Closed Bug 17798 Opened 25 years ago Closed 25 years ago

[dogfood] Crash loading cnn.com

Categories

(Core :: DOM: HTML Parser, defect, P3)

Product:
Core
Component:
DOM: HTML Parser
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: cpratt, Assigned: troy)

References

(
URL
)

Details

(Whiteboard: [PDT+])

Attachments

(2 files)

I tried to reduce the page into what causes the crash. Hope this helps.
1.45 KB, text/html
Details
Even smaller test case
225 bytes, text/html
Details 
Build ID: 1999110210 (Linux), 1999110208 (Mac OS, Win32)
Platform: all (Win32 sporadically, Mac OS and Linux regularly)

To reproduce:
- Launch the browser
- Load http://www.cnn.com

Result: you crash.

Expected result: you don't.

Talkback isn't working so I'm having difficulty getting a stack trace; I'll see
if I can at least get a Mac OS stdlog.
*** Bug 17401 has been marked as a duplicate of this bug. ***
Windows 98 Dr. Watson log is now at http://schist/17798.txt
Mac crash log at http://schist/17798-mac.txt
Assignee: rickg → troy
Troy -- this looks like it's ultimately crashing in GetPrimaryFrameFor().
Here's the top of the stack trace:

FindFrameWithContent(nsIFrame * 0x024d31d0, nsIContent * 0x024cb260, nsIContent
* 0x024c714c) line 7695 + 17 bytes
nsCSSFrameConstructor::FindPrimaryFrameFor(nsCSSFrameConstructor * const
0x01f853e0, nsIPresContext * 0x01faf450, nsIFrameManager * 0x01f84d60,
nsIContent * 0x024c714c, nsIFrame * * 0x0012e078) line 7782 + 22 bytes
StyleSetImpl::FindPrimaryFrameFor(StyleSetImpl * const 0x01f85480,
nsIPresContext * 0x01faf450, nsIFrameManager * 0x01f84d60, nsIContent *
0x024c714c, nsIFrame * * 0x0012e078) line 1049
FrameManager::GetPrimaryFrameFor(FrameManager * const 0x01f84d60, nsIContent *
0x024c714c, nsIFrame * * 0x0012e078) line 416
nsCSSFrameConstructor::FindPrimaryFrameFor(nsCSSFrameConstructor * const
0x01f853e0, nsIPresContext * 0x01faf450, nsIFrameManager * 0x01f84d60,
nsIContent * 0x024d246c, nsIFrame * * 0x0012e148) line 7780
StyleSetImpl::FindPrimaryFrameFor(StyleSetImpl * const 0x01f85480,
nsIPresContext * 0x01faf450, nsIFrameManager * 0x01f84d60, nsIContent *
0x024d246c, nsIFrame * * 0x0012e148) line 1049
FrameManager::GetPrimaryFrameFor(FrameManager * const 0x01f84d60, nsIContent *
0x024d246c, nsIFrame * * 0x0012e148) line 416
PresShell::GetPrimaryFrameFor(const PresShell * const 0x01f852d0, nsIContent *
0x024d246c, nsIFrame * * 0x0012e148) line 2034 + 32 bytes
nsCSSFrameConstructor::ContentChanged(nsCSSFrameConstructor * const 0x01f853e0,
nsIPresContext * 0x01faf450, nsIContent * 0x024d246c, nsISupports * 0x00000000)
line 6626
StyleSetImpl::ContentChanged(StyleSetImpl * const 0x01f85480, nsIPresContext *
0x01faf450, nsIContent * 0x024d246c, nsISupports * 0x00000000) line 972
PresShell::ContentChanged(PresShell * const 0x01f852d8, nsIDocument *
0x01fa6d20, nsIContent * 0x024d246c, nsISupports * 0x00000000) line 1834 + 46
bytes
nsDocument::ContentChanged(nsDocument * const 0x01fa6d20, nsIContent *
0x024d246c, nsISupports * 0x00000000) line 1471
nsGenericDOMDataNode::SetText(const unsigned short * 0x0012e478, int 3, int 1)
line 980
nsTextNode::SetText(nsTextNode * const 0x024d2470, const unsigned short *
0x0012e478, int 3, int 1) line 70 + 26 bytes
Target Milestone: M11
putting on m11 radar per leger
my linux build from today seems to load the page ok.
win32 still crashes.
on linux the page appears to load ok but the
throbber and progress bar contine to spin....
*** Bug 18181 has been marked as a duplicate of this bug. ***
Severity: major → critical
Summary: Crash loading cnn.com → [dogfood] Crash loading cnn.com
can't read news..., can't eat dogfood. :-(
Using the 1999110908 build under NT, I haven't been able to get cnn.com to crash
just yet today, but I am seeing the problem where the throbber &c. just keep on
spinning long after the page is loaded.
Guess what? It finally crashed on me. New Dr. Watson report at
http://schist/17798b.html in a few minutes. (1999110908 build, NT 4 SP 5.)
Whoops! Bad URL. Should be http://schist/17798b.txt .
*** Bug 18236 has been marked as a duplicate of this bug. ***
Whiteboard: [PDT+]
Putting on PDT+ radar.
Assignee: troy → karnaze
With the latest build I'm hitting an assert in the table code:

