140442 - crash when publish or save this page [@ nsHTMLReflowState::DetermineFrameType]

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect, P3)

Description

[Pete Boyd]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc1)
Gecko/20020424
BuildID:    2002042406 (1.0 branch) and 2002042510/2002042512 (trunk)

publishing this document:
http://www.thegoldenear.connectfree.co.uk/gg/toolbox/computing-system-roadmap.html
crashes Mozilla

talkback ID: TB5655344Z (there were more but they didn't get saved in my
talkback list, despite my having chosen to)

Reproducible: Always
Steps to Reproduce:
1. edit page (see URL above)
2. make a change on the page
3. choose Publish

Actual Results:  after some activity with the dialog, Mozilla crashes

Expected Results:  site should get published

this worked earlier in the day, when I tried publishing it for the first time

Comment 1

[Pete Boyd]

forgot to mention, I'm loading this document from the 'Recent Pages' menu option
and its listed as http:// so its being pulled from the web

Comment 2

[Pete Boyd]

I have to update this page I've referenced so I'm saving the version of the
document I had the crash with as:
http://www.thegoldenear.connectfree.co.uk/gg/toolbox/computing-system-roadmap-crasher.html

allthough the problem may not be to do with the actual page but rather the
publishing process

Whilst publishing this page, the publishing wizard was unexpectedly also
uploading _001.html and _002.html:
http://www.thegoldenear.connectfree.co.uk/gg/toolbox/_001.html
http://www.thegoldenear.connectfree.co.uk/gg/toolbox/_002.html

one of which is a copy of the root index.htm:
http://www.thegoldenear.connectfree.co.uk/

and the other was gnu.org's page descrbing copyleft (which I'll have linked to
somewhere on one of my pages)

I'm now going to wipe out my publishing settings, set them up again and give it
another go

Comment 3

[sujay]

--> cmanske

Comment 4

[michael wendell]

I am seeing this problem on the 04-29 trunk build.

My steps to reproduce:
1. Load above URL in browser
2. Click on File - Edit page
3. Type a word to change the page
4. Click on the Publish icon on the toolbar

Crash Talkback ID: TB5734882K

Comment 5

[Kathleen :Brade]

Can this crash be reproduced by saving the file locally (instead of publishing)?

