110650 - M098 & Trunk [@ nsContainerFrame::PaintChild]

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P1)

Description

[ba824109]

From Bugzilla Helper:
User-Agent: Mozilla/4.77 [en] (Win98; U)
BuildID:    2001111708



Reproducible: Always
Steps to Reproduce:
Use 2001111708 and load http://www.asus.com/products/Motherboard/award.html


Every time Mozilla crashes the Windows error message displays:

Module GKLAYOUT.DLL at 0187:6035550f

Comment 1

[Matp75]

Wfm with 2001111706 on Linux 

Comment 2

[rcummins]

TB38184218W w/ 2001111603 on Win98

Comment 3

[Karl Johan Kleist]

Build ID: 2001 11 15 03. Windows 2000.

Confirm crash: TB38185289W

Comment 4

[Ashley Bischoff (blog at handcoding.com)]

Confirming based on comments.

CC: [e-mail] for talkback retrieval, please (TB38184218W)

Reporter: In future, please use a talkback-enabled build, as that allows us to
get a Talkback ID for the crash (much more useful than DLL info).

For example, this is a talkback-enabled build:
http://ftp.mozilla.org/pub/mozilla/nightly/latest/mozilla-win32-talkback.zip
(as always, be sure to delete your old Mozilla directory before installing the
new one)

Then, if you get a crash, you'd post a Talkback ID here (just as others have
done). You can get the talkback id by running <moz-dir>/bin/components/talkback.exe.

Comment 5

[Olivier Cahagne]

Confirming on Linux with build 2001111706.
Talkback ID (if needed for a different OS): TB38188180M.

Setting OS -> All.

Comment 6

[[e-mail] (gone - use [e-mail] instead)]

Stack Signature  nsContainerFrame::PaintChild 68a2aeb6
Bug ID
Trigger Time 2001-11-18 06:51:26
Email Address [e-mail]
URL visited http://www.rbc.ru
User Comments
Build ID 2001111605
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
Stack Trace
nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 206]
nsBlockFrame::PaintFloaters
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5398]
nsBlockFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5327]
nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 248]
nsBlockFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5457]
nsBlockFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5329]
nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 248]
nsContainerFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 191]
nsTableCellFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 448]
nsTableRowFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 662]
nsTableRowFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 609]
nsTableRowGroupFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 319]
nsTableRowGroupFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 267]
nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 248]
nsContainerFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 191]
nsTableFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1508]
nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 248]
nsTableOuterFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 376]
nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 248]
nsBlockFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5457]
nsBlockFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5329]
nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 248]
nsBlockFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5457]
nsBlockFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5329]
nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 248]
nsContainerFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 191]
nsHTMLContainerFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line
137]
CanvasFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 395]
PresShell::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5545]
nsView::Paint [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 275]
nsViewManager::RenderDisplayListElement
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1182]
nsViewManager::RenderViews
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1106]
nsViewManager::Refresh [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp,
line 653]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1728]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 84]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 838]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 860]
nsWindow::OnPaint [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp,
line 4216]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3173]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1103]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x24407 (0xbff94407) 

Comment 7

[Ashley Bischoff (blog at handcoding.com)]

No dupes found. Marking NEW.

Comment 8

[Olivier Cahagne]

Is this rhe right Talkback data ?
I don't crash on http://www.rbc.ru/ (with 2001111806 on Linux) and this URL is
not mentioned in the bug report. It's from comment #2 apparently.
Stephen, can you retreive TB38188180M and/or TB38185289W for comparison ?

Comment 9

[Olivier Cahagne]

CC'ing to Stephen for Talkback retreival, Stephen, can you retreive Talkback
data from above comment just to make sure the Talkback was the real one
associated to the right URL ?

Comment 10

[[e-mail] (gone - use [e-mail] instead)]

