160228 - going back to a bugzilla page triggered stack overflow? [@ nsCSSFrameConstructor::ConstructFrameByDisplayType]

Status: VERIFIED DUPLICATE of bug 323394

(Core :: Layout, defect)

Description

[timeless]

tb8826536y
Stack Signature  ntdll.dll + 0x4b007 (0x77fcb007) e096b1f7
Email Address [e-mail]
Product ID MozillaTrunk
Build ID 2002072808
Trigger Time 2002-07-30 15:51:52
Platform Win32
Operating System Windows NT 5.0 build 2195
Module ntdll.dll
URL visited going back
User Comments
Trigger Reason Access violation
Source File Name
Trigger Line No.
Stack Trace

ntdll.dll + 0x4b007 (0x77fcb007)
MSVCRT.DLL + 0x1089 (0x78001089)
MSVCRT.DLL + 0x1026 (0x78001026)
nsComponentManager::CreateInstance
[c:/builds/seamonkey/mozilla/xpcom/components/nsComponentManagerObsolete.cpp,
line 103]
nsHTMLContainerFrame::CreateViewForFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 563]
nsCSSFrameConstructor::FinishBuildingScrollFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 6017]
nsCSSFrameConstructor::BuildScrollFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 6131]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 6285]
nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7410]
nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7259]
nsCSSFrameConstructor::CreateAnonymousFrames
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 5230]
nsCSSFrameConstructor::CreateAnonymousFrames
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 5168]
nsCSSFrameConstructor::ConstructHTMLFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 4992]
nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7371]
nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7259]
nsCSSFrameConstructor::ProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 12345]
nsCSSFrameConstructor::ConstructTableCellFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 2915]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3180]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3075]
nsCSSFrameConstructor::ConstructTableRowFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 2759]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3166]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3075]
nsCSSFrameConstructor::ConstructTableRowGroupFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 2650]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3160]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 3075]
nsCSSFrameConstructor::ConstructTableFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 2531]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 6576]

the stack doesn't have a proper bottom, so i'm pretty sure this is a stack overflow.

Comment 1

[Madhur Bhatia]

do you still see this bug ?

Comment 2

[timeless]

i crash in all sorts of ways, crashes like this need to be analyzed based on the
code instead of based on whether they're reproducable.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Probably duplicate of a bug about the frame tree depth limiting not being sufficient, or something like that.

Comment 4

[Jesse Ruderman]

dbaron, is bug 323394 what you're thinking of?

It's not obvious to me why a bug list would trigger that.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Not really sure.  We probably need to do better measurement to figure out what the limits ought to be.