138725 - Trunk M1RC2 Crash going to this Harvard link [@ nsFormFrame::AddFormControlFrame]

Reporter

Description

•

22 years ago

I've been able to crash at will on the Trunk and the release candidate going to
these links:

http://jobs.boston.com/texis/js/+Zwwzm1wwwqFqm5w5ozmqwwwMFqtxd5BdDDzm1wwwdzmxww
wpzm-wwwBFqtxd5BdD/job.html?id=3ca887a44

http://jobs.boston.com/texis/js/+Zwwzm1wwwqFqm5w5ozmqww
wMFqtxd5BdDDzm1wwwdzmxwwwpzm-wwwBFqtxd5BdD/job.html?id=3c7a63b1

Which generate some significant recursion:

nsFormFrame::AddFormControlFrame
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsFormFrame.cpp, line 198]
nsFormFrame::AddFormControlFrame
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsFormFrame.cpp, line 166]
nsHTMLButtonControlFrame::SetInitialChildList
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsHTMLButtonControlFrame.cpp,
line 389]
nsCSSFrameConstructor::ConstructHTMLFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 4860]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7175]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7063]
nsCSSFrameConstructor::ProcessBlockChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 13183]
nsCSSFrameConstructor::ConstructBlock
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 13132]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6320]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7214]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7063]
nsCSSFrameConstructor::ProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 11999]
nsCSSFrameConstructor::ConstructHTMLFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 4838]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7175]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7063]
nsCSSFrameConstructor::ProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 11999]
nsCSSFrameConstructor::ConstructTableCellFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2741]
nsCSSFrameConstructor::TableProcessChild
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 3005]
nsCSSFrameConstructor::TableProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2899]
nsCSSFrameConstructor::ConstructTableRowFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2585]
nsCSSFrameConstructor::TableProcessChild
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2991]
nsCSSFrameConstructor::TableProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2899]
nsCSSFrameConstructor::ConstructTableRowGroupFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2476]
nsCSSFrameConstructor::TableProcessChild
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2985]
nsCSSFrameConstructor::TableProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2899]
nsCSSFrameConstructor::ConstructTableFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2357]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6380]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7214]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7063]
nsCSSFrameConstructor::ProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 11999]
nsCSSFrameConstructor::ConstructTableCellFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2741]
nsCSSFrameConstructor::TableProcessChild
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 3005]
nsCSSFrameConstructor::TableProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2899]
nsCSSFrameConstructor::ConstructTableRowFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2585]
nsCSSFrameConstructor::TableProcessChild
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2991]
nsCSSFrameConstructor::TableProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2899]
nsCSSFrameConstructor::ConstructTableRowGroupFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2476]
nsCSSFrameConstructor::TableProcessChild
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2985]
nsCSSFrameConstructor::TableProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2899]
nsCSSFrameConstructor::ConstructTableFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 2357]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6380]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7214]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7063]
nsCSSFrameConstructor::ProcessInlineChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 13483]
nsCSSFrameConstructor::ConstructInline
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 13264]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6340]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7214]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7063]
nsCSSFrameConstructor::ProcessBlockChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 13183]
nsCSSFrameConstructor::ConstructBlock
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 13132]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6320]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7214]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7063]
nsCSSFrameConstructor::ContentInserted
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 8768]
nsCSSFrameConstructor::ContentReplaced
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 8914]
nsCSSFrameConstructor::WipeContainingBlock
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 13650]
nsCSSFrameConstructor::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 8256]
StyleSetImpl::ContentAppended
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1500]
PresShell::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5171]
nsDocument::ContentAppended
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1897]
nsHTMLDocument::ContentAppended
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line
1338]
HTMLContentSink::NotifyAppend
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 4826]
SinkContext::CloseContainer
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 1572]
HTMLContentSink::CloseContainer
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3470]

greer

Reporter

Comment 1

•

22 years ago

Nominating, since this one seems easy to reproduce.

Keywords: crash, nsbeta1, testcase, topcrash+

Matthias Versen [:Matti]

Comment 2

•

22 years ago

see also bug 121591

URL: http://http://jobs.boston.com/texis/j... → http://jobs.boston.com/texis/js/+Zwwz...