Stack Signature  nsContainerFrame::PaintChild() cf187ff7
Bug ID
Trigger Time 2001-11-18 08:53:37
Email Address [e-mail]
URL visited http://www.asus.com/products/Motherboard/award.html
User Comments Loading single window, bug
Build ID 2001111706
Product ID MozillaTrunk
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
nsContainerFrame::PaintChild()
nsBlockFrame::PaintFloaters()
nsBlockFrame::Paint()
nsContainerFrame::PaintChild()
nsBlockFrame::PaintChildren()
nsBlockFrame::Paint()
nsContainerFrame::PaintChild()
nsContainerFrame::PaintChildren()
nsTableCellFrame::Paint()
nsTableRowFrame::PaintChildren()
nsTableRowFrame::Paint()
nsTableRowGroupFrame::PaintChildren()
nsTableRowGroupFrame::Paint()
nsContainerFrame::PaintChild()
nsContainerFrame::PaintChildren()
nsTableFrame::Paint()
nsContainerFrame::PaintChild()
nsTableOuterFrame::Paint()
nsContainerFrame::PaintChild()
nsBlockFrame::PaintChildren()
nsBlockFrame::Paint()
nsContainerFrame::PaintChild()
nsBlockFrame::PaintChildren()
nsBlockFrame::Paint()
nsContainerFrame::PaintChild()
nsContainerFrame::PaintChildren()
nsHTMLContainerFrame::Paint()
CanvasFrame::Paint()
PresShell::Paint()
nsView::Paint()
nsViewManager::RenderDisplayListElement()
nsViewManager::RenderViews()
nsViewManager::Refresh()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWindow::DoPaint()
nsWindow::Update()
nsWindow::Update()
nsWindow::UpdateIdle()
libglib-1.2.so.0 + 0x11179 (0x4035b179)
libglib-1.2.so.0 + 0x101b6 (0x4035a1b6)
libglib-1.2.so.0 + 0x10781 (0x4035a781)
libglib-1.2.so.0 + 0x10921 (0x4035a921)
libgtk-1.2.so.0 + 0x8c919 (0x4027e919)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x189cb (0x4046f9cb) 

Comment 11

[[e-mail] (gone - use [e-mail] instead)]

Stacks are basically the same.

Comment 12

[Olivier Cahagne]

This URL now wfm with build 2001111806 on Linux. I guess it was fixed between
Nov. 17th and 18th.
Reporter, can you try latest nightly build ?
Build available here:
http://ftp.mozilla.org/pub/mozilla/nightly/latest/mozilla-win32-talkback.zip

So, that might explain why I don't crash on http://www.rbc.ru/ which I had not
tried with previous build. But I can't find recent bugs fixed, besides bug 110174.

Comment 13

[Itamar]

Still crashing for me:
I have nightly:
Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.6+) Gecko/20011118
TB38215432W
Crash with the floowing error
module GKLAYOUT.DLL at 0167:6035553f.
Looks like nothing has changed since original message.

Comment 14

[Olivier Cahagne]

ok, crashing too (even with a new profile) with build 2001111808 on Win2k.
If someone can test on Linux and/or MacOS... seems to be a Win32-only bug since
20011118.

Comment 15

[Boris Zbarsky [:bzbarsky]]

*** Bug 111715 has been marked as a duplicate of this bug. ***

Comment 16

[Kevin McCluskey (gone)]

WFM with 2001112903 build on WINXP.
Resolving as WFM.

Comment 17

[Jay Patel [:jay]]

Reopening for a little more investigation.  This is a topcrasher with Mozilla
0.9.6 and there have been a few crashes on the MozillaTrunk recently.  Here's
the latest info from Talkback on M096 crashes:

nsContainerFrame::PaintChild   46 
BBID range: 1974 - 399760
Min/Max Seconds since last crash: 10 - 1206633
Min/Max Runtime: 4575 - 1206676
Crash data range: 2001-12-03 to 2001-12-12
Build ID range: 2001112012 to 2001112012
Keyword List : 
Stack Trace: 

