118142 - [RR]Composer crashes when trying to show preview

Status: VERIFIED DUPLICATE of bug 141054

(Core :: CSS Parsing and Computation, defect)

Description

[Dariusz J. Garbowski]

From Bugzilla Helper:
User-Agent: Mozilla/4.75 [en] (Windows NT 5.0; U)
BuildID:    2002010303

Composer crashes after:
grabbing web page (719KB) into Composer -> editing htm source -> trying to show 
preview (crash!)


Reproducible: Always
Steps to Reproduce:
1.Go to http://www.scan.co.uk/allprice.htm
2.Click right mouse button and choose "Edit Page in Composer" (be patient now - 
Mozilla looks frozen for quite a long time, even on Pentium 4/1.5 GHz... CPU 
load is 100%). Composer launches in "Normal" mode.
3.Click on "HTML Source" tab at the bottom of the window. Again, be patient, 
Mozilla is frozen for much longer time... Source appears.
4.Scroll down and find line (or similar one):

</a><a name="#35"></a>

Find/Replace in the Edit menu is grayed (why?) - you have to do it manually.
5.Cut the "#" symbol, so the line looks like:

</a><a name="35"></a>

6.Click "Preview" tab at the bootom part of the window.
7.Wait...

Actual Results:  Mozilla crashes - "Program error" dialog appears ("mozilla.exe 
has generated errors and will be closed by Windows (...blahblah...)"


This html is different in original - Composer adds "" around names in
<a name=blah>. I know, the html source is probably not valid (should be without 
"#" signs after "name="). That's why I wanted to check it changing page source 
in Composer...

Comment 1

[Dariusz J. Garbowski]

Attachment: simple test case

Ok, I did some investigation and extracted problem to the simplest test case I 

could. Steps to reproduce are exactly the same, but remove # before numer 1,
not 
35 ;-)

Comment 2

[Dariusz J. Garbowski]

Sorry for spam... I forgot to add comment, that it seems this has something to 
do with style sheets - without it, everything works fine.

Comment 3

[Syd Logan]

--> daniel

Comment 4

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

Stack trace, two related assertions occur right before crash.

ns_if_addref(nsIPresContext * 0x00000001) line 122 + 9 bytes
nsRuleNode::GetPresContext(nsIPresContext * * 0x0012bb48) line 581 + 19 bytes
nsStyleContext::Destroy() line 1289 + 35 bytes
nsStyleContext::Release(nsStyleContext * const 0x0393afbc) line 190 + 134 bytes
nsStyleContext::~nsStyleContext() line 178 + 18 bytes
nsStyleContext::`scalar deleting destructor'(unsigned int 0x00000000) + 15 bytes
nsStyleContext::Destroy() line 1296
nsStyleContext::Release(nsStyleContext * const 0x03a1f130) line 190 + 134 bytes
nsStyleContext::~nsStyleContext() line 178 + 18 bytes
nsStyleContext::`scalar deleting destructor'(unsigned int 0x00000000) + 15 bytes
nsStyleContext::Destroy() line 1296
nsStyleContext::Release(nsStyleContext * const 0x038ad728) line 190 + 134 bytes
nsStyleContext::~nsStyleContext() line 178 + 18 bytes
nsStyleContext::`scalar deleting destructor'(unsigned int 0x00000000) + 15 bytes
nsStyleContext::Destroy() line 1296
nsStyleContext::Release(nsStyleContext * const 0x038adc40) line 190 + 134 bytes
nsStyleContext::~nsStyleContext() line 178 + 18 bytes
nsStyleContext::`scalar deleting destructor'(unsigned int 0x00000000) + 15 bytes
nsStyleContext::Destroy() line 1296
nsStyleContext::Release(nsStyleContext * const 0x038adbd8) line 190 + 134 bytes
FrameManager::ReResolveStyleContext(nsIPresContext * 0x038a33c8, nsIFrame * 
0x0393a6c8, nsIStyleContext * 0x038adb70, nsIContent * 0x03a6c868, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000005, int & 0x00000000) line 1799 + 12 bytes
FrameManager::ReResolveStyleContext(nsIPresContext * 0x038a33c8, nsIFrame * 
0x0393add0, nsIStyleContext * 0x038b30fc, nsIContent * 0x03913c80, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000005, int & 0x00000005) line 1932
FrameManager::ReResolveStyleContext(nsIPresContext * 0x038a33c8, nsIFrame * 
0x0393a410, nsIStyleContext * 0x038ad6f4, nsIContent * 0x0373f868, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1932
FrameManager::ReResolveStyleContext(nsIPresContext * 0x038a33c8, nsIFrame * 
0x0393a104, nsIStyleContext * 0x0393ad4c, nsIContent * 0x0373f868, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1932
FrameManager::ReResolveStyleContext(nsIPresContext * 0x038a33c8, nsIFrame * 
0x038b3204, nsIStyleContext * 0x0393ae08, nsIContent * 0x0373f868, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1932
FrameManager::ReResolveStyleContext(nsIPresContext * 0x038a33c8, nsIFrame * 
0x038b3564, nsIStyleContext * 0x0393a694, nsIContent * 0x0373f868, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1932
FrameManager::ReResolveStyleContext(nsIPresContext * 0x038a33c8, nsIFrame * 
0x038b330c, nsIStyleContext * 0x03a1f270, nsIContent * 0x00000000, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1932
FrameManager::ReResolveStyleContext(nsIPresContext * 0x038a33c8, nsIFrame * 
0x038b31c8, nsIStyleContext * 0x00000000, nsIContent * 0x00000000, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1932
FrameManager::ComputeStyleChangeFor(FrameManager * const 0x039c76c8, 
nsIPresContext * 0x038a33c8, nsIFrame * 0x038b31c8, int 0xffffffff, nsIAtom * 
0x00000000 {???}, nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) 
line 2191
PresShell::ReconstructStyleData(PresShell * const 0x039c14b0, int 0x00000000) 
line 5341
PresShell::StyleSheetAdded(PresShell * const 0x039c14b8, nsIDocument * 
0x038d5b20, nsIStyleSheet * 0x038bb1d0) line 5359
nsDocument::InsertStyleSheetAt(nsDocument * const 0x038d5b20, nsIStyleSheet * 
0x038bb1d0, int 0x00000000, int 0x00000001) line 1417
CSSLoaderImpl::InsertSheetInDoc(nsICSSStyleSheet * 0x038bb1d0, int 0x00000004, 
nsIContent * 0x03a6e2f0, int 0x00000001, nsICSSLoaderObserver * 0x00000000) 
line 1196
InsertPendingSheet(void * 0x038f8930, void * 0x03397320) line 762
nsVoidArray::EnumerateForwards(int (void *, void *)* 0x022b50c0 
InsertPendingSheet(void *, void *), void * 0x03397320) line 660 + 21 bytes
CSSLoaderImpl::Cleanup(URLKey & {...}, SheetLoadData * 0x03900cc8) line 826
CSSLoaderImpl::SheetComplete(nsICSSStyleSheet * 0x00000000, SheetLoadData * 
0x03900cc8) line 919
CSSLoaderImpl::ParseSheet(nsIUnicharInputStream * 0x039a7140, SheetLoadData * 
0x03900cc8, int & 0x00000001, nsICSSStyleSheet * & 0x038bb1d0) line 954
