Closed Bug 1252 Opened 26 years ago Closed 25 years ago

[CRASH]Crash in initial layout of empty framesets

Categories

(Core :: Layout: Images, Video, and HTML Frames, defect, P1)

Product:
Core
Component:
Layout: Images, Video, and HTML Frames
Platform:
All
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: morse, Assigned: karnaze)

References

(
URL
)

Details

(Whiteboard: fixed long ago but has since regressed - 06/01/99)

Bringing up the browswer on a page containing the following html results in a gp-trap: <HTML> <HEAD> <TITLE>Cookies</TITLE> <SCRIPT> function loadButtons(){ top.frames[0].document.open(); top.frames[0].document.close(); } </SCRIPT> </HEAD> <FRAMESET onLoad=loadButtons()> <FRAME> <FRAME> </FRAMESET> </HTML> If the document.open and document.close is commented out, the trap doesn't occur. This is blocking a lot of other implementation work from happening. The stack trace at the time of the trap is as follows: GlobalWindowImpl::GetDocument(GlobalWindowImpl * const 0x01340128, nsIDOMDocument * * 0x00129e40) line 269 + 13 bytes GetWindowProperty(JSContext * 0x01310670, JSObject * 0x018a5a60, long 0xfffffffb, long * 0x0012a2c4) line 149 + 16 bytes js_GetProperty(JSContext * 0x01310670, JSObject * 0x018a5a60, long 0x01318a10, long * 0x0012a2c4) line 1623 + 25 bytes js_Interpret(JSContext * 0x01310670, long * 0x0012a41c) line 2153 + 801 bytes js_Invoke(JSContext * 0x01310670, unsigned int 0x00000000, int 0x00000000) line 657 + 13 bytes js_Interpret(JSContext * 0x01310670, long * 0x0012a974) line 2187 + 15 bytes js_Invoke(JSContext * 0x01310670, unsigned int 0x00000001, int 0x00000000) line 657 + 13 bytes js_CallFunctionValue(JSContext * 0x01310670, JSObject * 0x018a4210, long 0x018a5608, unsigned int 0x00000001, long * 0x0012aabc, long * 0x0012aac4) line 726 + 15 bytes JS_CallFunctionValue(JSContext * 0x01310670, JSObject * 0x018a4210, long 0x018a5608, unsigned int 0x00000001, long * 0x0012aabc, long * 0x0012aac4) line 2336 + 29 bytes nsJSEventListener::ProcessEvent(nsIDOMEvent * 0x01336c60) line 97 + 34 bytes nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012ac18, nsIDOMEvent * * 0x0012ab8c, nsEventStatus & nsEventStatus_eIgnore) line 491 + 17 bytes GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x013154e4, nsIPresContext & {...}, nsEvent * 0x0012ac18, nsIDOMEvent * * 0x0012ab8c, unsigned int 0x00000001, nsEventStatus & nsEventStatus_eIgnore) line 1724 nsWebShell::OnConnectionsComplete(nsWebShell * const 0x012856f0) line 1655 + 34 bytes nsDocLoaderImpl::LoadURLComplete(nsIURL * 0x013032c0, nsISupports * 0x013031b0, int 0x00000000) line 966 nsDocumentBindInfo::OnStopBinding(nsDocumentBindInfo * const 0x013031b0, nsIURL * 0x013032c0, int 0x00000000, const nsString & {...}) line 1416 OnStopBindingProxyEvent::HandleEvent(OnStopBindingProxyEvent * const 0x0130b280) line 538 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x0130b284) line 421 + 12 bytes PL_HandleEvent(PLEvent * 0x0130b284) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x01235f60) line 357 + 9 bytes _md_EventReceiverProc(void * 0x01270110, unsigned int 0x0000c084, unsigned int 0x00000000, long 0x01235f60) line 675 + 9 bytes USER32! 77e71250() 01235f60()
Status: NEW → ASSIGNED
Summary: javascript and frames: document.open causes gp-trap → js doc object needs to be reflected before doc load
*** Bug 1098 has been marked as a duplicate of this bug. ***
Updating summary
Setting all current Open Critical and Major to M3
per leger, assigning QA contacts to all open bugs without QA contacts according to list at http://bugzilla.mozilla.org/describecomponents.cgi?product=Browser
Status: ASSIGNED → NEW
Target Milestone: M3 → M5
Assignee: joki → troy
Summary: js doc object needs to be reflected before doc load → Crash in initial layout of empty framesets
Changing subject from js doc object needs to be reflected before doc load I think that bug may still exist but theres a different one now that hits first. Document dies in a reflow stack during initial document layout. Troy can you look at this and if the reflow gets fixed and load event crash recurs send it back.
Assignee: troy → karnaze