	 nsContainerFrame::PaintChild()
	 nsBlockFrame::PaintFloaters()
	 nsBlockFrame::Paint()
	 nsContainerFrame::PaintChild()
	 nsBlockFrame::PaintChildren()
	 nsBlockFrame::Paint()
	 nsContainerFrame::PaintChild()
	 nsContainerFrame::PaintChildren()
	 nsHTMLContainerFrame::Paint()
	 CanvasFrame::Paint()
	 PresShell::Paint()
	 nsView::Paint()
	 nsViewManager::RenderDisplayListElement()
	 nsViewManager::RenderViews()
	 nsViewManager::Refresh()
	 nsViewManager::DispatchEvent()
	 HandleEvent()
	 nsWidget::DispatchEvent()
	 nsWidget::DispatchWindowEvent()
	 nsWindow::DoPaint()
	 nsWindow::Update()
	 nsWindow::UpdateIdle()
	 libglib-1.2.so.0 + 0x1159a (0x4037959a)
	 libglib-1.2.so.0 + 0x10578 (0x40378578)
	 libglib-1.2.so.0 + 0x10b83 (0x40378b83)
	 libglib-1.2.so.0 + 0x10d1c (0x40378d1c)
	 libgtk-1.2.so.0 + 0x98f87 (0x4028bf87)
	 nsAppShell::Run()
	 nsAppShellService::Run()
	 main1()
	 main()
	 libc.so.6 + 0x1d65f (0x404bb65f)     (378575)	URL: www.brw.nl
(357164)
URL: www.designgraphik.com
(333433)
URL: http://www.skibanfflakelouise.com/html/vacation/hotel_rates.html
(315230)
URL: www.below-0.com
(315230)
Comments: seems to have problems with loading flashworks fine sometimes
     (303481)	URL: chimp.acm.uiuc.edu
     (303481)	Comments: the layout engine choked on the page.  again.  i wasn't sure if it
was something else  so i went back.
     (303411)	URL: www.scifihaven.com (i think)
     (285702)	URL: http://www.gamma.com
(285702)
Comments: Visited http://www.gamma.com. Mozilla 0.9.6 crashes while opening this
page...
     (274440)	URL: www.download.com
(202413)
URL: http://www.fluideglacial.tm.fr/
(177957)
URL: http://www.fluideglacial.tm.fr/pages/rubnews.htm
(177957)
Comments: opening a page in a tab
     (155660)	URL: http://www.xiva.com
(155660)
Comments: Went to xiva.com  clicked on enter  then clicked on skip intro.  A
crashresulted after a second or two.  I tried it again from a clean restart
withthe same result.
     (152210)	URL: www.xiva.com
(144362)
Comments: Browsing http://www.fuzion.co.uk/
(144332)
Comments: Browsing http://www.fuzion.co.uk/
(137037)
URL: www.ti-training.com
(114411)
URL: jang.com.pk
     (114411)	Comments: loading page    jang.com.pkand     jang-group.comand  subaru.co.uk
     (8489)	URL: iwebcenter.com
     (1974)	URL: 947nrk.com

Here are a few recent MozillaTrunk crashes too:
Incident: 204877     
Build: 2001120706   MozillaTrunk   Windows 98 4.90 build 73010104   
Date: 2001-12-08 04:38:40   
StackSig: nsContainerFrame::PaintChild 6d6a8df5   13663   13663       

Incident: 81143     
Build: 2001120506   MozillaTrunk   Windows 98 4.10 build 67766446   
DateL 2001-12-05 11:19:33   
StackSig: nsContainerFrame::PaintChild 44f4a614   1162   3577   
URL: www.paidmania.com/start/rotate           

Incident: 111987     
Build: 2001120206   MozillaTrunk   Linux 2.4.15-pre5   
Date: 2001-12-06 02:36:21   
StackSig: nsContainerFrame::PaintChild() 0aea85b3   268954   268954   
URL: www.allbay.com/cost.htm   
Comments: Going from www.google.com to www.allbay.com/cost.htm         

Incident: 165958     
Build: 2001113009   MozillaTrunk   Windows 98 4.10 build 67766446   
Date: 2001-12-07 05:43:04   
StackSig: nsContainerFrame::PaintChild 29a6cd01   72282   72282   
URL: http://www.telstra.com

Adding qawanted keyword to see if we can get this reproduced with recent
MozillaTrunk builds...since we have more user comments and urls to work with.  

Comment 18

[Itamar]

Well I guess this one was closed since the original page isn't there any more an
you get a 404 instead.
So now it is working for everybody

Comment 19

[Marc Attinasi]

I'm pretty sure these are all Flash problems. We have seen this before, but I
thought we fixed it.  When we say this before, it was easy to prevent the crash,
just remove the flash plugin. (actually, some of these URLs have Java, not flash...)

Sending to Peter since he had the prior bug related to this problem.

Comment 20

[Peter Lubczynski]

This also WFM but I'm using Windows XP like Kevin in comment #16. Shrir, can you
reproduce this on any of these URL's?

Comment 21

[shrirang khanzode]

I get a "Page cannot be found" error...hmm. Does anyone see the actual content 
of this page? I will try again.

Comment 22

[shrirang khanzode]

oh..i talked too early...I didn't try the 'other url's' ..just the primary url. 
Will comment soon.

Comment 23

[Sergey Lunegov]

I visited most of URLs mentionded in bug descriptions and comments:
WFM with CVS trunk build from 20011221 on Linux RH 7.1 for
Flash plugin 5.0 r47 and java plugin (JRE1.3.1_01)

Comment 24

[greer]

Attachment: Stack trace

Here's a simple repro case on Win2000, using trunk 2002010906:
1. Go to www.skibanfflakelouise.com
2. Click on "snow report" at the top

I'm attaching the stack from this crash. It's essentially the same as previous
stacks but (a Windows crash) with line numbers.

Maybe this will help get a fix.

Comment 25

[Jay Patel [:jay]]

This one has been around for a long time now...has anyone looked at this
recently?  We now have a repro testcase and are still getting plenty of crashes
with Mozilla 0.9.7:

nsContainerFrame::PaintChild   86
		 110650 	 NEW 	  	 [e-mail] 	 --- 	 2002-01-10 
BBID range: 1294051 - 1754277
Min/Max Seconds since last crash: 14 - 874463
Min/Max Runtime: 591 - 1579228
Crash data range: 2002-01-06 to 2002-01-16
Build ID range: 2001122108 to 2001122109
Keyword List : load(4), flash(4), back(4), 
Stack Trace: 

	 nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 211]
	 nsBlockFrame::PaintFloaters
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5409]
	 nsBlockFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5338]
	 nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 253]
	 nsBlockFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5468]
	 nsBlockFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5340]
	 nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 253]
	 nsContainerFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 196]
	 nsTableCellFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp  line 481]
	 nsTableRowFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp  line 674]
	 nsTableRowFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp  line 616]
	 nsTableRowGroupFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp 
line 329]
	 nsTableRowGroupFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp 
line 272]
	 nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 253]
	 nsContainerFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 196]
	 nsTableFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp  line 1516]
	 nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 253]
	 nsTableOuterFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp  line 374]
	 nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 253]
	 nsBlockFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5468]
	 nsBlockFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5340]
	 nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 253]
	 nsBlockFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5468]
	 nsBlockFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5340]
	 nsContainerFrame::PaintChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 253]
	 nsContainerFrame::PaintChildren
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 196]
	 nsHTMLContainerFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp  line
137]
	 CanvasFrame::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp  line 395]
	 PresShell::Paint
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 5579]
	 nsView::Paint
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 272]
	 nsViewManager::RenderDisplayListElement
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 1217]
	 nsViewManager::RenderViews
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 1141]
	 nsViewManager::Refresh
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 686]
	 nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 1763]
	 HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 83]
	 nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 850]
	 nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 872]
	 nsWindow::OnPaint
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 4229]
	 nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3186]
	 nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 1112]
	 USER32.dll + 0x3a5f (0x77d43a5f)
	 USER32.dll + 0x3b2e (0x77d43b2e)
	 USER32.dll + 0x5874 (0x77d45874)
	 USER32.dll + 0x58a4 (0x77d458a4)
	 ntdll.dll + 0x108f (0x77f5108f)
	 nsXULDocument::FlushPendingNotifications
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 2344]
	 nsContentTreeOwner::SetStatus
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsContentTreeOwner.cpp  line 359]
	 nsPluginInstanceOwner::ShowStatus
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp  line 2218]
	 nsPluginHostImpl::PostStartupMessageForType
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp  line
4252]
	 nsPluginHostImpl::SetUpPluginInstance
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp  line
3701]
	 nsPluginHostImpl::InstantiateEmbededPlugin
[d:\builds\seamonkey\mozilla\modules\plugin\base\src\nsPluginHostImpl.cpp  line
3272]
	 nsObjectFrame::InstantiatePlugin
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp  line 1280]
	 nsObjectFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp  line 1133]
	 nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp  line
567]
	 nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp  line
