126229 - Crash on loading joins.com (international smoketest topsite)

Status: VERIFIED DUPLICATE of bug 125713

(Core :: Layout, defect)

Description

[Tracy Walker [:tracy]]

seen on linux commercial build 2002-02-18-06-trunk

-load the above URL
the page almost finishes loading, then crashes the app.

here's a talkback incident for this crash:

http://climate/reports/SingleIncidentInfo.cfm?dynamicBBID=3056220

                 Incident ID 3056220
 Stack Signature
                 nsLineLayout::ReflowFrame() 31a367dc
 Trigger Time
                 2002-02-18 09:27:43
 Email Address
                 [e-mail]
 URL visited
                 http://www.joins.com
 Build ID
                 2002021806
 Product ID
                 MozillaTrunk
 Platform
 Operating System
                 LinuxIntel
 Module
 Trigger Reason
                  SIGSEGV: Segmentation Fault: (signal 11)
 User Comments
                 crash entering joins.com 
 Stack Trace

nsLineLayout::ReflowFrame() 
nsInlineFrame::ReflowInlineFrame() 
nsInlineFrame::ReflowFrames() 
nsInlineFrame::Reflow() 
nsLineLayout::ReflowFrame() 
nsBlockFrame::ReflowInlineFrame() 
nsBlockFrame::DoReflowInlineFrames() 
nsBlockFrame::DoReflowInlineFramesAuto() 
nsBlockFrame::ReflowInlineFrames() 
nsBlockFrame::ReflowLine() 
nsBlockFrame::ReflowDirtyLines() 
nsBlockFrame::Reflow() 
nsBlockReflowContext::DoReflowBlock() 
nsBlockReflowContext::ReflowBlock() 
nsBlockFrame::ReflowBlockFrame() 
nsBlockFrame::ReflowLine() 
nsBlockFrame::ReflowDirtyLines() 
nsBlockFrame::Reflow() 
nsContainerFrame::ReflowChild() 
nsTableCellFrame::Reflow() 
nsContainerFrame::ReflowChild() 
nsTableRowFrame::IR_TargetIsChild() 
nsTableRowFrame::IncrementalReflow() 
nsTableRowFrame::Reflow() 
nsContainerFrame::ReflowChild() 
nsTableRowGroupFrame::IR_TargetIsChild() 
nsTableRowGroupFrame::IncrementalReflow() 
nsTableRowGroupFrame::Reflow() 
nsContainerFrame::ReflowChild() 
nsTableFrame::IR_TargetIsChild() 
nsTableFrame::IncrementalReflow() 
nsTableFrame::Reflow() 
nsContainerFrame::ReflowChild() 
nsTableOuterFrame::OuterReflowChild() 
nsTableOuterFrame::IR_InnerTableReflow() 
nsTableOuterFrame::IR_TargetIsInnerTableFrame() 
nsTableOuterFrame::IR_TargetIsChild() 
nsTableOuterFrame::IncrementalReflow() 
nsTableOuterFrame::Reflow() 
nsBlockReflowContext::DoReflowBlock() 
nsBlockReflowContext::ReflowBlock() 
nsBlockFrame::ReflowBlockFrame() 
nsBlockFrame::ReflowLine() 
nsBlockFrame::ReflowDirtyLines() 
nsBlockFrame::Reflow() 
nsBlockReflowContext::DoReflowBlock() 
nsBlockReflowContext::ReflowBlock() 
nsBlockFrame::ReflowBlockFrame() 
nsBlockFrame::ReflowLine() 
nsBlockFrame::ReflowDirtyLines() 
nsBlockFrame::Reflow() 
nsContainerFrame::ReflowChild() 
CanvasFrame::Reflow() 
nsBoxToBlockAdaptor::Reflow() 
nsBoxToBlockAdaptor::DoLayout() 
nsBox::Layout() 
nsScrollBoxFrame::DoLayout() 
nsBox::Layout() 
nsContainerBox::LayoutChildAt() 
nsGfxScrollFrameInner::LayoutBox() 
nsGfxScrollFrameInner::Layout() 
nsGfxScrollFrame::DoLayout() 
nsBox::Layout() 
nsBoxFrame::Reflow() 
nsGfxScrollFrame::Reflow() 
nsContainerFrame::ReflowChild() 
ViewportFrame::Reflow() 
nsHTMLReflowCommand::Dispatch() 
PresShell::ProcessReflowCommand() 
PresShell::ProcessReflowCommands() 
HandlePLEvent() 
PL_HandleEvent() 
PL_ProcessPendingEvents() 
nsEventQueueImpl::ProcessPendingEvents() 
event_processor_callback() 
our_gdk_io_invoke() 
libglib-1.2.so.0 + 0xe52a (0x4036852a) 
libglib-1.2.so.0 + 0xfbe6 (0x40369be6) 
libglib-1.2.so.0 + 0x101a1 (0x4036a1a1) 
libglib-1.2.so.0 + 0x10341 (0x4036a341) 
libgtk-1.2.so.0 + 0x8c209 (0x40291209) 
nsAppShell::Run() 
nsAppShellService::Run() 
netscape-bin + 0x7e89 (0x0804fe89) 
netscape-bin + 0x86d7 (0x080506d7) 
libc.so.6 + 0x181eb (0x404691eb)

