Closed Bug 162855 Opened 23 years ago Closed 23 years ago

Regression Trunk crashes [@ nsCSSFrameConstructor::TableProcessChild ]

Categories

(Core :: Layout, defect)

x86
Windows 2000
defect
Not set
blocker

Tracking

()

RESOLVED FIXED

People

(Reporter: greer, Assigned: bzbarsky)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

Attachments

(1 file)

The 2002081409 Windows Trunk build is crashing in nsCSSFrameConstructor.cpp. Based on the checkins info in LXR, it is possibly due to Boris' checkin of Leon's patch for bug 159359. cc'ing both of them. The user comment don't point to specific behavior. One user was able to consistently reproduce the crash by going to this site: www.gene-chips.com. However, that site WFM. Crash data range: 2002-08-14 to 2002-08-14 Build ID range: 2002081409 to 2002081409 Stack Trace: nsCSSFrameConstructor::TableProcessChild [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3198] nsCSSFrameConstructor::TableProcessChildren [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3073] nsCSSFrameConstructor::ProcessChildren [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 12336] nsCSSFrameConstructor::ConstructTableCaptionFrame [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 2587] nsCSSFrameConstructor::TableProcessChild [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3143] nsCSSFrameConstructor::TableProcessChildren [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3073] nsCSSFrameConstructor::ConstructTableFrame [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 2531] nsCSSFrameConstructor::ConstructFrameByDisplayType [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 6578] nsCSSFrameConstructor::ConstructFrameInternal [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 7412] nsCSSFrameConstructor::ConstructFrame [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 7261] nsCSSFrameConstructor::ProcessChildren [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 12348] nsCSSFrameConstructor::ConstructTableCellFrame [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 2915] nsCSSFrameConstructor::TableProcessChild [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3178] nsCSSFrameConstructor::TableProcessChildren [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3073] nsCSSFrameConstructor::ConstructTableRowFrame [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 2759] nsCSSFrameConstructor::TableProcessChild [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3164] nsCSSFrameConstructor::TableProcessChildren [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3073] nsCSSFrameConstructor::ConstructTableRowGroupFrame [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 2650] nsCSSFrameConstructor::TableProcessChild [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3158] nsCSSFrameConstructor::TableProcessChildren [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 3073] nsCSSFrameConstructor::ConstructTableFrame [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 2531] nsCSSFrameConstructor::ConstructFrameByDisplayType [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 6578] nsCSSFrameConstructor::ConstructFrameInternal [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 7412] nsCSSFrameConstructor::ConstructFrame [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 7261] nsCSSFrameConstructor::ContentAppended [c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp line 8512] StyleSetImpl::ContentAppended [c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp line 1527] PresShell::ContentAppended [c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp line 5242] nsDocument::ContentAppended [c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp line 2124] nsHTMLDocument::ContentAppended [c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLDocument.cpp line 1390] HTMLContentSink::NotifyAppend [c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp line 4650] SinkContext::FlushTags [c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp line 1947] HTMLContentSink::CloseBody [c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp line 3019] CNavDTD::CloseBody [c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp line 3192] CNavDTD::CloseContainer [c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp line 3524] CNavDTD::CloseContainersTo [c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp line 3590] CNavDTD::CloseContainersTo [c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp line 3774] CNavDTD::DidBuildModel [c:/builds/seamonkey/mozilla/htmlparser/src/CNavDTD.cpp line 611] nsParser::DidBuildModel [c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp line 1263] nsParser::ResumeParse [c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp line 1805] nsParser::OnStopRequest [c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp line 2434] nsDocumentOpenInfo::OnStopRequest [c:/builds/seamonkey/mozilla/uriloader/base/nsURILoader.cpp line 256] nsStreamListenerTee::OnStopRequest [c:/builds/seamonkey/mozilla/netwerk/base/src/nsStreamListenerTee.cpp line 66] nsHttpChannel::OnStopRequest [c:/builds/seamonkey/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp line 2966] nsOnStopRequestEvent::HandleEvent [c:/builds/seamonkey/mozilla/netwerk/base/src/nsRequestObserverProxy.cpp line 213] PL_HandleEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 597] PL_ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 530] _md_EventReceiverProc [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 1078] KERNEL32.DLL + 0x242e7 (0xbff942e7) 0x00648bf6
keywords -> crash, regression, topcrash, zt4newcrash severity -> blocker
Severity: critical → blocker
Boris, I'm reassigning this one to you while you look into it because the default owner (attinasi) isn't going to.
Assignee: attinasi → bzbarsky
when looking at assembly it's dying on the instuction where it's dereferencing a null pointer: EAX:00000000 60721031 8b4804 mov ecx,[eax+0x4] but when viewing the source code where talkback has it dying on 3198: 3189 nsCOMPtr<nsINodeInfo> parentNodeInfo, childNodeInfo; 3190 aChildContent->GetNodeInfo(*getter_AddRefs(childNodeInfo)); 3195 NS_ASSERTION(childNodeInfo || 3196 aChildContent->IsContentOfType(nsIContent::eTEXT), 3197 "Non-#text nodes should have a nodeinfo here!"); 3198 if (childNodeInfo) { none of these vars have a null value (locals and params). another oddity is that when i was looking the locals and params, |paginated| was allocated and had a value (albeit not a bool value either). since execution is landing on the default of the switch statement, seems weird that |paginated| was allocated. am i smoking crack?!
here's an attchment for the locals and params. hope this helps.
Well, although Talkback reports the crash at line 3198, the crash is actually either at line 3196 or 3197 (it's just a bug with Talkback that it reports the incorrect line by 1 or 2). So...the crash is most likely happening in the assertion statement somewhere.
maybe worth mentioning, when i looked at incident 9349209 the whole "data block" was blown away. i dunno how something could do that. to veterans: any ideas?
I checked in the fix for this at 2002-08-14 19:38 (see comments in bug 159359 comment 66 and following). The problem with comment 3 is that it's looking at the wrong version of nsCSSFrameConstructor.css -- the version after I checked in the fix for this crash. If you look at http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp&rev=1.759#3192, that is the line that was actually crashing.
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
*** Bug 162884 has been marked as a duplicate of this bug. ***
Crash Signature: [@ nsCSSFrameConstructor::TableProcessChild ]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: