContentRemoved (this=0x845d290,
aPresContext=0x8468848, aContainer=0x0, aChild=0x84769ec, aIndexInContainer=0)
at nsCSSFrameConstructor.cpp:4607
#1  0x40f0dd45 in StyleSetImpl::ContentRemoved (this=0x845d248,
aPresContext=0x8468848, aContainer=0x0, aChild=0x84769ec, aIndexInContainer=0)
at nsStyleSet.cpp:822
#2  0x40d4ed64 in PresShell::ContentRemoved (this=0x845d2d8,
aDocument=0x8477490, aContainer=0x0, aChild=0x84769ec, aIndexInContainer=0) at
nsPresShell.cpp:1735
#3  0x40ed8a2b in nsDocument::ContentRemoved (this=0x8477490, aContainer=0x0,
aChild=0x84769ec, aIndexInContainer=0) at nsDocument.cpp:1612
#4  0x40df0a64 in nsHTMLDocument::ContentRemoved (this=0x8477490,
aContainer=0x0, aChild=0x84769ec, aIndexInContainer=0) at nsHTMLDocument.cpp:775
#5  0x40ed6d3d in nsDocument::Reset (this=0x8477490, aURL=0x8580698) at
nsDocument.cpp:853
#6  0x40def3ea in nsHTMLDocument::Reset (this=0x8477490, aURL=0x8580698) at
nsHTMLDocument.cpp:247
#7  0x40df1d1a in nsHTMLDocument::OpenCommon (this=0x8477490,
aSourceURL=0x8580698) at nsHTMLDocument.cpp:1326
#8  0x40df2069 in nsHTMLDocument::Open (this=0x8477490, cx=0x84528d0,
argv=0x84b1874, argc=1) at nsHTMLDocument.cpp:1412
#9  0x40df245c in nsHTMLDocument::ScriptWriteCommon (this=0x8477490,
cx=0x84528d0, argv=0x84b1874, argc=1, aNewlineTerminate=0) at
nsHTMLDocument.cpp:1490
#10 0x40df2688 in nsHTMLDocument::Write (this=0x8477490, cx=0x84528d0,
argv=0x84b1874, argc=1) at nsHTMLDocument.cpp:1528
#11 0x40399bb1 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libjsdom.so
#12 0x404366f7 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libmozjs.so
#13 0x40444db1 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libmozjs.so
#14 0x40436c62 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libmozjs.so
#15 0x4040e8c1 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libmozjs.so
#16 0x40357768 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libjsdom.so
#17 0x40debb37 in HTMLContentSink::EvaluateScript (this=0x8398ee8,
aScript=@0x825c670, aLineNo=0) at nsHTMLContentSink.cpp:2869
#18 0x40debc10 in nsDoneLoadingScript (aLoader=0x825c650, aData=@0x825c670,
aRef=0x8398ee8, aStatus=0) at nsHTMLContentSink.cpp:2894
#19 0x40128823 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libnetlib.so
#20 0x402af333 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libraptorwebwidget.so
#21 0x4012bc3c in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libnetlib.so
#22 0x40028cd7 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libhttpurl.so
#23 0x400fa5ae in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libnetwork.so
#24 0x401026b1 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libnetwork.so
#25 0x401252f2 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libnetlib.so
#26 0x4028d205 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libgfxgtk.so
#27 0x4028d68a in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libgfxgtk.so
#28 0x4067ffa3 in ?? () from /usr/lib/libglib-1.2.so.0
#29 0x4067f2c6 in ?? () from /usr/lib/libglib-1.2.so.0
#30 0x4067f801 in ?? () from /usr/lib/libglib-1.2.so.0
#31 0x4067f979 in ?? () from /usr/lib/libglib-1.2.so.0
#32 0x405aef3a in ?? () from /usr/lib/libgtk-1.2.so.0
#33 0x4022b5a9 in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libwidgetgtk.so
#34 0x4015681d in ?? () from
/builds/seth/MOZILLA/07.06.1999/04.30/mozilla/dist/bin/libnsappshell.so
#35 0x804ab20 in main (argc=2, argv=0xbffff9e4) at nsAppRunner.cpp:701
#36 0x407e1cb3 in ?? () from /lib/libc.so.6

Here's a simple bullet-proofing patch to prevent the crash:

  Index: nsCSSFrameConstructor.cpp
===================================================================
RCS file: /cvsroot/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,v
retrieving revision 1.149
diff -p -r1.149 nsCSSFrameConstructor.cpp
*** nsCSSFrameConstructor.cpp   1999/07/10 01:10:36     1.149
--- nsCSSFrameConstructor.cpp   1999/07/12 19:19:02
*************** nsCSSFrameConstructor::ContentRemoved(ns
*** 4604,4609 ****
--- 4604,4610 ----

  #ifdef INCLUDE_XUL
      nsCOMPtr<nsIAtom> tag;
+     if (!aContainer) return NS_ERROR_NULL_POINTER;
      aContainer->GetTag(*getter_AddRefs(tag));
      if (tag.get() == nsXULAtoms::treechildren ||
          tag.get() == nsXULAtoms::treeitem) {

As soon as the tree opens, I'll check that in.

The real problem seems to be netlib related.

before the crash, this message gets written to the console:
"couldn't find the active socket.  Shouldn't ever happen"

Comment 1

[(not reading, please use [e-mail] instead)]

marking target milestone m8.

Comment 2

[(not reading, please use [e-mail] instead)]

bullet proofing fixed checked in.

marking fixed, as it doesn't crash anymore.

Comment 3

[Chris Petersen]

This crash is fixed on the Linux July 13th . I can't reproduce the crash on the
Windows 95/NT build. However, this crash does occur on the Mac build (July 13th
1999071309)

Comment 4

[troy]

I don't know why this is assigned to layout since it appears to be XUL or
network related

Seth, assigning it to you because you marked it as FIXED

Comment 5

[(not reading, please use [e-mail] instead)]

troy:  sorry, it was under mozilla/layout so I just left the assigned field
blank.

Now that I'm thinking clearly, I went to lxr and found that hyatt owns the code.

reassigning to him.

hyatt:  my checkin fixes the crasher, but I wanted to run the bug and fix by
you, in case you want to scope it out.

Comment 6

[David Hyatt]

I already checked in a fix for this yesterday (assuming it's the same crash as
9601 was).

Comment 7

[David Hyatt]

Oops. I never checked in the fix.  I just put the fix for this into the tip.

Comment 8

[Chris Petersen]

I will check the bug in tomorrow's build (7/15) to see if fix has been added.

Comment 9

[Chris Petersen]

The crash no longer occurs in the (1999071416) Mac build. But now the contents of

the page is missing with only a single banner gif displayed. Will write up a new

bug.