nsCellMap::GetCellInfoAt(int 0, int 0, int * 0x0012b178, int * 0x0012b17c) line
515 + 16 bytes
nsTableFrame::GetCellInfoAt(int 0, int 0, int * 0x0012b178, int * 0x0012b17c)
line 4082
BasicTableLayoutStrategy::AssignPreliminaryColumnWidths(int 3300) line 742 + 30
bytes
BasicTableLayoutStrategy::Initialize(nsSize * 0x0012b960, int 2, int 3300) line
112
nsTableFrame::BalanceColumnWidths(nsIPresContext & {...}, const
nsHTMLReflowState & {...}, const nsSize & {...}, nsSize * 0x0012b960) line 2882
nsTableFrame::Reflow(nsTableFrame * const 0x01b09bb8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1291
nsContainerFrame::ReflowChild(nsIFrame * 0x01b09bb8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x01b09b20, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 900 + 34 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01b09b20, const nsRect & {...},
int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x01b0dca8, int * 0x0012bad4) line 3234 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01b0dca8, int
* 0x0012bad4, int 0) line 2622 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2433 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x01b093a0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1490 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01b093a0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableCellFrame::Reflow(nsTableCellFrame * const 0x01b092f8, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 654
nsContainerFrame::ReflowChild(nsIFrame * 0x01b092f8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x01b06968,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 1040 + 34 bytes
nsTableRowFrame::Reflow(nsTableRowFrame * const 0x01b06968, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 1432 + 35 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01b06968, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const
0x01b05bb0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...},
RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000,
nsReflowReason eReflowReason_Initial, int 1, int 0) line 460 + 34 bytes
nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x01b05bb0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1040 + 38 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01b05bb0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x01b05a18, nsIPresContext
& {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason
eReflowReason_Initial, int 1) line 1402
nsTableFrame::Reflow(nsTableFrame * const 0x01b05a18, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1256 + 42 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01b05a18, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x01b05980, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 900 + 34 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01b05980, const nsRect & {...},
int 1, int 0, int 0, nsMargin & {...}, unsigned int & 0) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x01b101f8, int * 0x0012d19c) line 3234 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01b101f8, int
* 0x0012d19c, int 1) line 2622 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2433 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x01aad6b8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1490 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01aad6b8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableCellFrame::Reflow(nsTableCellFrame * const 0x01aad610, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 654
nsContainerFrame::ReflowChild(nsIFrame * 0x01aad610, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableRowFrame::IR_TargetIsChild(nsTableRowFrame * const 0x01a4d4e0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0, nsIFrame * 0x01aad610) line 1294 + 34 bytes
nsTableRowFrame::IncrementalReflow(nsTableRowFrame * const 0x01a4d4e0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0) line 1182 + 35 bytes
nsTableRowFrame::Reflow(nsTableRowFrame * const 0x01a4d4e0, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 1456 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01a4d4e0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableRowGroupFrame::IR_TargetIsChild(nsTableRowGroupFrame * const 0x01a4d458,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState &
{...}, unsigned int & 0, nsIFrame * 0x01a4d4e0) line 1510 + 34 bytes
nsTableRowGroupFrame::IncrementalReflow(nsTableRowGroupFrame * const 0x01a4d458,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState &
{...}, unsigned int & 0) line 1117 + 35 bytes
nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x01a4d458,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1026 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01a4d458, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableFrame::IR_TargetIsChild(nsTableFrame * const 0x01a4d2c0, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, InnerTableReflowState & {...}, unsigned int
& 0, nsIFrame * 0x01a4d458) line 2359 + 34 bytes
nsTableFrame::IncrementalReflow(nsTableFrame * const 0x01a4d2c0, nsIPresContext
& {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 2191 + 41 bytes
nsTableFrame::Reflow(nsTableFrame * const 0x01a4d2c0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1232 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01a4d2c0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableOuterFrame::IR_InnerTableReflow(nsTableOuterFrame * const 0x01a4d228,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 582 + 34 bytes
nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsTableOuterFrame * const
0x01a4d228, nsIPresContext & {...}, nsHTMLReflowMetrics & {...},
OuterTableReflowState & {...}, unsigned int & 0) line 377 + 31 bytes
nsTableOuterFrame::IR_TargetIsChild(nsTableOuterFrame * const 0x01a4d228,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0, nsIFrame * 0x01a4d2c0) line 350 + 31 bytes
nsTableOuterFrame::IncrementalReflow(nsTableOuterFrame * const 0x01a4d228,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 333 + 35 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x01a4d228, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 854 + 31 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01a4d228, const nsRect & {...},
int 1, int 0, int 0, nsMargin & {...}, unsigned int & 0) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x01a5cb38, int * 0x0012ea6c) line 3234 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01a5cb38, int
* 0x0012ea6c, int 1) line 2622 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2433 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x019434b8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1490 + 15 bytes
Troy, after Rod's change (11/9 afternoon> to nsCSSFrameConstructor, the stack is
as described on 11/4. If you have that change and something possibly later is
causing the stack to be as you describe, then reassign it to me.
Assignee: karnaze → troy
Assignee: troy → karnaze
Chris, I had a fresh pull and build of the tree, and that was the stack trace I
saw
Assignee: karnaze → troy
Troy, back to you since you are now seeing the same stack as me.
The problem seems to be related to the WipeContainingBlock() code that Kipp
added. It is causing us to destroy and recreate lots of frames...
Yes, that helps a lot. Thanks!
Attached file Even smaller test case — 