359]
	 nsBlockFrame::ReflowFloater
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 5100]
	 nsBlockReflowState::FlowAndPlaceFloater
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowState.cpp  line 858]
	 nsBlockReflowState::AddFloater
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowState.cpp  line 663]
	 nsLineLayout::ReflowFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp  line 1163]
	 nsBlockFrame::ReflowInlineFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 3688]
	 nsBlockFrame::DoReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 3569]
	 nsBlockFrame::DoReflowInlineFramesAuto
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 3494]
	 nsBlockFrame::ReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 3439]
	 nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp  line 2475]
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsContainerFrame.cpp
line : 211
     (1754277)	URL: http://www.houstoncellular.com
     (1754277)	Comments: Selected Menu File/Edit Page. Crashed.
     (1753689)	Comments: This is the second time today that Mozilla crashed while I was in
the Composer with 2 pages editing.  Also had a couple of pages in browse.
     (1745714)	URL: http://www.omroep.nl
     (1717400)	URL: www.snakenetmetalradio.com
     (1717400)	Comments: select the enter link
     (1716083)	URL: www.stanford.edu/~tsoman
     (1716083)	Comments: This webpage crashes mozilla consistantly
     (1705192)	Comments: Pressing the "back" button
     (1679271)	Comments: www.siccoproductionz.com
     (1679096)	Comments: http://www.sickoproductionz.com
     (1675745)	URL: news.bbc.co.uk
     (1669338)	URL: http://ceridian-benefits.com/products/fsa/fsa.shtml
     (1655948)	URL: http://plugins.myetang.com
     (1655948)	Comments: Illegal operation
     (1648209)	URL: http://www.snakenetmetalradio.com/default.asp
     (1646996)	URL: http://www.janosha.com
     (1646996)	Comments: just trying to open link
     (1646989)	URL: http://www.janosha.com
     (1646989)	Comments: just trying to open this site
     (1627881)	URL: www.audio.dk
     (1627855)	URL: www.audio.dk
     (1617117)	URL: www.pureprofile.com.au
     (1615093)	Comments: i was at a page (framed) and had been there before. Did aBACK and
the system crashed.....
     (1614682)	Comments: accessing www.matrox.com G450 section  
     (1578773)	URL: www.lonsdale.co.uk
     (1551331)	URL: www.google.com ???
     (1551331)	Comments: had multiple window tabs...looking for spongebob squarepants pictures
     (1543874)	URL: www.kul-alarab.com
     (1543874)	Comments: when click on this site the browser disappers.
     (1534888)	URL: http://cmecut.com/xcard/index.html
     (1534888)	Comments: looking at a flash animation  mozilla crashed when I clicked on
one of the flash links (I'm not sure if they're still called links when they're
in flash)
     (1516814)	URL: www.ttp.nl
     (1516814)	Comments: Going back to the main site using their back button
     (1514905)	Comments: just browsed to:
http://www.gefen.com/products/extendit/new_kvm_usb_extenders_switches/vga_to_adc/index.html
then I clicked on buy.
     (1471193)	URL: http://www.hertzmann.com/articles/2001/knives/
     (1471193)	Comments: Clicked on "Use" menu item  left frame.
     (1425811)	URL: http://www.snakenetmetalradio.com
     (1425811)	Comments: I just tried to view the site in a newly created "tab-window". The
site usually works fine.
     (1422156)	URL: http://www.tigertoys.co.uk/hitclips
     (1422156)	Comments: I visited the site. Clicked on the "Pink" square in the moving
banner at the bottom then clicked back and the browser died.Previously I had
visited www.theregister.co.uk and www.todayonly.co.uk in this browser session.
     (1420624)	URL: telstra.com
     (1420624)	Comments: clicking on join telstra.com link
     (1418916)	URL: http://usuarios.tripod.es/
     (1399841)	URL: http://www.half.com
     (1399841)	Comments: Just surfing.  I'd searched for an item at half.com  and as the
URL began to load  I got the error message
     (1391586)	Comments: Had two windows tabbed at the same address.  Doing nothing unusual
 normal links with no javascript or anything.
     (1377789)	URL: www.royal.com
     (1377789)	Comments: After manually installing the flash 5 plugin I reloaded the page.
The flash animation was running fine until I switched over to another tab
(www.freshmeat.net/my) which caused Mozilla to fall over.
     (1376818)	URL: http://www.buehnenkoeln.de
     (1376818)	Comments: mozilla crashed while loading page
     (1361374)	URL: www.equipmentpipeline.com
     (1361374)	Comments: Just installed flash player and mozilla crashed upon hitting the page
     (1355260)	URL: http://csradio.counter-strike.net
     (1355260)	Comments: was loading flash and then decided to skip right onto site..
     (1294051)	URL: http://pcunix.com/Reviews/mozilla.html

Comment 26

[Peter Lubczynski]

Still WFM on W2K....

Comment 27

[greer]

Just crashed the Windows M098 build (2002020409 on WinNT Server) using steps in 
comment #24 (except it took a couple of clicks, not just one). Got the stack in 
comment #6. Incident #2521012.

