142609 - instant crash on page load [@ nsBlockBandData::ComputeAvailSpaceRect ] Trunk M11A M100

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P2)

Description

[jdaras1]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc1)
Gecko/20020417
BuildID:    2002041711

Loading/accessing the page http://www.big-bunny.com causes an instant crash of
Mozilla.  Error dialogue reports "mozilla.exe has generated errors and will be
closed by Windows...An error log is being created."

Reproducible: Always
Steps to Reproduce:
1. Start up Mozilla.
2. Enter http://www.big-bunny.com or www.big-bunny.com into the top URL bar.
3. Hit enter and Mozilla will immediately crash.

Actual Results:  Error dialogue reports "mozilla.exe has generated errors and
will be closed by Windows...An error log is being created."

Expected Results:  Page should load.

Works fine with IE 5.  Running Win 2k with SP2.

Comment 1

[R.K.Aa.]

WFM, 2002050504, XP. There is a flash plugin on the page. Do you have flash
installed?

Comment 2

[jdaras1]

Shockwave Flash 6.0 r23
    File name: C:\Program Files\mozilla.org\Mozilla\plugins\NPSWF32.dll

Enabled:

application/x-shockwave-flash Macromedia Flash movie (*.swf) swf Yes
application/futuresplash FutureSplash movie (*.spl) spl Yes

(about:plugins)

Comment 3

[Olivier Cahagne]

wfm using build 2002050604 on Win2k + Flash 6.0r29.

Comment 4

[gabriel]

Just crashed for me with Linux 2002050109, flash 5 r48.

Talkback TB6001929W.

Comment 5

[Doron Rosenberg (IBM)]

Stack Signature  nsBlockBandData::ComputeAvailSpaceRect() 0e0bde26
Email Address [e-mail]
Product ID Netscape7.0PR1
Build ID 2002050109
Trigger Time 2002-05-06 15:29:55
Platform LinuxIntel
Operating System Linux 2.4.18-13mdk
Module libgklayout.so
URL visited Bug 142609
User Comments
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Source File Name
Trigger Line No.
Stack Trace
nsBlockBandData::ComputeAvailSpaceRect()
nsBlockBandData::GetAvailableSpace()
nsBlockReflowState::GetAvailableSpace()
nsBlockFrame::PropagateFloaterDamage()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
CanvasFrame::Reflow()
nsBoxToBlockAdaptor::Reflow()
nsBoxToBlockAdaptor::DoLayout()
nsBox::Layout()
nsScrollBoxFrame::DoLayout()
nsBox::Layout()
nsContainerBox::LayoutChildAt()
nsGfxScrollFrameInner::LayoutBox()
nsGfxScrollFrameInner::Layout()
nsGfxScrollFrame::DoLayout()
nsBox::Layout()
nsBoxFrame::Reflow()
nsGfxScrollFrame::Reflow()
nsContainerFrame::ReflowChild()
ViewportFrame::Reflow()
nsHTMLReflowCommand::Dispatch()
PresShell::ProcessReflowCommand()
PresShell::ProcessReflowCommands()
HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke() 

Comment 6

[gabriel]

Trying layout...

Comment 7

[R.K.Aa.]

WFM on linux, trunk CVS build 1 to 2 days old. (Flash 6.0 r23 via Crossover)
Is this branch only?

Comment 8

[Matthias Versen [:Matti]]

default owner

Comment 9

[Chris Waterson]

This usually means somebody forgot to create a space manager.

Comment 10

[Chris Petersen]

Attachment: Reduced test case from big-bunny site

Reduced test case contains two object elements that reference flash content.
First object is contained in a table ; the second object is contained in a DIV.
In the DIV element, the Object element is contained in a P element.

Comment 11

[Kevin McCluskey (gone)]

Reassigning to Alex

Comment 12

[greer]

*** Bug 156965 has been marked as a duplicate of this bug. ***

Comment 13

[greer]

Bringing forward the topcrash keyword from bug 156965 (with a testcase, now
topcrash+), because Alex loves those and needs less sleep.

Comment 14

[Alexandru Savulov]

exactly, less sleep and more double-esspresso-shot lates for $4.00 each (tip
included). sleep is for little babies anyway :-)

Comment 15

[Andrew Schultz]

looking at the testcase and the URLs from bug 156965 on Linux:
release 1.0 crashes, but 1.1alpha and recent nightly builds (trunk and branch)
work fine.  Also, all the talkback reports that I see are Win NT.

Do Windows builds crash on the testcase here (or just the URLs from bug 156965)?

Comment 16

[jdaras1]

WFM now with 1.1 alpha release on Windows 2k SP2 (same system as original
report).  Both test case and URL (www.big-bunny.com) seem to work as intended.

Comment 17

[Jaime Rodriguez, Jr.]

petersen: chris, is this crash in the 1.0 branch?

Comment 18

[Chris Petersen]

Let me try the latest branch.

Comment 19

[Shiva Thirumazhusai]

According to the summary :- 
  Trunk builds ->Trunk M11A 
  Branch builds - > M100

Comment 20

[Chris Petersen]

WFM with the OS X (2002-07-22-05 1.0.0) and Windows ME (2002-07-22-08 1.0.0) builds.

Comment 21

[ly nguyen]

with 5 wfm and talkback data not showing this stack sig in the reports for
Trunk, M11A, M100 nor in M11B so marking wfm.