Assigning LAYER.top causes crash

VERIFIED WORKSFORME

Status

()

defect
P3
critical
VERIFIED WORKSFORME
20 years ago
20 years ago

People

(Reporter: beardmcbob, Assigned: nisheeth_mozilla)

Tracking

Trunk
x86
Windows 95
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [TESTCASE], )

Attachments

(5 attachments)

this may only happen after loading another page fully, it happened when i went
from the default mozillazine page, when then going to www.aim-eur.org/web, the
page loaded partially then mozilla crashed, this happens every time now,
message is
APPRUNNER caused an invalid page fault in
module NSAPPSHELL.DLL at 0157:60929d6f.
Registers:
EAX=00000000 CS=0157 EIP=60929d6f EFLGS=00010206
EBX=01f0f810 SS=015f ESP=0063cb98 EBP=0063cbbc
ECX=01ef1e30 DS=015f ESI=00000000 FS=3b7f
EDX=0063cbb8 ES=015f EDI=01ef84f0 GS=0000
Bytes at CS:EIP:
ff 50 04 33 c0 c2 04 00 8b 44 24 04 89 01 33 c0
Stack dump:
01ef1e30 60929eae 0063cbb8 01ed3e60 00000000 01f0f810 00000006 00000000
01ef1e30 0063cbe0 60929ee9 01f0f810 01ed2780 00000001 01f0f810 0000000c
Severity: blocker → critical
Whiteboard: [MAKINGTEST] mats@symsoft.se
Going directly to http://www.aim-eur.org/web crashes on Windows 98 too.
I am lowering Severity to "critical" which I think is used for crashers.
Using build 1999-08-26-13-M10 the last messages on the console are:
FindShortcut: in='http://www.aim-eur.org/web'  out='null'
Document: Done (3.29 secs)
Document: Done (3.18 secs)
Document: Done (0.77 secs)
Error: Can't load: http://www.aim-eur.org/web/start.htm (804b0002)
Document: Done (2.14 secs)
Whiteboard: [MAKINGTEST] mats@symsoft.se → [TESTCASE]
Sorry for the somewhat complicated testcase, but I couldn't reduce it further.
The "animation" in the testcase (and at the original site) is done by setting
"top" attribute on a LAYER (see frame3), which I think is the problem.
It looks like it is causing memory corruption.
Summary: Assigning LAYER.top causes crash
Assignee: don → troy
Component: Browser-General → Layout
Target Milestone: M10
petersen, can you reproduce?
Target Milestone: M10 → M11
At this point LAYER is not supported. Moving to M11
Status: NEW → ASSIGNED
Assignee: troy → nisheeth
Status: ASSIGNED → NEW
I'm crashing in the widget code when trying to load this page.

Nisheeth, it doesn't look like a widget problem per say. Assigning to you
because web shell is up there on the call stack:

NTDLL! 77f76148()
nsWindow::Create(nsWindow * const 0x02036d14, nsIWidget * 0x00000000, const
nsRect & {...}, nsEventStatus (nsGUIEvent *)* 0x01c73b63 HandleEvent(nsGUIEvent
*), nsIDeviceContext * 0x01fec330, nsIAppShell * 0x00000000, nsIToolkit *
0x00000000, nsWidgetInitData * 0x00000000) line 602
nsView::CreateWidget(nsView * const 0x02036e50, const nsID & {...},
nsWidgetInitData * 0x00000000, void * 0x00000000, int 1) line 1234
DocumentViewerImpl::MakeWindow(void * 0x00000000, const nsRect & {...},
nsScrollPreference nsScrollPreference_kAuto) line 887 + 34 bytes
DocumentViewerImpl::Init(DocumentViewerImpl * const 0x020145e0, void *
0x00000000, nsIDeviceContext * 0x01fec330, nsIPref * 0x00b916a0, const nsRect &
{...}, nsScrollPreference nsScrollPreference_kAuto) line 394
nsWebShell::Embed(nsWebShell * const 0x01fec8b0, nsIContentViewer * 0x020145e0,
const char * 0x01fedd00, nsISupports * 0x00000000) line 977 + 69 bytes
nsDocumentBindInfo::OnStartRequest(nsDocumentBindInfo * const 0x01fed730,
nsIChannel * 0x01fed5e0, nsISupports * 0x00000000) line 1896 + 36 bytes
nsChannelListener::OnStartRequest(nsChannelListener * const 0x01fed6b0,
nsIChannel * 0x01fed5e0, nsISupports * 0x00000000) line 2234 + 43 bytes
nsHTTPResponseListener::FinishedResponseHeaders() line 680 + 37 bytes
nsHTTPResponseListener::OnDataAvailable(nsHTTPResponseListener * const
0x020033f0, nsIChannel * 0x01fed110, nsISupports * 0x01fed5e0, nsIInputStream *
0x02004868, unsigned int 0, unsigned int 121) line 166 + 8 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x02013220)
line 345
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x02013224) line 144 + 12 bytes
PL_HandleEvent(PLEvent * 0x02013224) line 545 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00b91dd0) line 504 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x518e0366, unsigned int 49405, unsigned int 0,
long 12131792) line 974 + 9 bytes
USER32! 77e71250()
00b91dd0()
QA Contact: leger → petersen
Updating QA Contact.
Status: NEW → ASSIGNED
Troy, please assign future webshell related bugs to Travis.  Thanks.

I'll take a look at this one, though.  Setting milestone to M12 and accepting
bug...
Target Milestone: M11 → M12
Status: ASSIGNED → RESOLVED
Closed: 20 years ago
Resolution: --- → WORKSFORME
This is fixed in the latest builds.  Marking worksforme.  Please re-test.
Thanks.
Status: RESOLVED → VERIFIED
With the Oct 29th build, I can't reproduce the problem.
You need to log in before you can comment on or make changes to this bug.