CSSLoaderImpl::LoadInlineStyle(CSSLoaderImpl * const 0x03397320, nsIContent * 
0x03a6e2f0, nsIUnicharInputStream * 0x039a7140, const nsString & {""}, const 
nsString & {""}, int 0xffffffff, int 0x00000004, nsIParser * 0x00000000, int & 
0x00000001, nsICSSLoaderObserver * 0x00000000) line 1384 + 24 bytes
nsHTMLStyleElement::UpdateStyleSheet(nsHTMLStyleElement * const 0x03a6e320, int 
0x00000001, nsIDocument * 0x00000000, int 0xffffffff) line 293 + 95 bytes
nsHTMLStyleElement::SetDocument(nsHTMLStyleElement * const 0x03a6e2f0, 
nsIDocument * 0x038d5b20, int 0x00000001, int 0x00000001) line 307
nsGenericHTMLContainerElement::InsertChildAt(nsGenericHTMLContainerElement * 
const 0x0373f960, nsIContent * 0x03a6e2f0, int 0x00000003, int 0x00000001, int 
0x00000001) line 3842
nsGenericElement::doInsertBefore(nsIDOMNode * 0x03a6e318, nsIDOMNode * 
0x00000000, nsIDOMNode * * 0x0012cd64) line 2290 + 35 bytes
nsGenericHTMLContainerElement::InsertBefore(nsGenericHTMLContainerElement * 
const 0x0373f960, nsIDOMNode * 0x03a6e318, nsIDOMNode * 0x00000000, nsIDOMNode 
* * 0x0012cd64) line 543
nsHTMLHeadElement::InsertBefore(nsHTMLHeadElement * const 0x0373f988, 
nsIDOMNode * 0x03a6e318, nsIDOMNode * 0x00000000, nsIDOMNode * * 0x0012cd64) 
line 60 + 27 bytes
InsertElementTxn::DoTransaction(InsertElementTxn * const 0x03973d00) line 114 + 
80 bytes
nsTransactionItem::DoTransaction() line 181 + 18 bytes
nsTransactionManager::BeginTransaction(nsITransaction * 0x03973d00) line 1076 + 
11 bytes
nsTransactionManager::DoTransaction(nsTransactionManager * const 0x038dc0b8, 
nsITransaction * 0x03973d00) line 137 + 18 bytes
nsEditor::Do(nsEditor * const 0x0389fd30, nsITransaction * 0x03973d00) line 492 
+ 30 bytes
nsEditor::InsertNode(nsEditor * const 0x0389fd30, nsIDOMNode * 0x03a6e318, 
nsIDOMNode * 0x0373f988, int 0x00000003) line 1149 + 16 bytes
nsHTMLEditor::ReplaceHeadContentsWithHTML(nsHTMLEditor * const 0x0389fdfc, 
const nsAString & {???}) line 1646 + 70 bytes
nsHTMLEditor::RebuildDocumentFromSource(nsHTMLEditor * const 0x0389fdfc, const 
nsAString & {???}) line 1708 + 42 bytes
nsEditorShell::RebuildDocumentFromSource(nsEditorShell * const 0x0382aad8, 
const unsigned short * 0x039de028) line 2365 + 42 bytes
XPTC_InvokeByIndex(nsISupports * 0x0382aad8, unsigned int 0x00000036, unsigned 
int 0x00000001, nsXPTCVariant * 0x0012d508) line 106
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode 
CALL_METHOD) line 1998 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x0112a7e8, JSObject * 0x03190218, unsigned int 
0x00000001, long * 0x039d80ec, long * 0x0012d7e4) line 1266 + 14 bytes
js_Invoke(JSContext * 0x0112a7e8, unsigned int 0x00000001, unsigned int 
0x00000000) line 832 + 23 bytes
js_Interpret(JSContext * 0x0112a7e8, long * 0x0012e5d4) line 2802 + 15 bytes
js_Invoke(JSContext * 0x0112a7e8, unsigned int 0x00000001, unsigned int 
0x00000002) line 849 + 13 bytes
js_InternalInvoke(JSContext * 0x0112a7e8, JSObject * 0x030a1c80, long 
0x032afd38, unsigned int 0x00000000, unsigned int 0x00000001, long * 
0x0012e82c, long * 0x0012e6fc) line 924 + 20 bytes
JS_CallFunctionValue(JSContext * 0x0112a7e8, JSObject * 0x030a1c80, long 
0x032afd38, unsigned int 0x00000001, long * 0x0012e82c, long * 0x0012e6fc) line 
3405 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x0114a438, void * 
0x030a1c80, void * 0x032afd38, unsigned int 0x00000001, void * 0x0012e82c, int 
* 0x0012e830, int 0x00000000) line 1016 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x033c0d38, 
nsIDOMEvent * 0x03a00610) line 180 + 77 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x033c0df8, 
nsIDOMEvent * 0x03a00610, nsIDOMEventTarget * 0x0313be78, unsigned int 
0x00000008, unsigned int 0x00000007) line 1205 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x033c0cd0, 
nsIPresContext * 0x020aa160, nsEvent * 0x0012f33c, nsIDOMEvent * * 0x0012f1f0, 
nsIDOMEventTarget * 0x0313be78, unsigned int 0x00000007, nsEventStatus * 
0x0012f384) line 2195 + 36 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0313be70, nsIPresContext * 
0x020aa160, nsEvent * 0x0012f33c, nsIDOMEvent * * 0x0012f1f0, unsigned int 
