107413 - crash on page with multiple embedded tables and padding-left

Status: RESOLVED WORKSFORME

(Core :: XPCOM, defect)

Description

[Mike Utke]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.5+) Gecko/20011029
BuildID:    2001102910

When visiting www.bleem.com this weekend, I noticed a crash.  When reducing the
testcase, I managed to reliably reproduce it when padding-left set on a div and
putting four tables inside each other.  The testcase can probably be reduced a
bit more, but I lack the time to go further right now.  Removing the
padding-left or one of the tables did, at one point, stop the crash.

Reproducible: Always
Steps to Reproduce:
1. Load http://www.bleem.com/nshtml/main/mainpage.shtml or view upcoming attachment



Actual Results:  Crash
run-mozilla.sh: line 72: 24469 Segmentation fault
    $prog ${1+"$@"}


Expected Results:  Don't crash, view page

Comment 1

[Mike Utke]

Attachment: Reduced testcase

Comment 2

[James Paige]

Hmmm. No crash for me either on the bleem site or the testcase, build 2001102903
on Win 95

Comment 3

[Boris Zbarsky [:bzbarsky]]

#0  chunk_alloc (ar_ptr=0x40684d40, nb=48) at malloc.c:2868
#1  0x405ef5ae in __libc_malloc (bytes=42) at malloc.c:2696
#2  0x402b45ae in PL_strdup (s=0x8a62670
"chrome://global/skin/scrollbar/btn-up.gif")
    at strdup.c:46
#3  0x4023efd2 in nsCRT::strdup (
    str=0x8a62670 "chrome://global/skin/scrollbar/btn-up.gif")
    at ../../dist/include/xpcom/nsCRT.h:182
#4  0x40f4a684 in DupString (o_Dest=0xbfffdb98, 
    i_Src=0x8a62670 "chrome://global/skin/scrollbar/btn-up.gif") at
nsURLHelper.cpp:83
#5  0x40f40cf4 in nsStdURL::SetSpec (this=0x8b7f658, 
    i_Spec=0x8a62670 "chrome://global/skin/scrollbar/btn-up.gif") at
nsStdURL.cpp:1009
#6  0x411bb571 in nsChromeProtocolHandler::NewURI (this=0x815d628, 
    aSpec=0x8a62670 "chrome://global/skin/scrollbar/btn-up.gif", aBaseURI=0x0, 
    result=0xbfffdd8c) at nsChromeProtocolHandler.cpp:568
#7  0x40f2a415 in nsIOService::NewURI (this=0x812b0a8, 
    aSpec=0x8a62670 "chrome://global/skin/scrollbar/btn-up.gif",
aBaseURI=0x8a3b438, 
    result=0xbfffdd8c) at nsIOService.cpp:713

Over to strings.

Comment 4

[Mike Utke]

Appears to be fixed on Linux 200110612 both on testcase and above URL.  Should
mark WORKSFORME, but I'll let scc make that call.

Comment 5

[Mike Utke]

Still WORKSFORME on Linux 2001111109 so I'm going to resolve it.  Thanks for
your time.