Trunk crash [@ nsHTMLFrameInnerFrame::ShowDocShell]

RESOLVED FIXED in mozilla1.0.1

Status

()

Core
Layout
P1
critical
RESOLVED FIXED
16 years ago
3 years ago

People

(Reporter: jay, Assigned: jst)

Tracking

({crash, topcrash})

Trunk
mozilla1.0.1
crash, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(1 attachment)

647 bytes, patch
peterv
: review+
Heikki Toivonen (remove -bugzilla when emailing directly)
: superreview+
Details | Diff | Splinter Review
(Reporter)

Description

16 years ago
This is a topcrasher with recent MozillaTrunk builds.  One person has been
crashing a lot, but other have also seen this crash.  Mostly on Win98 and
Linux...but there are also incidents reported for other Windows versions. 
Here's the latest from Talkback:

nsHTMLFrameInnerFrame::ShowDocShell   17 
BBID range: 5351438 - 5490191
Min/Max Seconds since last crash: 21 - 95686
Min/Max Runtime: 2024 - 132430
Crash data range: 2002-04-18 to 2002-04-22
Build ID range: 2002041721 to 2002042207
Keyword List : load(4), 
Stack Trace: 

	 nsHTMLFrameInnerFrame::ShowDocShell()
	 nsHTMLFrameInnerFrame::Init()
	 nsHTMLFrameOuterFrame::Init()
	 nsHTMLFramesetFrame::Init()
	 nsCSSFrameConstructor::InitAndRestoreFrame()
	 nsCSSFrameConstructor::ConstructHTMLFrame()
	 nsCSSFrameConstructor::ConstructFrameInternal()
	 nsCSSFrameConstructor::ConstructFrame()
	 nsCSSFrameConstructor::ProcessChildren()
	 nsCSSFrameConstructor::ConstructDocElementFrame()
	 nsCSSFrameConstructor::ContentInserted()
	 StyleSetImpl::ContentInserted()
	 PresShell::InitialReflow()
	 HTMLContentSink::StartLayout()
	 HTMLContentSink::CloseFrameset()
	 CNavDTD::CloseFrameset()
	 CNavDTD::CloseContainer()
	 CNavDTD::CloseContainersTo()
	 CNavDTD::CloseContainersTo()
	 CNavDTD::HandleEndToken()
	 CNavDTD::HandleToken()
	 CNavDTD::BuildModel()
	 nsParser::BuildModel()
	 nsParser::ResumeParse()
	 nsParser::OnDataAvailable()
	 nsDocumentOpenInfo::OnDataAvailable()
	 nsHttpChannel::OnDataAvailable()
	 nsOnDataAvailableEvent::HandleEvent()
	 nsARequestObserverEvent::HandlePLEvent()
	 PL_HandleEvent()
	 PL_ProcessPendingEvents()
	 nsEventQueueImpl::ProcessPendingEvents()
	 event_processor_callback()
	 our_gdk_io_invoke()
	 libglib-1.2.so.0 + 0x102ee (0x403a42ee)
	 libglib-1.2.so.0 + 0x11ad2 (0x403a5ad2)
	 libglib-1.2.so.0 + 0x11ee4 (0x403a5ee4)
	 libglib-1.2.so.0 + 0x122ac (0x403a62ac)
	 libgtk-1.2.so.0 + 0x972f3 (0x402b82f3)
	 nsAppShell::Run()
	 nsAppShellService::Run()
	 main1()
	 main()
	 libc.so.6 + 0x18503 (0x404cb503)     (5464559)	URL:
https://olo.office.altkom.com.pl/domowa/security/dalej.html
     (5464559)	Comments: bug 139108
     (5464240)	URL: https://olo.office.altkom.com.pl/domowa/security/dalej.html
     (5464240)	Comments: Mozilla crashes on self-referencing object tags. See
example:<OBJECT DATA="CRASH.HTM" TYPE="text/html"></OBJECT>
     (5424512)	Comments: loading word.net crashes mozilla (reproducible)
     (5424499)	Comments: loading two pages at once
     (5411540)	URL: http://www.techtv.com/screensavers/
     (5411540)	Comments: linked from slashdot.  kept getting a uid/passwd prompt; but I
don't have a uid/passwd  so I kept cancelling -- BUT THE PROMPT WOULD NOT GO
AWAY and I COULDN'T GET AROUND.I have the same problem with Mozilla MAIL; if the
POP server(s) are down (no
     (5411540)	Comments:  surprise from comcast) -- Mozilla MAIL keeps trying to connect. 
NOT GOOD.   The only way OUT is to manually KILL Mozilla.
     (5371767)	URL: http://sourceforge.net/forum/forum.php?forum=48211
     (5371767)	Comments: same as before.  this is after Win98 restart.  NOTE: does NOT
crash on a win2000 boxo.
     (5371568)	URL: http://sourceforge.net/forum/forum.php?forum=48211
     (5371568)	Comments: trying to load web page after crashing moz and restarting moz 
only.  will try to restart Win98 and try again.  if this is the last note  then
it didn't crash again.
     (5371478)	URL: http://sourceforge.net/forum/forum.php?forum=48211
     (5371478)	Comments: loading the web page