Andrew Schultz

Comment 3

•

22 years ago

crashes on linux builds back to at least 20020114
OS->All

OS: Windows 2000 → All

Andrew Schultz

Comment 4

•

22 years ago

Attached file reduced testcase — Details

if one set of <span> tags is removed, it loads ok, but crashes on exit.

this does look like bug 121591.

Laura Krietemeyer

Comment 5

•

22 years ago

Changing QA Contact

QA Contact: petersen → amar

Kevin McCluskey (gone)

Comment 6

•

22 years ago

Reassigning to John

Assignee: attinasi → jkeiser

Amarendra Hanumanula

Comment 7

•

22 years ago

 Setting the priority to P2.

Priority: -- → P2

Amarendra Hanumanula

Comment 8

•

22 years ago

*** Bug 139221 has been marked as a duplicate of this bug. ***

R.K.Aa.

Comment 9

•

22 years ago

*** Bug 140057 has been marked as a duplicate of this bug. ***

Kevin McCluskey (gone)

Comment 10

•

22 years ago

nsbeta1+.

Keywords: nsbeta1 → nsbeta1+

Whiteboard: [adt1]

Target Milestone: --- → mozilla1.0

John Keiser (jkeiser)

Updated

•

22 years ago

Status: NEW → ASSIGNED

John Keiser (jkeiser)

Comment 11

•

22 years ago

OK, this has to do with the PFM not being updated for one reason or another. 
Specifically, GetPrimaryFrameFor in nsFormFrame::AddFormControlFrame() is
returning the old, destroyed primary frame.

I put some printfs in the constructors / destructors and here is what I see:

0x86d29ac::nsFormFrame()
0x86d2be8::nsHTMLButtonControlFrame
0x86d29ac::Destroy()
0x86d2be8::Destroy()
###!!! ASSERTION: frame was not removed from primary frame map before
destruction or was readded to map after being removed:
'!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame', file
nsFrameManager.cpp, line 1051
###!!! Break: at file nsFrameManager.cpp, line 1051
0x86d2be8::~nsHTMLButtonControlFrame
###!!! ASSERTION: frame was not removed from primary frame map before
destruction or was readded to map after being removed:
'!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame', file
nsFrameManager.cpp, line 1051
###!!! Break: at file nsFrameManager.cpp, line 1051
0x86d29ac::~nsFormFrame()
0x86d1004::nsFormFrame()
0x86d2be8::nsHTMLButtonControlFrame
0x86d2be8::SetFormFrame(0x86d29ac)
0x86d29ac::AddFormControlFrame(0x86d2c20)
0x86d1004::Destroy()
0x86d2be8::Destroy()
0x86d29ac::RemoveFormControlFrame(0x86d2c20)

karnaze (gone)

Assignee

Comment 12

•

22 years ago

Attached patch untested patch which fixes the test case (but not the url) (obsolete) — Details — Splinter Review

This patch avoids reframing when an inline is appended to an inline block. It
fixes the test case but not the url.

karnaze (gone)

Assignee

Comment 13

•

22 years ago

Taking the bug. I will be attaching a patch after some more testing.

Assignee: jkeiser → karnaze

Status: ASSIGNED → NEW

karnaze (gone)

Assignee

Comment 14

•

22 years ago

Attached patch patch to fix the bug — Details — Splinter Review

The patch (1) fixes a flaw in DoCleanupFrameReferences where a placeholder's
out of flow frame was not being used to recurse its children and (2) avoids
reframing when an inline is appended to the last inline frame of an inline that
contains a block. All of the regression tests passed except there were some
cases where frames were now not marked as being special, probably because of
not having to reframe them. If this is important, I guess the patch could be
changed to set the bit when the reframe is avoided.

Attachment #81828 - Attachment is obsolete: true

karnaze (gone)

Assignee

Updated

•

22 years ago

Status: NEW → ASSIGNED

Whiteboard: [adt1] → [adt1]PATCH

Chris Waterson

Comment 15

•

22 years ago

The `sacred triad'? LOL!

