17546 - CSS page causes browser to fail

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[Igor]

When opening the above URL the page crashes.  This page is done entirely with
CSS and Frames.  Most of the frame contents are shown on the screen, but at the
point where the browser pulls them into the frames and applies the CSS colors,
the browser crashes.

Comment 1

[leger]

chrisd, can you try to reproduce with latest build and provide input.

[e-mail] - could you please read:
http://www.mozilla.org/quality/bug-writing-guidelines.html
and use:
http://www.mozilla.org/quality/bug-template.html
This will help us confirm and fix bugs faster.  Thanks!

Comment 2

[Pierre Saslawsky]

It crashes with a jump-to-nil with today's optimized builds on Mac and WinNT.
A debug build on Mac shows that 'aReflowState.mSpaceManager' is deleted before it
is passed to nsBlockReflowState::nsBlockReflowState(). Reassigned to Troy.

Comment 3

[Christine Hoffman]

Tested using build 1999110908 on Win 95. Application crashed. Talkback incident
#534148.

Details:
MOZILLA caused an invalid page fault in
module GKHTML.DLL at 014f:6018df9c.
Registers:
EAX=0063ec34 CS=014f EIP=6018df9c EFLGS=00010246
EBX=00000000 SS=0157 ESP=0063ec28 EBP=0063ec38
ECX=0063ec30 DS=0157 ESI=0063ec7c FS=7977
EDX=00000000 ES=0157 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 37 89 45 f8 e8 69 49 ff ff 50 57 ff 56 18 8b
Stack dump:
0063ef20 0063ec7c 6025d31c 00000000 0063ec58 601a3d6d 024af7f0 00000000 00000000
0063f16c 0063eedc 024a1060 0063ee60 601a4795 0063eedc 02404d10

Call Stack:    (Signature = nsFrame::Destroy 7969549d)
nsFrame::Destroy
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrame.cpp,line 346]
nsBlockReflowState::nsBlockReflowState
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 577]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1410]
nsAreaFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 294]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
428]
nsHTMLButtonControlFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsHTMLButtonControlFrame.cpp,
line 598]
nsGfxButtonControlFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsGfxButtonControlFrame.cpp,
line 196]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 282]
nsAbsoluteContainingBlock::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 151]
nsAreaFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 315]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
428]
RootFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 335]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
428]
nsScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollFrame.cpp, line 622]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
428]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 514]
nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line
140]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1617]
PresShell::ExitReflowLock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 711]
PresShell::ReconstructFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2122]
PresShell::StyleSheetAdded
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2130]
nsDocument::InsertStyleSheetAt
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1322]
CSSLoaderImpl::InsertSheetInDoc
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 999]
InsertPendingSheet
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 616]
nsVoidArray::EnumerateForwards
[d:\builds\seamonkey\mozilla\xpcom\ds\nsVoidArray.cpp, line 407]
CSSLoaderImpl::Cleanup
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 674]
CSSLoaderImpl::ParseSheet
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 771]

Comment 4

[Christine Hoffman]

Changing platform to 'All'

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Changing OS to All since Platform changed to All.

Comment 6

[Christine Hoffman]

Tested using 11/16 builds on Win, Mac and Linux. Takes a few minutes to load on
each platform, but there are no crashes. Verifying bug fixed.