Comment 28

[Peter Lubczynski]

perhaps I need an optimized build to see this? Links still WFM on WinXP on my
debug build.

Comment 29

[greer]

Peter, yes, try the optimized build. 
I just crashed a Win2K box with the steps I listed in #24 (actually, I got the 
report, but clicked again and crashed). The incident ID is 2690867, from a full 
download of 2002020610 off of the mozilla site. 

Comment 30

[serge (gone)]

*** Bug 125021 has been marked as a duplicate of this bug. ***

Comment 31

[serge (gone)]

Peter, this here is the url to reproduce from bug 125021 
http://www.below-0.com

Comment 32

[Peter Lubczynski]

*** Bug 123246 has been marked as a duplicate of this bug. ***

Comment 33

[Peter Lubczynski]

Serge,

I don't see this on Windows, but I DO see it on Linux with or without Flash and
the default plugin installed. See: http://islecorp.com/

Comment 34

[Peter Lubczynski]

*** Bug 124018 has been marked as a duplicate of this bug. ***

Comment 35

[Andrew Schultz]

Attachment: minimal testcase

this is a testcase from bug #123246

Offending html is:
<object align="left" width=100%>
</object>

align and width attributes by themselves work.	align=center works, but
align=(left|right) do not work.  crash occurs regardless of width specification

(less than 100%, or specified in pixels, it still crashes)

Comment 36

[serge (gone)]

Comment on attachment 69184 [details]
minimal testcase

changed mimetype to text/html

Comment 37

[serge (gone)]

Comment on attachment 69184 [details]
minimal testcase

second try

Comment 38

[serge (gone)]

my linux debug build 20020208 work fine on http://islecorp.com/
 

Comment 39

[Andrew Schultz]

serge: it only crashes on optimized builds (or perhaps non-DEBUG).

for the minimal testcase, the problem is that aFrame is null, so it crashes at
nsContainerFrame.cpp:211
In the calling routine (nsBlockFrame::PaintFloaters),
   nsIFrame *floater = fc->mPlaceholder-GetOutOfFlowFrame   (line 5452)
is null

Comment 40

[shrirang khanzode]

confirmed..I could crash on loading this testcase on linux (0212) :
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=69184

Comment 41

[serge (gone)]

Thanks. I got a crash linux optimized 2002021308 build on attachment 69184 [details]
TBID 2866960

Comment 42

[Shiva Thirumazhusai]

nominating for nsbeta1. Since it is a topcrash and has reproducible steps to crash.

Comment 43

[Andrew Schultz]

The -DDEBUG compile flag seems to "fix" this bug.  If you take a standard debug
build, and disable the MOZ_DEBUG_ENABLE_DEFS setting in config/autoconf.mk
-------------------------------
- MOZ_DEBUG_ENABLE_DEFS         = -DDEBUG -D_DEBUG -DDEBUG_andrew -DTRACING
+ MOZ_DEBUG_ENABLE_DEFS         = 
-------------------------------

you can get a build with symbols that still exhibits this bug.

Comment 44

[Olav Vitters]

*** Bug 122171 has been marked as a duplicate of this bug. ***

Comment 45

[Peter Lubczynski]

Attachment: 1-line patch, null ptr check to fix crash

Thanks for the help Andrew!

Here's a 1-line protective patch to stop the crash. I think the root cause may
be related to another bug about missing floaters while paiting. Please review.

Comment 46

[Kevin McCluskey (gone)]

Comment on attachment 71585 [details] [diff] [review]
1-line patch, null ptr check to fix crash

We should try and understand why it's passing a null pointer here, but it is
fine to add some defensive code as you have done but please add an ASSERT.

r=[e-mail]

Comment 47

[Patrick C. Beard]

Comment on attachment 71585 [details] [diff] [review]
1-line patch, null ptr check to fix crash

consistency nit,

if (!aFrame) return;

vs.

if (nsnull == pView) {

I prefer the former.

sr=beard

Comment 48

[chris hofmann]

a=chofmann for 0.9.9 

Comment 49

[Peter Lubczynski]

patch in trunk, marking FIXED

Comment 50

[serge (gone)]

*** Bug 113214 has been marked as a duplicate of this bug. ***

Comment 51

[shrirang khanzode]

testcase (id 69184) does not crash anymore. verified on 0304 trunk build.

Comment 52

[Vadim Berezniker]

*** Bug 127204 has been marked as a duplicate of this bug. ***

Comment 53

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/54417ebbaea2