134917 - browser crash on mouseover [@ nsBlockFrame::ReflowDirtyLines]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[ben]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 Galeon/1.2.0 (X11; Linux i686; U;) Gecko/0
BuildID:    20020326

mouseover of product names seems to increase font size of product name, however
after rolling over a couple (few) names, the browser crashes (seg fault).

Reproducible: Always
Steps to Reproduce:
1.go to www.4sure.com
2.select monitors/flatpanels/17"/browseinventory
3.roll over product names

Actual Results:  crash/seg fault

Expected Results:  seems that correct operation is increased font size

mandrake 8.2 os, first found this using galeon, reproduced using mozilla at
request of galeon developer

Comment 1

[Matthias Versen [:Matti]]

Reporter: Do you have a talkabck ID of that crash ?

Comment 2

[R.B.]

WFM Linux 2002032806.

Comment 3

[André Dahlqvist]

WFM with a Linux build from recent todays CVS. The text is made large when you
mouse over it, but it does not crash here. Reporter, try to get us a talkback ID
of the crash that you see.

Comment 4

[ben]

Downloaded and ran talkback build from mozilla.org.  Crashed on
mouseover as reported earlier.  Talkback report submitted -- I don't
know the talkback ID, but the bug number (134917) is in the submitted
description.

Comment 5

[Adam Hauner]

WFM 2002040203/Win2K

Comment 6

[Andrew Schultz]

looks lot like bug 133813.  is 20020326 the Galeon build date or Mozilla?  what
Mozilla build did you use to produce the talkback crash?

you can pull the talkback ID by running
/usr/local/mozilla/components/talkback/talkback
^^^^^^^^^^  replace with wherever Mozilla lives.

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

Stack Signature  0x00000000 c160477e
Trigger Time 2002-04-02 16:43:19
Email Address [e-mail]
URL visited (http://bugzilla.mozilla.org/show_bug.cgi?id=134917)
Build ID 2002031312
Product ID MozillaBranch
Platform
Operating System LinuxIntel
Module
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
User Comments mouseover text that changes font size
Stack Trace
0x00000000
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableCellFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableRowFrame::IR_TargetIsChild()
nsTableRowFrame::IncrementalReflow()
nsTableRowFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableRowGroupFrame::IR_TargetIsChild()
nsTableRowGroupFrame::IncrementalReflow()
nsTableRowGroupFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableFrame::IR_TargetIsChild()
nsTableFrame::IncrementalReflow()
nsTableFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableOuterFrame::OuterReflowChild()
nsTableOuterFrame::IR_InnerTableReflow()
nsTableOuterFrame::IR_TargetIsInnerTableFrame()
nsTableOuterFrame::IR_TargetIsChild()
nsTableOuterFrame::IncrementalReflow()
nsTableOuterFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableCellFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableRowFrame::IR_TargetIsChild()
nsTableRowFrame::IncrementalReflow()
nsTableRowFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableRowGroupFrame::IR_TargetIsChild()
nsTableRowGroupFrame::IncrementalReflow()
nsTableRowGroupFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableFrame::IR_TargetIsChild()
nsTableFrame::IncrementalReflow()
nsTableFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableOuterFrame::OuterReflowChild()
nsTableOuterFrame::IR_InnerTableReflow()
nsTableOuterFrame::IR_TargetIsInnerTableFrame()
nsTableOuterFrame::IR_TargetIsChild()
nsTableOuterFrame::IncrementalReflow()
nsTableOuterFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableCellFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableRowFrame::IR_TargetIsChild()
nsTableRowFrame::IncrementalReflow()
nsTableRowFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableRowGroupFrame::IR_TargetIsChild()
nsTableRowGroupFrame::IncrementalReflow()
nsTableRowGroupFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableFrame::IR_TargetIsChild()
nsTableFrame::IncrementalReflow()
nsTableFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableOuterFrame::OuterReflowChild()
nsTableOuterFrame::IR_InnerTableReflow()
nsTableOuterFrame::IR_TargetIsInnerTableFrame()
nsTableOuterFrame::IR_TargetIsChild()
nsTableOuterFrame::IncrementalReflow()
nsTableOuterFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
CanvasFrame::Reflow()
nsBoxToBlockAdaptor::Reflow()
nsBoxToBlockAdaptor::DoLayout() 

Comment 8

[Matthias Versen [:Matti]]

-> Layout

The same stack is also at bug 117088

Comment 9

[ben]

talkback ID was TB4754135M
build ID for the talkback crash was 2002031312

Comment 10

[Marc Attinasi]

WFM using 04-01 build - marking WORKSFORME - please reopen if you are seeing
this crash with a later build.