Here's some info (including the stack) from Michael's talkback ID:
Source File Name  nsHTMLReflowState.cpp
Trigger Line No. 361
Stack Trace
nsHTMLReflowState::DetermineFrameType [nsHTMLReflowState.cpp, line 361]
nsHTMLReflowState::Init [nsHTMLReflowState.cpp, line 275]
nsHTMLReflowState::nsHTMLReflowState [nsHTMLReflowState.cpp, line 250]
nsLineLayout::ReflowFrame [nsLineLayout.cpp, line 981]
nsInlineFrame::ReflowInlineFrame [nsInlineFrame.cpp, line 732]
nsInlineFrame::ReflowFrames [nsInlineFrame.cpp, line 532]
nsInlineFrame::Reflow [nsInlineFrame.cpp, line 448]
nsLineLayout::ReflowFrame [nsLineLayout.cpp, line 1089]
nsBlockFrame::ReflowInlineFrame [nsBlockFrame.cpp, line 3578]
nsBlockFrame::DoReflowInlineFrames [nsBlockFrame.cpp, line 3456]
nsBlockFrame::DoReflowInlineFramesAuto [nsBlockFrame.cpp, line 3381]
nsBlockFrame::ReflowInlineFrames [nsBlockFrame.cpp, line 3326]
nsBlockFrame::ReflowLine [nsBlockFrame.cpp, line 2484]
nsBlockFrame::ReflowDirtyLines [nsBlockFrame.cpp, line 2128]
nsBlockFrame::Reflow [nsBlockFrame.cpp, line 864]
nsBlockReflowContext::DoReflowBlock [nsBlockReflowContext.cpp, line 581]
nsBlockReflowContext::ReflowBlock [nsBlockReflowContext.cpp, line 359]
nsBlockFrame::ReflowBlockFrame [nsBlockFrame.cpp, line 3082]
nsBlockFrame::ReflowLine [nsBlockFrame.cpp, line 2350]
nsBlockFrame::ReflowDirtyLines [nsBlockFrame.cpp, line 2128]
nsBlockFrame::Reflow [nsBlockFrame.cpp, line 864]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableCellFrame::Reflow [nsTableCellFrame.cpp, line 959]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableRowFrame::IR_TargetIsChild [nsTableRowFrame.cpp, line 1300]
nsTableRowFrame::IncrementalReflow [nsTableRowFrame.cpp, line 1192]
nsTableRowFrame::Reflow [nsTableRowFrame.cpp, line 1453]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableRowGroupFrame::IR_TargetIsChild [nsTableRowGroupFrame.cpp, line 1623]
nsTableRowGroupFrame::IncrementalReflow [nsTableRowGroupFrame.cpp, line 1294]
nsTableRowGroupFrame::Reflow [nsTableRowGroupFrame.cpp, line 1203]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableFrame::IR_TargetIsChild [nsTableFrame.cpp, line 3164]
nsTableFrame::IncrementalReflow [nsTableFrame.cpp, line 2880]
nsTableFrame::Reflow [nsTableFrame.cpp, line 2114]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableOuterFrame::OuterReflowChild [nsTableOuterFrame.cpp, line 1028]
nsTableOuterFrame::IR_InnerTableReflow [nsTableOuterFrame.cpp, line 1345]
nsTableOuterFrame::IR_TargetIsInnerTableFrame [nsTableOuterFrame.cpp, line 1134]
nsTableOuterFrame::IR_TargetIsChild [nsTableOuterFrame.cpp, line 1124]
nsTableOuterFrame::IncrementalReflow [nsTableOuterFrame.cpp, line 1087]
nsTableOuterFrame::Reflow [nsTableOuterFrame.cpp, line 1585]
nsBlockReflowContext::DoReflowBlock [nsBlockReflowContext.cpp, line 581]
nsBlockReflowContext::ReflowBlock [nsBlockReflowContext.cpp, line 359]
nsBlockFrame::ReflowBlockFrame [nsBlockFrame.cpp, line 3082]
nsBlockFrame::ReflowLine [nsBlockFrame.cpp, line 2350]
nsBlockFrame::ReflowDirtyLines [nsBlockFrame.cpp, line 2128]
nsBlockFrame::Reflow [nsBlockFrame.cpp, line 864]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableCellFrame::Reflow [nsTableCellFrame.cpp, line 959]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableRowFrame::IR_TargetIsChild [nsTableRowFrame.cpp, line 1300]
nsTableRowFrame::IncrementalReflow [nsTableRowFrame.cpp, line 1192]
nsTableRowFrame::Reflow [nsTableRowFrame.cpp, line 1453]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableRowGroupFrame::IR_TargetIsChild [nsTableRowGroupFrame.cpp, line 1623]
nsTableRowGroupFrame::IncrementalReflow [nsTableRowGroupFrame.cpp, line 1294]
nsTableRowGroupFrame::Reflow [nsTableRowGroupFrame.cpp, line 1203]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableFrame::IR_TargetIsChild [nsTableFrame.cpp, line 3164]
nsTableFrame::IncrementalReflow [nsTableFrame.cpp, line 2880]
nsTableFrame::Reflow [nsTableFrame.cpp, line 2114]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
nsTableOuterFrame::OuterReflowChild [nsTableOuterFrame.cpp, line 1028]

Comment 6

[Pete Boyd]

I'm glad Michael was able to reproduce this. I got all confused about this bug
when trying to reproduce it yesterday, cos when you choose Publish, the Publish
dialog chooses the site location to publish to as:
http://www.thegoldenear.connectfree.co.uk/gg/toolbox/ rather than the ftp
address I usually use, of-course, and I couldn't remember whether I'd chosen my
ftp address or this http address when I created the bug report. it seems
counter-intuitive that the Publish dialog chooses an http address as don't these
things always use ftp to publish? (or am I showing my lack of knowledge of 'HTTP
PUT' or something?)

when reproducing this bug now, using Mozilla 2002042706 (1.0 branch):
- trying to publish to the http address I get the dialog seemingly working away
at something forever
- choosing 'save as' opens the save dialog, Mozilla claims 99% of CPU resources,
I choose 'ok' to save and Mozilla crashes (Talkback ID: TB5737491E)
- choosing instead to publish to my pre-configured ftp address works ok

Comment 7

[Kathleen :Brade]

I haven't had a chance yet to look at this particular web page.
Can we get a minimal testcase that causes the crash or is the url above already
minimal?

