117777 - [viewpoint] Crash in layout when loading a ViewPoint test case

Status: RESOLVED DUPLICATE of bug 116232

(Core :: Layout, defect)

Description

[av (gone)]

Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:0.9.6+) Gecko/20011218

1. install the ViewPoint plugin (see 
http://cole.viewpoint.com/~aberger/readme.txt for instructions)
2. go to the page
3. crash

This is the trunk only bug. It is not seen on 0.9.4 branch. There is another 
crash on this page in the plugin code which is seen on the branch (bug 116232) 
and is obvioudly present on the trunk but this bug blocks me from fixing it on 
the trunk, because it crashes in the layout code before we get to loading the 
plugin.

Here is the stack trace when we crash:
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=62452

Comment 1

[av (gone)]

Setting dependency.

Comment 2

[Peter Lubczynski]

No, you don't even need to install the plugin. I see the crash without the
plugin installed, but only on the trunk!

Here's the output from the console (notice the asserts):
0[442ae0]: WARNING: notification callbacks should provide nsIAuthPrompt, file
c:\builds\vacation\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 1567
WARNING: notification callbacks should provide nsIAuthPrompt, file
c:\builds\vacation\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 1567
0[442ae0]: nsPluginHostImpl::InstatiateEmbededPlugin Begin
mime=application/x-mtx, owner=3239a40,
url=http://cole.viewpoint.com/~ddavies/interactor1/index.html
0[442ae0]: nsPluginHostImpl::SetupPluginInstance Begin mime=application/x-mtx,
owner=3239a40, url=http://cole.viewpoint.com/~ddavies/interactor1/index.html
0[442ae0]: nsPluginHostImpl::GetPluginFactory End mime=application/x-mtx,
rv=-2147467259, plugin=0 name=(not found)
0[442ae0]: nsPluginHostImpl::GetPluginFactory Begin mime=*,
plugin=c:\builds\vacation\mozilla\dist\win32_d.obj\bin\plugins\npnul32.dll
For * found plugin
c:\builds\vacation\mozilla\dist\win32_d.obj\bin\plugins\npnul32.dll
0[442ae0]: NPN callbacks initialized
0[442ae0]: ns4xPluginInstance ctor: this=323a1b0
0[442ae0]: ns4xPluginInstance::Initialize this=323a1b0
0[442ae0]: ###!!! ASSERTION: Bad tag enum passed to
CNavDTD::IntTagToStringTag()!!: 'str_ptr', file
c:\builds\vacation\mozilla\htmlparser\src\CNavDTD.cpp, line 2550
###!!! ASSERTION: Bad tag enum passed to CNavDTD::IntTagToStringTag()!!:
'str_ptr', file c:\builds\vacation\mozilla\htmlparser\src\CNavDTD.cpp, line 2550
0[442ae0]: ###!!! ASSERTION: nsDependentString must wrap a non-NULL buffer:
'aPtr', file ..\..\dist/include/string\nsDependentString.h, line 54
###!!! ASSERTION: nsDependentString must wrap a non-NULL buffer: 'aPtr', file
..\..\dist/include/string\nsDependentString.h, line 54
0[442ae0]: ns4xPluginInstance::Stop this=323a1b0
0[442ae0]: nsPluginHostImpl::StopPluginInstance called instance=323a1b0
0[442ae0]: NPP New called: this=323a1b0, npp=323a1c8, mime=application/x-mtx,
mode=1, argc=15, return=0
0[442ae0]: ns4xPluginInstance::Start this=323a1b0
0[442ae0]: nsPluginHostImpl::InstatiateEmbededPlugin Finished
mime=application/x-mtx, rv=0, owner=3239a40,
url=http://cole.viewpoint.com/~ddavies/interactor1/index.html

Comment 3

[Peter Lubczynski]

Ahh, I think this may indeed be a dup of bug 116232. The first ASSERTION goes
through the code path Ari mentions in nsHTMLDocument::FlushPendingNotification
and an nsHTMLUnknownElement is the tag being flushed.

I've leaving this open until I know for sure.

Comment 4

[av (gone)]

Why this nomination? It does not happen on the branch.

Comment 5

[Peter Lubczynski]

The crash is fixed by the new patch in bug 116232.

Some ASSERTIONS remain because it looks like there is some invlaid content
trying to be inserted. In any case, I don't crash with the new patch.

*** This bug has been marked as a duplicate of 116232 ***

Comment 6

[Judson Valeski]

minusing. this is a dupe of an edt0.9.4 bug.