    
    

    
  
*** Bug 18589 has been marked as a duplicate of this bug. ***

    
  
Status: NEW → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED

    
  
Status: RESOLVED → REOPENED

    
  
Resolution: FIXED → ---

    
    

    
  
Not fixed on the mac.  The attachments work fine, but going to cnn.com
still crashes.

Win98 works on both the attachments and at cnn.com

Linux build crashes on startup - can't test yet.

Reopening for Mac.

    
  
Status: REOPENED → RESOLVED
Closed: 25 years ago → 25 years ago
Resolution: --- → FIXED

    
    

    
  
Re-marking as fixed
Apparently the build I have doesn't have the fix in it yet.  Will check again
tomorrow.

    
    

    
  
*** Bug 18215 has been marked as a duplicate of this bug. ***

    
  
Status: RESOLVED → REOPENED

    
    

    
  
I picked up the change to
mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp this morning (my tree is
now completely to date with all M11 changes) and I still crash when I go to
the "even smaller test case" attachment and click on the arrow on the
menu-box.

This is on OpenVMS. I don't have a completely up to date Linux version to
try. Can someone else try this?

Are you sure this is fixed?

    
  
Status: REOPENED → ASSIGNED

    
  
Status: ASSIGNED → RESOLVED
Closed: 25 years ago → 25 years ago

    
    

    
  
Look, it's fixed so stop re-opening the bug...

    
    

    
  
What you're describing is a completely different problem. The bug report is that
_loading_ the page is crashing.

Look at the stack trace you get when you click on the button and you'll see it's
completely unrelated

    
  
Status: RESOLVED → VERIFIED

    
    

    
  
seems to be fixed.
Verified.

    
    

    
  
*** Bug 19076 has been marked as a duplicate of this bug. ***

    
  
Blocks: 282239

    
    

    
      
  

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: