17798 - [dogfood] Crash loading cnn.com

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[cpratt]

Build ID: 1999110210 (Linux), 1999110208 (Mac OS, Win32)
Platform: all (Win32 sporadically, Mac OS and Linux regularly)

To reproduce:
- Launch the browser
- Load http://www.cnn.com

Result: you crash.

Expected result: you don't.

Talkback isn't working so I'm having difficulty getting a stack trace; I'll see
if I can at least get a Mac OS stdlog.

Comment 1

[Paul MacQuiddy]

*** Bug 17401 has been marked as a duplicate of this bug. ***

Comment 2

[cpratt]

Windows 98 Dr. Watson log is now at http://schist/17798.txt

Comment 3

[cpratt]

Mac crash log at http://schist/17798-mac.txt

Comment 4

[rickg]

Troy -- this looks like it's ultimately crashing in GetPrimaryFrameFor().
Here's the top of the stack trace:

FindFrameWithContent(nsIFrame * 0x024d31d0, nsIContent * 0x024cb260, nsIContent
* 0x024c714c) line 7695 + 17 bytes
nsCSSFrameConstructor::FindPrimaryFrameFor(nsCSSFrameConstructor * const
0x01f853e0, nsIPresContext * 0x01faf450, nsIFrameManager * 0x01f84d60,
nsIContent * 0x024c714c, nsIFrame * * 0x0012e078) line 7782 + 22 bytes
StyleSetImpl::FindPrimaryFrameFor(StyleSetImpl * const 0x01f85480,
nsIPresContext * 0x01faf450, nsIFrameManager * 0x01f84d60, nsIContent *
0x024c714c, nsIFrame * * 0x0012e078) line 1049
FrameManager::GetPrimaryFrameFor(FrameManager * const 0x01f84d60, nsIContent *
0x024c714c, nsIFrame * * 0x0012e078) line 416
nsCSSFrameConstructor::FindPrimaryFrameFor(nsCSSFrameConstructor * const
0x01f853e0, nsIPresContext * 0x01faf450, nsIFrameManager * 0x01f84d60,
nsIContent * 0x024d246c, nsIFrame * * 0x0012e148) line 7780
StyleSetImpl::FindPrimaryFrameFor(StyleSetImpl * const 0x01f85480,
nsIPresContext * 0x01faf450, nsIFrameManager * 0x01f84d60, nsIContent *
0x024d246c, nsIFrame * * 0x0012e148) line 1049
FrameManager::GetPrimaryFrameFor(FrameManager * const 0x01f84d60, nsIContent *
0x024d246c, nsIFrame * * 0x0012e148) line 416
PresShell::GetPrimaryFrameFor(const PresShell * const 0x01f852d0, nsIContent *
0x024d246c, nsIFrame * * 0x0012e148) line 2034 + 32 bytes
nsCSSFrameConstructor::ContentChanged(nsCSSFrameConstructor * const 0x01f853e0,
nsIPresContext * 0x01faf450, nsIContent * 0x024d246c, nsISupports * 0x00000000)
line 6626
StyleSetImpl::ContentChanged(StyleSetImpl * const 0x01f85480, nsIPresContext *
0x01faf450, nsIContent * 0x024d246c, nsISupports * 0x00000000) line 972
PresShell::ContentChanged(PresShell * const 0x01f852d8, nsIDocument *
0x01fa6d20, nsIContent * 0x024d246c, nsISupports * 0x00000000) line 1834 + 46
bytes
nsDocument::ContentChanged(nsDocument * const 0x01fa6d20, nsIContent *
0x024d246c, nsISupports * 0x00000000) line 1471
nsGenericDOMDataNode::SetText(const unsigned short * 0x0012e478, int 3, int 1)
line 980
nsTextNode::SetText(nsTextNode * const 0x024d2470, const unsigned short *
0x0012e478, int 3, int 1) line 70 + 26 bytes

Comment 5

[Paul MacQuiddy]

putting on m11 radar per leger

Comment 6

[chris hofmann]

my linux build from today seems to load the page ok.
win32 still crashes.