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Worksforme on a current Linux build, without the flash plugin.  Do you have
flash installed on the machine that crashed, or not?

Comment 2

[Tracy Walker [:tracy]]

David, flash is installed (by default on commercial builds) and working  (goto 
www.jeep.com)

Comment 3

[Alec Flett]

this looks like layout, not i18n - the fact that the site is part of the i18n
test suite doesn't seem to relate to the crash. Who can we get from Gecko to
look at this (thanks already to dbaron!)

Comment 4

[ji]

I have a full install of today's build on my 7.1 and it doesn't crash on this page.

Comment 5

[Yuying Long]

I had this crash on 02-18 trunk build, however 02-11 trunk build didn't crash. -
both C locale

We used had crashes on this web site before (e.g. bug 109356), but we didn't
really fix it cause after a while we can not reproduce it any more. 

Comment 6

[Roy Yokoyama]

Wild guesses here. I need help on this.

dcone%netscape.com, bug 96870  <- table related change.
attinasi%netscape.com, bug 56894 <-Jan 14th check in
iQA: ok with 2002-02-15 trunk build?  can you try with flash?

Comment 7

[Roy Yokoyama]

I think it's a duplicate of http://bugzilla.mozilla.org/show_bug.cgi?id=109356
The stack trace is very similar to this bug.

assign to serge

Comment 8

[Roy Yokoyama]

I haven't seen any comments on this bug.  Layout guys?

Comment 9

[Rui Xu]

QA -> [e-mail]  for now.

Comment 10

[serge (gone)]

I cannot crash debug build, 
but 20020218 commercial build does crash with 
(http://climate/reports/singleincidentinfo.cfm?dynamicBBID=3064784)
or without 
(http://climate/reports/singleincidentinfo.cfm?dynamicBBID=3064899)
flash installed.
Investigating...

Comment 11

[serge (gone)]

ccing pavlov,
could this be a regression from fix for bug 84654?

Comment 12

[Tracy Walker [:tracy]]

on mac osx build 2002-02-18-12-trunk, the page loads without crashing but the 
korean stock display is broken up.

Comment 13

[serge (gone)]

I would not keep this bug as a tree blocker,
looks like chechins which expose this crash happened between
2002021408 & 2002021412 builds.
It looks like old problem and we need some time to nail it down.
If there is no objection I'm going to low severity of this bug.

Comment 14

[kysmith0 (gone)]

OK by me, thanks for the work nailing down the time window showing the suspected 
checkins. 

Comment 15

[serge (gone)]

severety-->critical
the tree could be open
but there is a big chanee linux smoketest topsite is going to fail

Comment 16

[serge (gone)]

This is the regression from from fix for bug 84654 at least w/o flash plugin
my debug build does crash with stack trace similar to TB report
http://climate/reports/singleincidentinfo.cfm?dynamicBBID=3064899
here is why we crash
mozilla/layout/base/src/nsPresContext.cpp
   1506     if (content) {
   1507       nsCOMPtr<nsIDocument> document;
   1508       rv = content->GetDocument(*getter_AddRefs(document));
   1509       if (NS_FAILED(rv)) return rv;
but 
mozilla/content/xul/content/src/nsXULElement.cpp:
nsXULElement::GetDocument(nsIDocument*& aResult) const
{
    aResult = mDocument;
    NS_IF_ADDREF(aResult);
    return NS_OK;
}
can return  aResult == 0
and we crash dereferencing null ptr in  nsPresContext::LoadImage
  1511 rv = document->GetScriptGlobalObject(getter_AddRefs(globalScript));
...
Bulletproofing patch is folowing ...

Comment 17

[serge (gone)]

Attachment: simple bulletproofing

Comment 18

[serge (gone)]

Actually, I found pavlov already posted the patch for this in bug 125713
so, I'm  marking this as a dup.



*** This bug has been marked as a duplicate of 125713 ***

Comment 19

[Tracy Walker [:tracy]]

verified dupe ..fixed in other bug