And a recent Windows incident with line numbers in the stack:
Incident ID 5541561
Stack Signature nsHTMLFrameInnerFrame::ShowDocShell e988e295
Email Address
Product ID MozillaTrunk
Build ID 2002042212
Trigger Time 2002-04-23 19:59:17
Platform Win32
Operating System Windows 98 4.10 build 67766222
Module GKLAYOUT.DLL
URL visited
User Comments
Trigger Reason Access violation
Source File Name
d:\builds\seamonkey\mozilla\layout\html\document\src\nsFrameFrame.cpp
Trigger Line No. 1010
Stack Trace
nsHTMLFrameInnerFrame::ShowDocShell
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsFrameFrame.cpp, line 1010]
nsHTMLFrameInnerFrame::Init
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsFrameFrame.cpp, line 1182]
nsHTMLFrameOuterFrame::Init
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsFrameFrame.cpp, line 363]
nsHTMLFramesetFrame::Init
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsFrameSetFrame.cpp, line 432]
nsCSSFrameConstructor::InitAndRestoreFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6656]
nsCSSFrameConstructor::ConstructHTMLFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 4923]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7270]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7158]
nsCSSFrameConstructor::ProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 12160]
nsCSSFrameConstructor::ConstructDocElementFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 3448]
nsCSSFrameConstructor::ContentInserted
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 8721]
StyleSetImpl::ContentInserted
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1525]
PresShell::InitialReflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2613]
HTMLContentSink::StartLayout
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 4013]
HTMLContentSink::CloseFrameset
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3400]
CNavDTD::CloseFrameset [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 3333]
CNavDTD::CloseContainer [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 3525]
CNavDTD::CloseContainersTo
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3579]
CNavDTD::CloseContainersTo
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3763]
CNavDTD::HandleEndToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 2004]
CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 893]
CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 520]
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1869]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1733]
nsParser::ContinueParsing
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1359]
HTMLContentSink::ScriptEvaluated
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 5110]
nsScriptLoader::FireScriptEvaluated
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 522]
nsScriptLoader::ProcessRequest
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 481]
nsScriptLoader::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 768]
nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 163]
nsHttpChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2879]
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 213]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 597]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 530]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1078]
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00648bfa
(Reporter)

Updated

16 years ago
Keywords: crash, nsbeta1, qawanted, topcrash
(Reporter)

Comment 1

16 years ago
Adding crash keywords and qawanted to see if we can get this reproduced. 
Nominating for nsbeta1.  I don't see any incident on the Mozilla1.0 branch, so
this might be a Trunk only regression.  

Crashes first showed up on 4/17 MozillaTrunk builds.
(Reporter)

Comment 2

16 years ago
Bug 52334 might have some clues...comment #106 in that bug mentions some fix in
nsHTMLFrameInnerFrame::ShowDocShell.  Cc'ing jst@netscape.com.
*** Bug 139929 has been marked as a duplicate of this bug. ***
i see a 100% crash with the URL from bug 139929
(http://www.typ.nl/kunst/sander/)

I see many warnings and an assertion before mozilla crashed (see the dupe)
(Assignee)

Comment 5

16 years ago
Taking bug, fix coming up.
Assignee: attinasi → jst
(Assignee)

Updated

16 years ago
Keywords: nsbeta1
(Assignee)

Comment 6

16 years ago
Matthias, thanks for the URL to the reproducable crash! Fixing this was trivial
once I saw the crash...
Status: NEW → ASSIGNED
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.0.1
(Assignee)

Comment 7

16 years ago
Created attachment 80965 [details] [diff] [review]
Don't crash when running into too deeply nested framesets.
Comment on attachment 80965 [details] [diff] [review]
Don't crash when running into too deeply nested framesets.

r=peterv
Attachment #80965 - Flags: review+
Comment on attachment 80965 [details] [diff] [review]
Don't crash when running into too deeply nested framesets.

sr=heikki
Attachment #80965 - Flags: superreview+

Comment 10

16 years ago
Changing QA Contact
QA Contact: petersen → amar
(Reporter)

Comment 11

16 years ago
Also, just wanted to ask to verify that this is a Trunk only issue. 

jst: This problem shouldn't be on the Mozilla1.0 branch, right?
(Assignee)

Comment 12

16 years ago
Right, this is trunk only, there is no nsHTMLFrameInnerFrame::ShowDocShell() on
the branch...
(Assignee)

Comment 13

16 years ago
Fix checked in.
(Assignee)

Comment 14

16 years ago
Marking fixed.
Status: ASSIGNED → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsHTMLFrameInnerFrame::ShowDocShell]
Keywords: qawanted
You need to log in before you can comment on or make changes to this bug.