WRT your changes to DoCleanupFrameReferences, it seems like we'll end up calling
DoCleanupFrameReferences twice on out-of-flow frames that have been constructed
in the current session. Specifically, WipeContainingBlock calls
CleanupFrameReferences for each of the frame ctor state's three lists
mAbsoluteItems, mFixedItems, and mFloatedItems. Does this matter? (It looks like
DoCleanupFrameReferences is idempotent, so my guess is `no, this won't matter'.)

karnaze (gone)

Assignee

Comment 16

•

22 years ago

In WipeContainingBlock I tried calling CleanupFrameReferences on the floaters 
before the originals and there were still problems. So, although the patch may 
be calling CleanupFrameReferences twice for frames with placeholders, it doesn't 
seem to be a problem. I guess WipeContainingBlock doesn't even need to call 
CleanupFrameReferences any more for things with placeholder frames. I'm a bit 
afraid to remove that though, since I'm not sure how many tests cases we have.

Alexandru Savulov

Comment 17

•

22 years ago

Comment on attachment 81893 [details] [diff] [review]
patch to fix the bug

r= alexsavulov

i spoke with chris about this patch he wrote and based on his observations + 
watersons comment + i looked yesterday at the stack as john started to look at
the bug, yes, we need to do this.

Attachment #81893 - Flags: review+

karnaze (gone)

Assignee

Comment 18

•

22 years ago

Attached patch alternate patch avoiding multiple calls to DoCleanupFrameReferences (obsolete) — Details — Splinter Review

This patch is similar to the previous one except that the calls to
CleanupFrameReferences have been removed for the absolute, fixed, and floater
lists (which should be taken care of in the modifications to
DoCleanupFrameReferences). This patch seems better, but is it?

karnaze (gone)

Assignee

Updated

•

22 years ago

Keywords: adt1.0.0, approval

Chris Waterson

Comment 19

•

22 years ago

sr=waterson on both patches.

I think the first version (attachment 81893 [details] [diff] [review]) ought to go on the branch:
DoCleanupFrameReferences seems to be idempotent so calling it more than once is
just a bit of a performance hit. (Add an XXX comment saying that we probably
_don't_ need to make the extra calls in WipeContainingBlock.)

Check the second version (attachment 81937 [details] [diff] [review]) in on the trunk, and we'll see if
we're right. :-)

Anyway, my $0.02.

Keywords: adt1.0.0, approval

Chris Waterson

Comment 20

•

22 years ago

Comment on attachment 81893 [details] [diff] [review]
patch to fix the bug

sr=waterson

Attachment #81893 - Flags: superreview+

Chris Waterson

Comment 21

•

22 years ago

Comment on attachment 81937 [details] [diff] [review]
alternate patch avoiding multiple calls to DoCleanupFrameReferences

sr=waterson

Attachment #81937 - Flags: superreview+

Jaime Rodriguez, Jr.

Updated

•

22 years ago

Keywords: approval

Whiteboard: [adt1]PATCH → [adt2] PATCH [Needs a=, & adt1.0.0+]

Chris Waterson

Comment 22

•

22 years ago

Adding back a keyword I whacked.

Keywords: adt1.0.0

Alexandru Savulov

Comment 23

•

22 years ago

Comment on attachment 81937 [details] [diff] [review]
alternate patch avoiding multiple calls to DoCleanupFrameReferences

r= alexsavulov

cool ideea to apply the previous patch on the branch.

Attachment #81937 - Flags: review+

Jaime Rodriguez, Jr.

Comment 24

•

22 years ago

Has this landed on the trunk? It looks like a pretty sizeable patch, that
touches layout, so I'd like to verify the fix first, and make sure we don't
introduce any regressions.

Jaime Rodriguez, Jr.

Comment 25

•

22 years ago

Karnaze - Can you land this on the trunk today? We'd like to take this one, but,
we'd also like it to bake for a day or 2.

R.K.Aa.

Comment 26

•

22 years ago

i get a very similar stack testing url in bug 142198
http://www.internetwines.com/spirits.html

but top of stack (on a non-debug cvs, linux) is

#0 0x40138cb2 in nsVoidArray::InsertElementAt () from libxpcom.so
#1 0x417b2465 in nsFormFrame::AddFormControlFrame () from libgklayout.so
#2 0x417b21d7 in nsFormFrame::AddFormControlFrame () from libgklayout.so
#3 0x417bd0b8 in nsHTMLButtonControlFrame::SetInitialChildList () from
libgklayout.so

R.K.Aa.

