114675 - Tinderbox crashes

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Mike Pinkerton (not reading bugmail)]

- build from 12/11/01, macosx debug

go to tinderbox page. crash
http://tinderbox.mozilla.org/showbuilds.cgi?tree=SeaMonkey&hours=5&nocrap=1

Thread 0:
 #0   0x0069af98 in PL_DHashTableOperate
 #1   0x04cf27d0 in 0x4cf27d0
 #2   0x03abe124 in FrameManager::NotifyDestroyingFrame(nsIFrame *)
 #3   0x038f7ef0 in PresShell::NotifyDestroyingFrame(nsIFrame *)
 #4   0x038c5c18 in nsFrame::Destroy(nsIPresContext *)
 #5   0x03a06500 in nsLineBox::DeleteLineList(nsIPresContext *, nsLineList &)
 #6   0x039b3574 in nsBlockFrame::Destroy(nsIPresContext *)
 #7   0x03a7334c in nsFrameList::DestroyFrame(nsIPresContext *, nsIFrame *)
 #8   0x03b69640 in RemoveFrame__11CanvasFrameFP14nsIPresContextR12nsIPresShellP7n
 #9   0x03abdd08 in RemoveFrame__12FrameManagerFP14nsIPresContextR12nsIPresShellP8
 #10  0x03a4765c in ReconstructDocElementHierarchy__2
 #11  0x02fd73ec in ReconstructDocElementHierarchy__12StyleSetImplFP14nsIPresConte
 #12  0x03907168 in PresShell::ReconstructFrames(void)
 #13  0x039071f8 in PresShell::StyleSheetAdded(nsIDocument *, nsIStyleSheet *)
 #14  0x02fbb2c4 in nsDocument::InsertStyleSheetAt(nsIStyleSheet *, int, int)
 #15  0x032697bc in InsertSheetInDoc__13CSSLoaderImplFP16nsICSSStyleSheetiP10nsICo
 #16  0x03267d54 in SheetComplete__13CSSLoaderImplFP16nsICSSStyleSheetP13SheetLoad
 #17  0x0326827c in ParseSheet__13CSSLoaderImplFP21nsIUnicharInputStreamP13SheetLo
 #18  0x0326abd0 in LoadInlineStyle__13CSSLoaderImplFP10nsIContentP21nsIUnicharInp
 #19  0x02ff507c in HTMLContentSink::ProcessSTYLETag(nsIParserNode const &)
 #20  0x02fe9ab4 in HTMLContentSink::AddLeaf(nsIParserNode const &)
 #21  0x029846bc in CNavDTD::AddLeaf(nsIParserNode const *)
 #22  0x0298487c in CNavDTD::AddHeadLeaf(nsIParserNode *)
 #23  0x0297f87c in CNavDTD::HandleStartToken(CToken *)
 #24  0x0297d21c in CNavDTD::HandleToken(CToken *, nsIParser *)
 #25  0x0297bba8 in BuildModel__7CNavDTDFP9nsIParserP12nsITokenizerP16nsITokenObse
 #26  0x029ac1b0 in nsParser::BuildModel(void)
 #27  0x029abe2c in nsParser::ResumeParse(int, int)
 #28  0x029af5a8 in OnDataAvailable__8nsParserFP10nsIRequestP11nsISupportsP14nsIIn
 #29  0x02dd8764 in OnDataAvailable__18nsDocumentOpenInfoFP10nsIRequestP11nsISuppo
 #30  0x02d04d2c in OnDataAvailable__19nsStreamListenerTeeFP10nsIRequestP11nsISupp
 #31  0x02d25254 in OnDataAvailable__13nsHttpChannelFP10nsIRequestP11nsISupportsP1
 #32  0x02cf639c in nsOnDataAvailableEvent::HandleEvent(void)
 #33  0x02d0d7e0 in nsARequestObserverEvent::HandlePLEvent(PLEvent *)
 #34  0x006700c8 in PL_HandleEvent
 #35  0x0066fe60 in PL_ProcessPendingEvents
 #36  0x005f31cc in nsEventQueueImpl::ProcessPendingEvents(void)
 #37  0x02a68688 in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void)
 #38  0x02a68058 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &)
 #39  0x00facbb0 in Repeater::DoRepeaters(EventRecord const &)
 #40  0x02a818b4 in nsMacMessagePump::DispatchEvent(int, EventRecord *)
 #41  0x02a813f8 in nsMacMessagePump::DoMessagePump(void)
 #42  0x02a80b80 in nsAppShell::Run(void)
 #43  0x02a109b8 in nsAppShellService::Run(void)
 #44  0x004e3f88 in main1(int, char **, nsISupports *)
 #45  0x004e6644 in main

Comment 1

[Mike Pinkerton (not reading bugmail)]

I also crash with this same stack at www.cnn.com. note this is a different stack
than the other "crashes at cnn.com" bug filed today.

Comment 2

[Mike Pinkerton (not reading bugmail)]

this also crashes on os9

Comment 3

[Mike Pinkerton (not reading bugmail)]

ok, well, it's crashing in code that is #ifdef DEBUG. so i guess it's not really
a smoketest blocker, but it's a blocker for anyone doing development. isn't that
as good as a smoketest blocker?

Comment 4

[Kathleen :Brade]

I think it's still a blocker...

Comment 5

[Radha on family leave (not reading bugmail)]

I think it is a blocker. 

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

That |#ifdef DEBUG| code in NotifyDestroyingFrame was something I checked in
yesterday.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Does this (which I meant to check in in the first place -- not sure how I lost
the change) fix it?



Index: nsFrameManager.cpp
===================================================================
RCS file: /cvsroot/mozilla/layout/html/base/src/nsFrameManager.cpp,v
retrieving revision 1.97
diff -u -d -r1.97 nsFrameManager.cpp
--- nsFrameManager.cpp	11 Dec 2001 05:41:42 -0000	1.97
+++ nsFrameManager.cpp	11 Dec 2001 19:11:16 -0000
@@ -974,13 +981,15 @@
   RemoveAllPropertiesFor(presContext, aFrame);
 
 #ifdef DEBUG
-  nsCOMPtr<nsIContent> content;
-  aFrame->GetContent(getter_AddRefs(content));
-  PrimaryFrameMapEntry *entry = NS_STATIC_CAST(PrimaryFrameMapEntry*,
-      PL_DHashTableOperate(&mPrimaryFrameMap, content, PL_DHASH_LOOKUP));
-  NS_ASSERTION(!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame,
-               "frame was not removed from primary frame map before"
-               "destruction or was readded to map after being removed");
+  if (mPrimaryFrameMap.ops) {
+    nsCOMPtr<nsIContent> content;
+    aFrame->GetContent(getter_AddRefs(content));
+    PrimaryFrameMapEntry *entry = NS_STATIC_CAST(PrimaryFrameMapEntry*,
+        PL_DHashTableOperate(&mPrimaryFrameMap, content, PL_DHASH_LOOKUP));
+    NS_ASSERTION(!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame,
+                 "frame was not removed from primary frame map before"
+                 "destruction or was readded to map after being removed");
+  }
 #endif
 
   return NS_OK;

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Checked in.  I'm pretty sure it would cause exactly this, which is why I had the
change in my Windows tree with a debug build, but I checked in from the wrong
tree.  But I'd appreciate if someone could test that it really fixes this
problem since I don't have a current debug build anymore.

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Pinkerton confirms that it fixed the problem.

Comment 10

[Tracy Walker [:tracy]]

verified per last comments