126186 - browser hangs in infinite loop rendering foxtons.co.uk web page

Status: VERIFIED WORKSFORME

(Core :: Layout, defect)

Description

[Richard Jones]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.7) Gecko/20020203
BuildID:    

The browser enters an infinite loop when visiting the
foxtons.co.uk web page. "strace"-ing the process reveals
that it is not making any system calls. However it is
certainly consuming 100% of CPU.

I have the following plug-ins installed (although I'm not
sure if this could be the source of the problems):

default plugin
real player 7.0
adobe acrobat plugin


Reproducible: Always
Steps to Reproduce:
1. Visit http://www.foxtons.co.uk/

Actual Results:  Browser hangs, using up 100% of CPU, not making any syscalls.

Expected Results:  Rendered the page or produced an error.

Comment 1

[Olivier Cahagne]

I do not crash on the page itself using build 2002021708 on Win2k, therefore
there's a problem display fonts on the left (which I've already seen mentioned
in previous bug reports).
And, when going back 1 page, I crashed with following Talkback ID:
TB3050226M. I don't know if this crash is related though.
Will try on Linux tonight.
Stephen, can you retreive Talkback data please ?

Comment 2

[[e-mail] (gone - use [e-mail] instead)]

0x00000186
nsFrameList::DestroyFrames
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 131]
nsBlockFrame::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 328]
nsFrameList::DestroyFrames
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 131]
nsAbsoluteContainingBlock::DestroyFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 376]
nsBlockFrame::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 321]
nsFrameList::DestroyFrames
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 131]
nsContainerFrame::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 141] 

Comment 3

[Richard Jones]

Linux, build 2002012823, shows different behaviour from the Debian 0.9.7 build
which I am using at work.

On Linux 2002012823 the page renders, but the text on the left hand side of the
page is screwy: all of the text is rendered on top of itself. If I then proceed
to visit another URL right afterwards, Mozilla immediately crashes.

Comment 4

[Andrew Schultz]

Attachment: minimal testcase

this is a reduced version of the left frame from the URL.  Mozilla crashes on
reload / back / forward / close

Comment 5

[Andrew Schultz]

the following appears in my terminal when running a debug build on the testcase:
---------------------------------------------------------------------
###!!! ASSERTION: can't find deleted frame in lines: 'line != line_end', file
nsBlockFrame.cpp, line 4921
###!!! Break: at file nsBlockFrame.cpp, line 4921
###!!! ASSERTION: bad prevSibling: 'tmp == aDeletedFrame', file
nsBlockFrame.cpp, line 4925
###!!! Break: at file nsBlockFrame.cpp, line 4925
Document file:///home/andrew/mozbugs/126186/www2.foxtons.co.uk/nav.html loaded
successfully
###!!! ASSERTION: invalid float type: '(NS_STYLE_FLOAT_LEFT ==
floaterDisplay->mFloats) || (NS_STYLE_FLOAT_RIGHT == floaterDisplay->mFloats)',
file nsBlockReflowState.cpp, line 885
###!!! Break: at file nsBlockReflowState.cpp, line 885

Comment 6

[Peter Trudelle]

->layout

Comment 7

[Christine Hoffman]

Changing QA contact

Comment 8

[Moied]

Cant able to reprooduce a crash either with URL or testcase on winXP and linuz
with build ID 20020227

Comment 9

[Andrew Schultz]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8+) Gecko/20020228
I see the same, no crash.  And the text on the left side is displayed properly.
WFM

Comment 10

[Richard Jones]

I can now confirm that with Build ID: 20020227, Mozilla now renders
the left hand side of the Foxtons page correctly, and does not crash
when you visit another page. Also with the same build the minimal
test case does not crash the browser on reload. Bug fixed, I think!

Comment 11

[Andrew Schultz]

Richard:  you can mark this WORKSFORME

Comment 12

[Richard Jones]

Changed status to WORKSFORME as instructed.

Comment 13

[Moied]

verified WFM with build ID 20020301