127106 - Crash in layout visiting http://www.iht.com

Status: RESOLVED DUPLICATE of bug 105619

(Core :: Layout, defect)

Description

[Radha on family leave (not reading bugmail)]

In my fresh tree from yesterday 02/20/01, visiting the site almost always
crashes at one of the following places. There is a session history related bug
on that site. Once you go to that site, 2 entries are created in session history
for it and therefore back button does not work. I have a fix for it, but I'm not
able to verify my patch because of the crash on the site. If going to the site
doesn't crash, go somewhere else and hit back button. It crashes 

nsAString::IsEmpty() line 140 + 15 bytes
nsAString::do_AssignFromReadable(const nsAString & {...}) line 288 + 8 bytes
nsAString::AssignFromReadable(const nsAString & {...}) line 239
nsAString::Assign(const nsAString & {...}) line 263 + 19 bytes
nsString::operator=(const nsString & {...}) line 281 + 19 bytes
nsFont::operator=(const nsFont & {...}) line 105
nsFontMetricsWin::Init(nsFontMetricsWin * const 0x0469f850, const nsFont &
{...}, nsIAtom * 0x02ab9660, nsIDeviceContext * 0x03d602d0) line 452
nsFontCache::GetMetricsFor(nsFontCache * const 0x03d8a390, const nsFont & {...},
nsIAtom * 0x02ab9660, nsIFontMetrics * & 0x00000000) line 664 + 27 bytes
DeviceContextImpl::GetMetricsFor(DeviceContextImpl * const 0x03d602d0, const
nsFont & {...}, nsIFontMetrics * & 0x00000000) line 324
nsRenderingContextWin::SetFont(nsRenderingContextWin * const 0x0469a9c0, const
nsFont & {...}) line 995
nsLineLayout::VerticalAlignFrames(nsLineLayout::PerSpanData * 0x001252ec) line 2150
nsLineLayout::VerticalAlignLine(nsLineBox * 0x03387aa4, nsSize & {...}, int &
54032344) line 1880
nsBlockFrame::PlaceLine(nsBlockReflowState & {...}, nsLineLayout & {...},
nsLineList_iterator {...}, int * 0x001256b8, int 1) line 4045
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & {...}, nsLineLayout &
{...}, nsLineList_iterator {...}, int * 0x001256b8, unsigned char * 0x00125468,
int 1, int 1) line 3688 + 32 bytes
nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState & {...},
nsLineList_iterator {...}, int * 0x001256b8, unsigned char * 0x00125468, int 1,
int 1) line 3540 + 46 bytes
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & {...}, nsLineList_iterator
{...}, int * 0x001256b8, int 1, int 1) line 3484 + 36 bytes



The other place where crash happens is ...

_NMSG_WRITE(int 255) line 221
_FF_MSGBANNER() line 169 + 10 bytes
_amsg_exit(int 25) line 324
_purecall() line 35 + 7 bytes
nsAString::Equals(const nsAString & {...}, const nsStringComparator & {...})
line 737 + 24 bytes
nsFont::Equals(const nsFont & {...}) line 96 + 141 bytes
nsFontCache::GetMetricsFor(nsFontCache * const 0x039b62b0, const nsFont & {...},
nsIAtom * 0x02ab9340, nsIFontMetrics * & 0x00000000) line 645 + 12 bytes
DeviceContextImpl::GetMetricsFor(DeviceContextImpl * const 0x0354b9c0, const
nsFont & {...}, nsIAtom * 0x02ab9340, nsIFontMetrics * & 0x00000000) line 303
nsTextFrame::TextStyle::TextStyle(nsIPresContext * 0x041afae0,
nsIRenderingContext & {...}, nsIStyleContext * 0x032ab4ac) line 572
nsTextFrame::Paint(nsTextFrame * const 0x032ab4e0, nsIPresContext * 0x041afae0,
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay, unsigned int 0) line 1448
nsContainerFrame::PaintChild(nsIPresContext * 0x041afae0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x032ab4e0, nsFramePaintLayer
eFramePaintLayer_Overlay, unsigned int 0) line 254
nsBlockFrame::PaintChildren(nsIPresContext * 0x041afae0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay,
unsigned int 0) line 5515
nsBlockFrame::Paint(nsBlockFrame * const 0x032ab428, nsIPresContext *
0x041afae0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay, unsigned int 0) line 5387
nsContainerFrame::PaintChild(nsIPresContext * 0x041afae0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x032ab428, nsFramePaintLayer
eFramePaintLayer_Overlay, unsigned int 0) line 254
nsContainerFrame::PaintChildren(nsIPresContext * 0x041afae0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay,
unsigned int 0) line 197




null string seems to be the problem in both the cases.

Comment 1

[Matthias Versen [:Matti]]

*** This bug has been marked as a duplicate of 105619 ***

Comment 2

[Christine Hoffman]

Changing QA contact