0x00000001, nsEventStatus * 0x0012f384) line 3383
PresShell::HandleDOMEventWithTarget(PresShell * const 0x020ab118, nsIContent * 
0x0313be70, nsEvent * 0x0012f33c, nsEventStatus * 0x0012f384) line 6033 + 36 
bytes
nsButtonBoxFrame::MouseClicked(nsIPresContext * 0x020aa160, nsGUIEvent * 
0x0012f530) line 195
nsButtonBoxFrame::HandleEvent(nsButtonBoxFrame * const 0x03750cbc, 
nsIPresContext * 0x020aa160, nsGUIEvent * 0x0012f530, nsEventStatus * 
0x0012f820) line 142
PresShell::HandleEventInternal(nsEvent * 0x0012f530, nsIView * 0x00000000, 
unsigned int 0x00000001, nsEventStatus * 0x0012f820) line 6001 + 38 bytes
PresShell::HandleEventWithTarget(PresShell * const 0x020ab118, nsEvent * 
0x0012f530, nsIFrame * 0x03750cbc, nsIContent * 0x0313be70, unsigned int 
0x00000001, nsEventStatus * 0x0012f820) line 5955 + 22 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const 
0x03268408, nsIPresContext * 0x020aa160, nsMouseEvent * 0x0012f924, 
nsEventStatus * 0x0012f820) line 2463 + 63 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x03268410, 
nsIPresContext * 0x020aa160, nsEvent * 0x0012f924, nsIFrame * 0x03750cbc, 
nsEventStatus * 0x0012f820, nsIView * 0x020aac90) line 1544 + 28 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f924, nsIView * 0x020aac90, 
unsigned int 0x00000001, nsEventStatus * 0x0012f820) line 6006 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x020ab11c, nsIView * 0x020aac90, 
nsGUIEvent * 0x0012f924, nsEventStatus * 0x0012f820, int 0x00000001, int & 
0x00000001) line 5909 + 25 bytes
nsView::HandleEvent(nsView * const 0x020aac90, nsGUIEvent * 0x0012f924, 
unsigned int 0x00000000, nsEventStatus * 0x0012f820, int 0x00000001, int & 
0x00000001) line 390
nsViewManager::DispatchEvent(nsViewManager * const 0x020aaa50, nsGUIEvent * 
0x0012f924, nsEventStatus * 0x0012f820) line 1900
HandleEvent(nsGUIEvent * 0x0012f924) line 83
nsWindow::DispatchEvent(nsWindow * const 0x020aad2c, nsGUIEvent * 0x0012f924, 
nsEventStatus & nsEventStatus_eIgnore) line 850 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f924) line 871
nsWindow::DispatchMouseEvent(unsigned int 0x0000012d, unsigned int 0x00000000, 
nsPoint * 0x00000000) line 4535 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 0x0000012d, unsigned int 
0x00000000, nsPoint * 0x00000000) line 4787
nsWindow::ProcessMessage(unsigned int 0x00000202, unsigned int 0x00000000, long 
0x029100a6, long * 0x0012fd20) line 3429 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x00710258, unsigned int 0x00000202, unsigned int 
0x00000000, long 0x029100a6) line 1115 + 27 bytes
USER32! 77e03eb0()
USER32! 77e0401a()
USER32! 77e092da()
nsAppShellService::Run(nsAppShellService * const 0x01119a38) line 308
main1(int 0x00000005, char * * 0x003c6fe8, nsISupports * 0x00000000) line 1285 
+ 32 bytes
main(int 0x00000005, char * * 0x003c6fe8) line 1625 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e77903()

Comment 5

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

RuleNode/StyleContext bug ; changing Component;
Cc:ing Pierre Saslawsky, David Hyatt, David Baron.

Comment 6

[Kathleen :Brade]

related to bug 125797?

Comment 7

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

this bug is not in editor:core but in Layout and Style System
reassigning to David Baron for triage

Comment 8

[Syd Logan]

Preview mode, html editing, content not generated/created originally by
composer. EDITORBASE- as a result.

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I can reproduce this reliably in a build without my changes from bug 141054, but
I can't reproduce this in a build with them.  That said, I can't get a good
stack from gdb, and I can't reproduce it on Windows, so I'm not 100% certain
it's those changes, but it certainly seems like what those would fix.

*** This bug has been marked as a duplicate of 141054 ***

Comment 10

[Dariusz J. Garbowski]

Mozilla 1.0 Release Candidate 3
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc3) Gecko/20020523

Well... since the time I reported this bug, "Edit Page in Composer" dissapeared
from context menu, so I changed this step to "File|Open File" from menu.

Seems it's working in 1.0rc3 :)

Comment 11

[sujay]

verified.