Closed
Bug 162855
Opened 23 years ago
Closed 23 years ago
Regression Trunk crashes [@ nsCSSFrameConstructor::TableProcessChild ]
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: greer, Assigned: bzbarsky)
References
Details
(Keywords: crash, regression, topcrash)
Crash Data
Attachments
(1 file)
1.66 KB,
text/plain
|
Details |
The 2002081409 Windows Trunk build is crashing in nsCSSFrameConstructor.cpp.
Based on the checkins info in LXR, it is possibly due to Boris' checkin of
Leon's patch for bug 159359.
cc'ing both of them.
The user comment don't point to specific behavior. One user was able to
consistently reproduce the crash by going to this site: www.gene-chips.com.
However, that site WFM.
Crash data range: 2002-08-14 to 2002-08-14
Build ID range: 2002081409 to 2002081409
Stack Trace:
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3198]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3073]
nsCSSFrameConstructor::ProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 12336]
nsCSSFrameConstructor::ConstructTableCaptionFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 2587]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3143]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3073]
nsCSSFrameConstructor::ConstructTableFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 2531]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 6578]
nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 7412]
nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 7261]
nsCSSFrameConstructor::ProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 12348]
nsCSSFrameConstructor::ConstructTableCellFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 2915]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3178]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3073]
nsCSSFrameConstructor::ConstructTableRowFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 2759]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3164]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3073]
nsCSSFrameConstructor::ConstructTableRowGroupFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 2650]
nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3158]
nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 3073]
nsCSSFrameConstructor::ConstructTableFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 2531]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 6578]
nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 7412]
nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 7261]
nsCSSFrameConstructor::ContentAppended
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp
line 8512]
StyleSetImpl::ContentAppended
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp line 1527]
PresShell::ContentAppended
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp line 5242]
nsDocument::ContentAppended
[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp line 2124]
nsHTMLDocument::ContentAppended
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLDocument.cpp line 1390]
HTMLContentSink::NotifyAppend
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp
line 4650]
SinkContext::FlushTags
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp
line 1947]
HTMLContentSink::CloseBody
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp
line 3019]
CNavDTD::CloseBody [c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp line
3192]
CNavDTD::CloseContainer [c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp
line 3524]
CNavDTD::CloseContainersTo
[c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp line 3590]
CNavDTD::CloseContainersTo
[c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp line 3774]
CNavDTD::DidBuildModel [c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp
line 611]
nsParser::DidBuildModel [c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp
line 1263]
nsParser::ResumeParse [c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp
line 1805]
nsParser::OnStopRequest [c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp
line 2434]
nsDocumentOpenInfo::OnStopRequest
[c:/builds/seamonkey/mozilla/uriloader/base/nsURILoader.cpp line 256]
nsStreamListenerTee::OnStopRequest
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsStreamListenerTee.cpp line 66]
nsHttpChannel::OnStopRequest
[c:/builds/seamonkey/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp line 2966]
nsOnStopRequestEvent::HandleEvent
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsRequestObserverProxy.cpp line 213]
PL_HandleEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 597]
PL_ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c
line 530]
_md_EventReceiverProc [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line
1078]
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00648bf6
keywords -> crash, regression, topcrash, zt4newcrash
severity -> blocker
Severity: critical → blocker
Boris, I'm reassigning this one to you while you look into it because the
default owner (attinasi) isn't going to.
Assignee: attinasi → bzbarsky
when looking at assembly it's dying on the instuction where it's dereferencing a
null pointer:
EAX:00000000
60721031 8b4804 mov ecx,[eax+0x4]
but when viewing the source code where talkback has it dying on 3198:
3189 nsCOMPtr<nsINodeInfo> parentNodeInfo, childNodeInfo;
3190 aChildContent->GetNodeInfo(*getter_AddRefs(childNodeInfo));
3195 NS_ASSERTION(childNodeInfo ||
3196 aChildContent->IsContentOfType(nsIContent::eTEXT),
3197 "Non-#text nodes should have a nodeinfo here!");
3198 if (childNodeInfo) {
none of these vars have a null value (locals and params). another oddity is that
when i was looking the locals and params, |paginated| was allocated and had a
value (albeit not a bool value either). since execution is landing on the
default of the switch statement, seems weird that |paginated| was allocated. am
i smoking crack?!
Comment 5•23 years ago
|
||
Well, although Talkback reports the crash at line 3198, the crash is actually
either at line 3196 or 3197 (it's just a bug with Talkback that it reports the
incorrect line by 1 or 2). So...the crash is most likely happening in the
assertion statement somewhere.
maybe worth mentioning, when i looked at incident 9349209 the whole "data block"
was blown away. i dunno how something could do that. to veterans: any ideas?
![]() |
Assignee | |
Comment 7•23 years ago
|
||
I checked in the fix for this at 2002-08-14 19:38 (see comments in bug 159359
comment 66 and following).
The problem with comment 3 is that it's looking at the wrong version of
nsCSSFrameConstructor.css -- the version after I checked in the fix for this
crash. If you look at
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp&rev=1.759#3192,
that is the line that was actually crashing.
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
![]() |
Assignee | |
Comment 8•23 years ago
|
||
*** Bug 162884 has been marked as a duplicate of this bug. ***
Updated•14 years ago
|
Crash Signature: [@ nsCSSFrameConstructor::TableProcessChild ]
You need to log in
before you can comment on or make changes to this bug.
Description
•