Comment 7

[chris hofmann]

on linux the page appears to load ok but the
throbber and progress bar contine to spin....

Comment 8

[Mats Palmgren (inactive)]

*** Bug 18181 has been marked as a duplicate of this bug. ***

Comment 9

[chris hofmann]

can't read news..., can't eat dogfood. :-(

Comment 10

[cpratt]

Using the 1999110908 build under NT, I haven't been able to get cnn.com to crash
just yet today, but I am seeing the problem where the throbber &c. just keep on
spinning long after the page is loaded.

Comment 11

[cpratt]

Guess what? It finally crashed on me. New Dr. Watson report at
http://schist/17798b.html in a few minutes. (1999110908 build, NT 4 SP 5.)

Comment 12

[cpratt]

Whoops! Bad URL. Should be http://schist/17798b.txt .

Comment 13

[troy]

*** Bug 18236 has been marked as a duplicate of this bug. ***

Comment 14

[leger]

Putting on PDT+ radar.

Comment 15

[troy]

With the latest build I'm hitting an assert in the table code:

nsCellMap::GetCellInfoAt(int 0, int 0, int * 0x0012b178, int * 0x0012b17c) line
515 + 16 bytes
nsTableFrame::GetCellInfoAt(int 0, int 0, int * 0x0012b178, int * 0x0012b17c)
line 4082
BasicTableLayoutStrategy::AssignPreliminaryColumnWidths(int 3300) line 742 + 30
bytes
BasicTableLayoutStrategy::Initialize(nsSize * 0x0012b960, int 2, int 3300) line
112
nsTableFrame::BalanceColumnWidths(nsIPresContext & {...}, const
nsHTMLReflowState & {...}, const nsSize & {...}, nsSize * 0x0012b960) line 2882
nsTableFrame::Reflow(nsTableFrame * const 0x01b09bb8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1291
nsContainerFrame::ReflowChild(nsIFrame * 0x01b09bb8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x01b09b20, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 900 + 34 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01b09b20, const nsRect & {...},
int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x01b0dca8, int * 0x0012bad4) line 3234 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01b0dca8, int
* 0x0012bad4, int 0) line 2622 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2433 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x01b093a0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1490 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01b093a0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableCellFrame::Reflow(nsTableCellFrame * const 0x01b092f8, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 654
nsContainerFrame::ReflowChild(nsIFrame * 0x01b092f8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x01b06968,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 1040 + 34 bytes
nsTableRowFrame::Reflow(nsTableRowFrame * const 0x01b06968, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 1432 + 35 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01b06968, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const
0x01b05bb0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...},
RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000,
nsReflowReason eReflowReason_Initial, int 1, int 0) line 460 + 34 bytes
nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x01b05bb0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1040 + 38 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01b05bb0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x01b05a18, nsIPresContext
& {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason
eReflowReason_Initial, int 1) line 1402
nsTableFrame::Reflow(nsTableFrame * const 0x01b05a18, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1256 + 42 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01b05a18, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x01b05980, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 900 + 34 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01b05980, const nsRect & {...},
int 1, int 0, int 0, nsMargin & {...}, unsigned int & 0) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x01b101f8, int * 0x0012d19c) line 3234 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01b101f8, int
* 0x0012d19c, int 1) line 2622 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2433 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x01aad6b8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1490 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01aad6b8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableCellFrame::Reflow(nsTableCellFrame * const 0x01aad610, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 654
nsContainerFrame::ReflowChild(nsIFrame * 0x01aad610, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableRowFrame::IR_TargetIsChild(nsTableRowFrame * const 0x01a4d4e0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0, nsIFrame * 0x01aad610) line 1294 + 34 bytes
nsTableRowFrame::IncrementalReflow(nsTableRowFrame * const 0x01a4d4e0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0) line 1182 + 35 bytes
nsTableRowFrame::Reflow(nsTableRowFrame * const 0x01a4d4e0, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 1456 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01a4d4e0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableRowGroupFrame::IR_TargetIsChild(nsTableRowGroupFrame * const 0x01a4d458,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState &
{...}, unsigned int & 0, nsIFrame * 0x01a4d4e0) line 1510 + 34 bytes
nsTableRowGroupFrame::IncrementalReflow(nsTableRowGroupFrame * const 0x01a4d458,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState &
{...}, unsigned int & 0) line 1117 + 35 bytes
nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x01a4d458,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1026 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01a4d458, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableFrame::IR_TargetIsChild(nsTableFrame * const 0x01a4d2c0, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, InnerTableReflowState & {...}, unsigned int
& 0, nsIFrame * 0x01a4d458) line 2359 + 34 bytes
nsTableFrame::IncrementalReflow(nsTableFrame * const 0x01a4d2c0, nsIPresContext
& {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 2191 + 41 bytes
nsTableFrame::Reflow(nsTableFrame * const 0x01a4d2c0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1232 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x01a4d2c0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
nsTableOuterFrame::IR_InnerTableReflow(nsTableOuterFrame * const 0x01a4d228,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 582 + 34 bytes
nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsTableOuterFrame * const
0x01a4d228, nsIPresContext & {...}, nsHTMLReflowMetrics & {...},
OuterTableReflowState & {...}, unsigned int & 0) line 377 + 31 bytes
nsTableOuterFrame::IR_TargetIsChild(nsTableOuterFrame * const 0x01a4d228,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0, nsIFrame * 0x01a4d2c0) line 350 + 31 bytes
nsTableOuterFrame::IncrementalReflow(nsTableOuterFrame * const 0x01a4d228,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 333 + 35 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x01a4d228, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 854 + 31 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01a4d228, const nsRect & {...},
int 1, int 0, int 0, nsMargin & {...}, unsigned int & 0) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x01a5cb38, int * 0x0012ea6c) line 3234 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01a5cb38, int
* 0x0012ea6c, int 1) line 2622 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2433 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x019434b8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1490 + 15 bytes