This seems like a core bug in layout somewhere...
-->Editor:Core

I would guess that loading the page in the browser and doing save as (HTML
Complete) would also produce this crash.  Could someone confirm that?


The talkback info for the crash from the save is very similar:
User Comments   crash saving web page to disk from Composer
Trigger Reason Access violation
Source File Name
d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowState.cpp
Trigger Line No. 383
Stack Trace
nsHTMLReflowState::DetermineFrameType
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowState.cpp, line 383]
nsHTMLReflowState::Init
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowState.cpp, line 267]
nsHTMLReflowState::nsHTMLReflowState
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowState.cpp, line 242]
nsLineLayout::ReflowFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp, line 981]
nsInlineFrame::ReflowInlineFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsInlineFrame.cpp, line 732]
nsInlineFrame::ReflowFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsInlineFrame.cpp, line 532]
nsInlineFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsInlineFrame.cpp, line 448]
nsLineLayout::ReflowFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineLayout.cpp, line 1089]
nsBlockFrame::ReflowInlineFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3691]
nsBlockFrame::DoReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3572]
nsBlockFrame::DoReflowInlineFramesAuto
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3497]
nsBlockFrame::ReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3442]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2600]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2239]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3198]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2466]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2239]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 959]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableRowFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1300]
nsTableRowFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1192]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1453]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableRowGroupFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1623]
nsTableRowGroupFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1294]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1203]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 3164]
nsTableFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2880]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2114]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1028]
nsTableOuterFrame::IR_InnerTableReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1345]
nsTableOuterFrame::IR_TargetIsInnerTableFrame
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1134]
nsTableOuterFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1124]
nsTableOuterFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1087]
nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 1585]
nsBlockReflowContext::DoReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
581]
nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
359]
nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3198]
nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2466]
nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2239]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 846]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 959]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableRowFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1300]
nsTableRowFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1192]
nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 1453]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableRowGroupFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1623]
nsTableRowGroupFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1294]
nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1203]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 3164]
nsTableFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2880]
nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2114]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
nsTableOuterFrame::OuterReflowChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line
1028] 

Comment 8

[Pete Boyd]

the page currently specified isn't minimal. I'll try to create one

loading the page in the browser and doing save as (HTML
Complete) works OK

Comment 9

[Pete Boyd]

[Mozilla 2002043006 (1.0 branch)]
in attempting to create a stripped down test case, I opened the document from
local disk, removed everything in the document apart from the title, the footer
and bottom bullet point, saved as a new name and Mozilla crashed (Talkback ID:
TB5844115Q)

repeated attempts failed to repeat the crash

With this newer build, trying to publish this stripped down page, to the HTTP
address provided by default by the Publishing dialog (which shouldn't work as an
address to publish to), with the username and password field left blank and
'include images and other files' de-selected, I get a 'Publishing completed' message

if I choose to select 'include images and other files' I get a 'x' for 2 files
(the content itself and a .txt CSS file), and a tick for _001.html, _002.html
and screen.txt (a .txt CSS file) and a 'Some files failed to publish' message
(and a 'cancel' button - shouldn't that be an 'ok' button?)

I now see why the _001.html and _002.html are included in uploads - I looked at
the source and they're my links for the Navigation Bar. they used to be URLs now
theyre files. similarly with the .TXT files are my CSS files with a changed
extension. I assume Mozilla has made these changes, but I'm not certain. and I
don't know if they relate to this bug as a consequence or cause or anything

Comment 10

[Asa Dotzler [:asa]]

unable to reproduce a crash either publishing (though it failed because I don't
have the credentials) or saving. Tested with windows Mozilla 1.7 beta. Please
reopen if you can reproduce with a contemporary build. Thanks.