Chris, we're hitting an assert in the nsHTMLOuterFrame code. Here's the stack trace: NTDLL! 77f76148() nsDebug::Assertion(const char * 0x007bd5a0, const char * 0x007bd580, const char * 0x007bd548, int 348) line 140 + 13 bytes nsHTMLFrameOuterFrame::Reflow(nsHTMLFrameOuterFrame * const 0x01133604, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 4294967295) line 348 + 38 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x01133600, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 4294967295) line 388 + 28 bytes nsHTMLFramesetFrame::ReflowPlaceChild(nsIFrame * 0x01133600, nsIPresContext & {...}, const nsHTMLReflowState & {...}, nsPoint & {x=0 y=0}, nsSize & {width=9180 height=4470}, nsPoint * 0x0012e954 {x=0 y=0}) line 751 nsHTMLFramesetFrame::Reflow(nsHTMLFramesetFrame * const 0x01132054, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 6483869) line 1140 nsLineLayout::ReflowFrame(nsIFrame * 0x01132050, nsIFrame * * 0x0012f564, unsigned int & 6483869) line 842 nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineBox * 0x01133f60, nsIFrame * 0x01132050, unsigned char * 0x0012ebe0) line 2729 + 26 bytes nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & {...}, nsLineBox * 0x01133f60, int * 0x0012ec70) line 2610 + 24 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01133f60, int * 0x0012ec70) line 1717 + 20 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1522 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x011324b4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 892 + 18 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x011324b4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 509 + 28 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x011324b0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 388 + 28 bytes RootFrame::Reflow(RootFrame * const 0x011328a4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 253 nsContainerFrame::ReflowChild(nsIFrame * 0x011328a0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 388 + 28 bytes ViewportFrame::Reflow(ViewportFrame * const 0x0112ae14, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 434 PresShell::InitialReflow(PresShell * const 0x01109f90, int 9180, int 4470) line 878 HTMLContentSink::StartLayout() line 1980 HTMLContentSink::CloseFrameset(HTMLContentSink * const 0x010e7850, const nsIParserNode & {...}) line 1822 CNavDTD::CloseFrameset(const nsIParserNode & {...}) line 2232 + 31 bytes CNavDTD::CloseContainer(const nsIParserNode & {...}, nsHTMLTag eHTMLTag_frameset, int 1) line 2366 + 12 bytes CNavDTD::CloseContainersTo(int 1, nsHTMLTag eHTMLTag_frameset, int 1) line 2402 + 26 bytes CNavDTD::CloseContainersTo(nsHTMLTag eHTMLTag_frameset, int 1) line 2423 + 20 bytes CNavDTD::HandleEndToken(CToken * 0x01128460) line 1231 + 14 bytes NavDispatchTokenHandler(CToken * 0x01128460, nsIDTD * 0x010a4050) line 245 + 12 bytes CTokenHandler::operator()(CToken * 0x01128460, nsIDTD * 0x010a4050) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x010a4050, CToken * 0x01128460, nsIParser * 0x010e7fa0) line 604 + 18 bytes CNavDTD::BuildModel(CNavDTD * const 0x010a4050, nsIParser * 0x010e7fa0, nsITokenizer * 0x010a3840, nsITokenObserver * 0x00000000, nsIContentSink * 0x010e7850) line 502 + 20 bytes nsParser::BuildModel() line 804 + 34 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 756 + 11 bytes nsParser::OnDataAvailable(nsParser * const 0x010e7fa4, nsIURL * 0x010ae6f0, nsIInputStream * 0x010a3b70, unsigned int 306) line 968 + 17 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x010ae7f0, nsIURL * 0x010ae6f0, nsIInputStream * 0x010a3b70, unsigned int 306) line 1783 + 24 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x010a0c70) line 632 StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x010a0c74) line 471 + 12 bytes PL_HandleEvent(PLEvent * 0x010a0c74) line 476 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x0104e950) line 437 + 9 bytes _md_EventReceiverProc(HWND__ * 0x0011052a, unsigned int 49403, unsigned int 0, long 17099088) line 799 + 9 bytes USER32! 77e71250() 0104e950()
Status: NEW → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
This works on my 3/29 pm WinNT debug build. I fixed another frameset bug yesterday which fixes the crash here. In the test case, the <frameset> has no rows or cols, so it will never display anything. If the intent is to eventually use the dom to add rows and/or cols, Eric Pollman is currently working on that.
