107367 - Various crashes on dhtmlkitchen.com

Status: RESOLVED DUPLICATE of bug 105619

(Core :: XPCOM, defect)

Description

[Sam Rowe]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.5+) Gecko/20011028
BuildID:    2001102821

I was about to report a bug about crashing after clicking on DHTML | Node
Maniplulation and I had the index loaded in a second window in the background.
When I focused the window and tried to copy the URL into the clipboard, Mozilla
crashed.

Reproducible: Always
Steps to Reproduce:
1. hit http://dhtmlkitchen.com/index.html
2. Click DHTML on the left
3. Click Node Manipulation

Comment 1

[Ashley Bischoff (blog at handcoding.com)]

Reporter: Please try a talkback-enabled build:
http://ftp.mozilla.org/pub/mozilla/nightly/latest/mozilla-i686-pc-linux-gnu-sea.tar.gz
(as always, be sure to delete your old Mozilla directory before installing the
new one)

Then, if you get a crash, please post the Talkback ID here.
(you can get the talkback id by running 'talkback' in
<moz-dir>/bin/components/talkback)

Comment 2

[James Paige]

Interesting. I tested this with build 2001102903 on Windows 95.

I clicked on the link to http://dhtmlkitchen.com/index.html

The page loaded, and immediately popped up an error with the red-X-of-death icon
on it (although the popup was the wrong size and shape for a _real_ red-X-of-death) 

The error said:

------------------------------------------

  Microsoft Visual C++ Runtime Library

     Runtime Error
     Program G:\MOZILLA\BIN\MOZILLA.EXE

        R6025
        -pure virtual function call

------------------------------------------

The browser window then immediatetly un-maximized underneath the error message,
and then a second message box with exactly the same error message popped up on
top of the first. When I clicked "OK" on the topmost error, both errors, and the
browser window promptly dissapeared, and no talkback incindent was triggered.

Comment 3

[Thorsten Konetzko]

I can confirm this, an incident ID was generated (TB37352572M)
(Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.5+) Gecko/20011028)

Comment 4

[Ashley Bischoff (blog at handcoding.com)]

CC: [e-mail], for talkback retrieval, please (TB37352572M)

Comment 5

[[e-mail] (gone - use [e-mail] instead)]

Incident ID 37352572
Stack Signature nsAString::do_AssignFromReadable 7c7ddf7e
Bug ID
Trigger Time 2001-10-29 10:02:04
Email Address [e-mail]
URL visited http://dhtmlkitchen.com/dhtml/replaceEl/replaceEl.html
User Comments see #107367
Build ID 2001102811
Product ID MozillaTrunk
Platform ID Win32
Trigger Reason Access violation
Stack Trace
nsAString::do_AssignFromReadable
[d:\builds\seamonkey\mozilla\string\src\nsAString.cpp, line 290]
nsAString::AssignFromReadable
[d:\builds\seamonkey\mozilla\string\src\nsAString.cpp, line 741]
nsFont::operator= [d:\builds\seamonkey\mozilla\gfx\src\nsFont.cpp, line 104]
nsFontMetricsWin::Init
[d:\builds\seamonkey\mozilla\gfx\src\windows\nsFontMetricsWin.cpp, line 448]
nsFontCache::GetMetricsFor
[d:\builds\seamonkey\mozilla\gfx\src\nsDeviceContext.cpp, line 565]
DeviceContextImpl::GetMetricsFor
[d:\builds\seamonkey\mozilla\gfx\src\nsDeviceContext.cpp, line 229]
ComputeLineHeight
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowState.cpp, line 2202]
nsHTMLReflowState::CalcLineHeight
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowState.cpp, line 2244]
nsBlockReflowState::nsBlockReflowState
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowState.cpp, line 175]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 718]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 737]
nsHTMLButtonControlFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsHTMLButtonControlFrame.cpp,
line 676]
nsLineLayout::ReflowFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp, line 1038]
nsBlockFrame::ReflowInlineFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3659]
nsBlockFrame::DoReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3540]
nsBlockFrame::DoReflowInlineFramesAuto
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3465]
nsBlockFrame::ReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3410]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2479]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2142]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 827]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3153]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2364]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2142]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 827]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 445]
nsAbsoluteContainingBlock::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 230]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 997]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 660]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 737]
CanvasFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 570]
nsBoxToBlockAdaptor::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxToBlockAdaptor.cpp, line 891]
nsBoxToBlockAdaptor::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxToBlockAdaptor.cpp, line 540]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1002]
nsScrollBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsScrollBoxFrame.cpp, line 392]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1002]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 653]
nsGfxScrollFrameInner::LayoutBox
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1026]
nsGfxScrollFrameInner::Layout
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1137]
nsGfxScrollFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 1034]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1002]
nsBoxFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 944]
nsGfxScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 752]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 737]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 575]
nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line 217]
PresShell::ProcessReflowCommand
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5996]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6051]
ReflowEvent::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5907]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1315]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1632]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1650]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e87d08) 

Comment 6

[Boris Zbarsky [:bzbarsky]]

String.

Comment 7

[Jacob Steenhagen]

I've just started seeing this on my Intranet main page (but so far none of the 
internal pages I've tested).  All pages in my Intranet use the same JavaScript 
(included via SSI) so I don't think it's related to that.  I'll try to narrow 
this down to a more specific testcase.

Comment 8

[Jacob Steenhagen]

Attachment: testcase

Comment 9

[Jacob Steenhagen]

The testcase I just uploaded will very happily end Mozilla's life on my CVS
build from today.  It seems to be some strange combination.  If I:
 a) remove the CSS style for "ul.l1"
 b) remove the <img id="img_phone" src="/images/arrow_down.gif"> tag
 c) change the order in the branch[] array (so 'phone_nsi' is 0 and 'phone' is 1)

It seems to work fine.  I thought it was related to the fact that 'phone_nsi'
contains the entire string of 'phone', but I have similar pages that work fine
(eg,  I have one page that has 'dept', 'dept_qual', and 'dept_qual_qdoc' nested
pretty much the same way 'phone' and 'phone_nsi' are.

Comment 10

[Boris Zbarsky [:bzbarsky]]

With that testcase and a current debug build I get:

###!!! ASSERTION: nsCSSOMFactory not thread-safe: 'owningThread ==
NS_CurrentThread()', file nsDebug.cpp, line 528
###!!! Break: at file nsDebug.cpp, line 528
Document http://bugzilla.mozilla.org/showattachment.cgi?attach_id=56910 loaded
successfully
pure virtual method called

and mozilla exits (not crashes) so no stack.

I'm not sure the assertion and the virtual method are related, but ccing dbaron.

Note that this is a _different_ crash from the original site.

Why are we even getting objects created that have pure virtual methods?  Is
there no way to detect this at compile-time?

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I've seen other threadsafety assertions because the socket transport was
releasing a webshell.  A stack for that assertion would be useful.

However, it's probably a separate bug.  I suspect the pure virtual function call
and the assertion are unrelated.

Comment 12

[Jacob Steenhagen]

You're right, it's a different crash then I get also when going to
http://dhtmlkitchen.com/index.html... I saw [e-mail]'s
description and error message and it was exactly what I was seeing, so I assumed
the same thing would happen if I tried to go there.  Being that I'd already seen
enough crashes, I thought I'd just start trying to reproduce it on as small a
test case as I could using my own code.

Comment 13

[Matthias Versen [:Matti]]

*** Bug 112194 has been marked as a duplicate of this bug. ***

Comment 14

[Boris Zbarsky [:bzbarsky]]

Looks like bug 106341

Comment 15

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** This bug has been marked as a duplicate of 105619 ***