149014 - Invalid mix of <h>, <center> and <input> fields can crash [@ nsBlockFrame::FirstChild][@ 0x00000a23]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P2)

Description

[Mark Hammond [:markh] [:mhammond]]

As reported in IRC.  Opening this ebay auction page will show increasingly huge
fonts as you scroll down.  Closing the page will crash the browser.  Spotted on
at least a couple of Win2k builds, and reported that it brings down the XServer
on a couple of Linux configurations!  Crashes branch - will check trunk after I
submit this bug. Win2k debug build shows crash data clearly after spewing loads
of fairly grim assertion failures (export XPCOM_DEBUG_BREAK=warn ;-)

The error is in the user supplied HTML, not the core ebay page layout.

I have narrowed the crash down to a fairly small html sample.  This HTML sample
is quite "fragile" in that (a) at least one user reports the ebay page crashes
but the HTML sample does not, and (b) changing (almost) *anything* in the sample
stops the crash occuring (eg, removing any further tags makes it "work" lines)

I am reporting the strange behaviour with the unterminated <h*><center> tags
growing fonts to an unacceptable size as a separate bug - that is much simpler
to repro in simple HTML and doesn't cause a crash in its own right - although I
do suspect they are related.

Comment 1

[Mark Hammond [:markh] [:mhammond]]

Attachment: Minimal HTML file I can create that also crashes

Obviously invalid HTML, but that isn't the point :)  This seems to crash less
reliably than the ebay page listed in the URL.

Comment 2

[Mark Hammond [:markh] [:mhammond]]

Crashes trunk and branch.

Comment 3

[Mason]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.0rc2) Gecko/2002051006

TB6994966X

Comment 4

[beanladen]

Linux RC3: Crashes also when scrolling the page up and down

Comment 5

[greer]

Attachment: Stacks

Here are the stacks from my crash (at the ebay site, using Trunk build
20020603xx) and Shill's crash (comment #3), from an earlier build.

Comment 6

[joakim_46]

Confirming it with build 2002052306 under Windows ME. Talkback ID TB7004147E

Comment 7

[Mark Hammond [:markh] [:mhammond]]

FYI, the less-critical bug on the font size zooming (that I suspect as being
related) is bug 149015

Comment 8

[Andrew Schultz]

Attachment: testcase

testcase from bug 150339, which may or may not be a dupe.  I get the same
behavior there and here (hang), and it seems to be caused by huge fonts in both
places.  

Anyway, this is a simpler testcase that will probably induce the same response.

Comment 9

[Daniel S Kurushin]

Unlike 150339 this bug could not be "switched off" by setting parameter "Allow
documents to use other fonts" to false.

Comment 10

[Nathan Strom]

Using Moz 1.0 RC 2 under WinNT Workstation 4... Font got bigger and bigger as I scrolled down, but I did not experience any crashing, just slowness/freezing if I dragged the vertical scroll bar all the way to the bottom.

Comment 11

[Mark Hammond [:markh] [:mhammond]]

This bug has shifted a little (for me anyway):

* The ebay page in the URL no longer crashes for me.  HTML test case does still
crash.

* The crashing of the xserver on Linux appears fixed by bug 150339.  Mozilla now
just seg-faults nice and cleanly :)

All true on Windows branch and trunk, and Linux trunk.

Comment 12

[Boris Zbarsky [:bzbarsky]]

HTML testcase does not crash for me... Mark, are you still seeing a crash?

Comment 13

[Bob Clary [:bc] (inactive)]

I don't see crashes on the url or the test cases in a moz1.7/winxp build either.
This is pretty old, can we close it out ?

Comment 14

[Anne (:annevk)]

WMF per comments.

Comment 15

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/54417ebbaea2