Whiteboard: awaiting stable win32 3/30 build to verify
The crash is back except now the stack trace is completely different. So rather than reopening this report, I've created a new report. See bug 5643.
URL: http://mobay/bugs/bug1252.html
Status: RESOLVED → REOPENED
QA Contact: glynn → claudius
Hardware: PC → All
Summary: Crash in initial layout of empty framesets → [CRASH]Crash in initial layout of empty framesets
Whiteboard: awaiting stable win32 3/30 build to verify → fixed long ago but has since regressed - 06/01/99
This bug is now crashing again. All platforms, with the 1999060108 builds (5/25 on Mac). It is reopened and I'll post a stack trace to compare. *Interesting note changing <FRAME> to <FRAME SRC=about:blank> prevents this from crashing although that was a related issue - see bug 5643
Resolution: FIXED → ---
OK Talkback is acting up but my Linux box says we're crashing in nsHTMLFrameInnerFrame whereas before it was nsHTMLFrameOuterFrame. Program received signal SIGSEGV, Segmentation fault. 0x40a48c7b in nsHTMLFrameInnerFrame::DidReflow () #0 0x40a48c7b in nsHTMLFrameInnerFrame::DidReflow () #1 0x409b57e9 in nsContainerFrame::DidReflow () #2 0x40a4aebc in nsHTMLFramesetFrame::ReflowPlaceChild () #3 0x40a4be38 in nsHTMLFramesetFrame::Reflow () #4 0x409c86a0 in nsLineLayout::ReflowFrame () #5 0x409b06c3 in nsBlockFrame::ReflowInlineFrame () #6 0x409b0551 in nsBlockFrame::ReflowInlineFrames () #7 0x409af5ff in nsBlockFrame::ReflowLine () #8 0x409af332 in nsBlockFrame::ReflowDirtyLines () #9 0x409aebb7 in nsBlockFrame::Reflow () #10 0x409ace94 in nsAreaFrame::Reflow () #11 0x409b5ddf in nsContainerFrame::ReflowChild () #12 0x409bd6a7 in RootFrame::Reflow () #13 0x409b5ddf in nsContainerFrame::ReflowChild () #14 0x409daeb8 in ViewportFrame::Reflow () #15 0x409cf2d3 in PresShell::InitialReflow () #16 0x40a409fc in HTMLContentSink::StartLayout () #17 0x40a4068b in HTMLContentSink::CloseFrameset () #18 0x40284c31 in CNavDTD::CloseFrameset () #19 0x4028518a in CNavDTD::CloseContainer () #20 0x4028528e in CNavDTD::CloseContainersTo () #21 0x40285388 in CNavDTD::CloseContainersTo () #22 0x40283bfd in CNavDTD::HandleEndToken () #23 0x40281acb in CNavDTD::Release () #24 0x4028e97b in CTokenHandler::operator() () #25 0x402825ba in CNavDTD::HandleToken () #26 0x402821be in CNavDTD::BuildModel () #27 0x4028c981 in nsParser::BuildModel () #28 0x4028c8bb in nsParser::ResumeParse () #29 0x4028cc25 in nsParser::OnDataAvailable () #30 0x4025b766 in nsDocumentBindInfo::OnDataAvailable () #31 0x40247ec4 in XP_FindContextOfType () #32 0x402029c6 in NET_GetMaxMemoryCacheSize () #33 0x40179da1 in net_ResumeHTTP () #34 0x40179762 in NET_getInternetKeyword () #35 0x4017a65e in net_ResumeHTTP () #36 0x40224f3f in NET_ProcessNet () #37 0x4022a5d7 in NET_PollSockets () #38 0x4024329d in nsNetlibService::NetPollSocketsCallback () #39 0x400f727a in TimerImpl::FireTimeout () #40 0x400f75dc in nsTimerExpired () #41 0x80e6b53 in g_main_iteration () #42 0x80e60d8 in g_list_length () #43 0x80e6553 in g_list_length () #44 0x80e666d in g_main_iteration () #45 0x8084593 in gtk_main () #46 0x400b12c3 in nsAppShell::Run () #47 0x40018fb6 in nsAppShellService::Run () #48 0x8051327 in main ()
Status: REOPENED → RESOLVED
Closed: 26 years ago → 25 years ago
Resolution: --- → FIXED
Target Milestone: M5 → M7
Fixed with latest checkin.
Status: RESOLVED → VERIFIED
VERIFIED fixed fro WinNT, MacOS, and RHLinux with 1999060708 builds
As far as i can tell, this bug has been back again for a while. Over the past few months i have successfully repeatedly crashed mozilla 0.9.9, 1.1.0 and now mozilla-1.2b-0_rh7 (all on redhat). The following HTML is all you need to re-create this crash: <html> <frameset rows="0" cols="0"> <frame src=""> </frameset> </body> </html> -jonny
wfm on 11/26/2 win2k debug.
it's nice to hear it works okay on w2k. on linux - it doesn't. just tested it again on a fresh rh 8.0 install with moz 1.2 stable (xft). crashed like a crashing thing. cheers, -jonny
crashes on Redhat 7.3 1.2b works on win2k
Revised delivery date - 07/21
Product: Core → Core Graveyard
Component: Layout: HTML Frames → Layout: Images
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.