Comment 27

•

22 years ago

*** Bug 142198 has been marked as a duplicate of this bug. ***

karnaze (gone)

Assignee

Comment 28

•

22 years ago

FIXED_ON_TRUNK

Status: ASSIGNED → RESOLVED

Closed: 22 years ago

Resolution: --- → FIXED

Whiteboard: [adt2] PATCH [Needs a=, & adt1.0.0+] → [adt2] PATCH [Needs a=, & adt1.0.0+][FIXED_ON_TRUNK]

Jaime Rodriguez, Jr.

Comment 29

•

22 years ago

amar - can you verify this fix on the trunk, and make sure it did not cause any
regressions?

we should look @ taking this topcrasher fix for RC2, if it is verified.

Asa Dotzler [:asa]

Comment 30

•

22 years ago

Comment on attachment 81937 [details] [diff] [review]
alternate patch avoiding multiple calls to DoCleanupFrameReferences

a=asa (on behalf of drivers) for checkin to the 1.0 branch.

Attachment #81937 - Flags: approval+

greer

Reporter

Comment 31

•

22 years ago

Verified - Talkback shows no crashes in the Trunk builds following checkin. I
have tried all of the links and testcases with the 0509 build. No crash. 

Great job, karnaze, et. al.

Status: RESOLVED → VERIFIED

Jay Patel [:jay]

Comment 32

•

22 years ago

Updating summary with M1RC2, since this is a topcrasher for Mozilla 1.0 RC2. 
Since we have verified this fix on the Trunk, it'll be a good idea to get this
checked onto the branch soon.

Summary: Trunk M10RC1 Crash going to this Harvard link [@ nsFormFrame::AddFormControlFrame] → Trunk M1RC2 Crash going to this Harvard link [@ nsFormFrame::AddFormControlFrame]

scottputterman

Comment 33

•

22 years ago

adding adt1.0.0+ for checkin to Mozilla 1.0 Branch.  Please get drivers approval
again before checking in since it's been more than 3 days since their previous
approval, and then add the fixed1.0.0 keyword.

Keywords: adt1.0.0 → adt1.0.0+

Jaime Rodriguez, Jr.

Updated

•

22 years ago

Blocks: 143047

chris hofmann

Comment 34

•

22 years ago

reapproval a=chofmann for the 1.0 branch for rc3.  let's get it in today.

Blocks: 143200

karnaze (gone)

Assignee

Comment 35

•

22 years ago

Maybe it would be better to check the 2nd patch into the branch, since it has 
been on the trunk for over a week now.

karnaze (gone)

Assignee

Comment 36

•

22 years ago

Checked the alternate (2nd) patch into the m1.0 branch.

Keywords: fixed1.0.0

Whiteboard: [adt2] PATCH [Needs a=, & adt1.0.0+][FIXED_ON_TRUNK] → [adt2] PATCH

Dawn Endico

Updated

•

22 years ago

No longer blocks: 143200

Amarendra Hanumanula

Updated

•

22 years ago

Keywords: verified1.0.0

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Comment 37

•

22 years ago

Bug 167915 comment 35 says that this caused bug 167915 (another crasher).

karnaze (gone)

Assignee

Comment 38

•

22 years ago

Attached patch patch to negate alternate patch which caused bug 167915 — Details — Splinter Review

The alternate patch was installed on the trunk and branch, but it caused bug
167915. This patch undoes it and installs the 1st patch. This patch is also an
attachment in bug 167915.

Attachment #81937 - Attachment is obsolete: true

Jesse Ruderman

Comment 39

•

15 years ago

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/54417ebbaea2

Flags: in-testsuite+

Nobody; OK to take it and work on it

Updated

•

13 years ago

Crash Signature: [@ nsFormFrame::AddFormControlFrame]

reduced testcase 22 years ago Andrew Schultz 941 bytes, text/html		Details
untested patch which fixes the test case (but not the url) 22 years ago karnaze (gone) 1.60 KB, patch		Details \| Diff \| Splinter Review
patch to fix the bug 22 years ago karnaze (gone) 3.25 KB, patch	alexsavulov : review+ waterson : superreview+	Details \| Diff \| Splinter Review
alternate patch avoiding multiple calls to DoCleanupFrameReferences 22 years ago karnaze (gone) 4.28 KB, patch	alexsavulov : review+ waterson : superreview+ asa : approval+	Details \| Diff \| Splinter Review
patch to negate alternate patch which caused bug 167915 22 years ago karnaze (gone) 1.90 KB, patch		Details \| Diff \| Splinter Review