Comment 16

[karnaze (gone)]

Troy, after Rod's change (11/9 afternoon> to nsCSSFrameConstructor, the stack is
as described on 11/4. If you have that change and something possibly later is
causing the stack to be as you describe, then reassign it to me.

Comment 17

[troy]

Chris, I had a fresh pull and build of the tree, and that was the stack trace I
saw

Comment 18

[karnaze (gone)]

Troy, back to you since you are now seeing the same stack as me.

Comment 19

[troy]

The problem seems to be related to the WipeContainingBlock() code that Kipp
added. It is causing us to destroy and recreate lots of frames...

Comment 20

[Joseph Elwell]

Attachment: I tried to reduce the page into what causes the crash. Hope this helps.

Comment 21

[troy]

Yes, that helps a lot. Thanks!

Comment 22

[troy]

Attachment: Even smaller test case

Comment 23

[troy]

*** Bug 18589 has been marked as a duplicate of this bug. ***

Comment 24

[Jan Carpenter]

Not fixed on the mac.  The attachments work fine, but going to cnn.com
still crashes.

Win98 works on both the attachments and at cnn.com

Linux build crashes on startup - can't test yet.

Reopening for Mac.

Comment 25

[Jan Carpenter]

Re-marking as fixed
Apparently the build I have doesn't have the fix in it yet.  Will check again
tomorrow.

Comment 26

[troy]

*** Bug 18215 has been marked as a duplicate of this bug. ***

Comment 27

[Colin Blake]

I picked up the change to
mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp this morning (my tree is
now completely to date with all M11 changes) and I still crash when I go to
the "even smaller test case" attachment and click on the arrow on the
menu-box.

This is on OpenVMS. I don't have a completely up to date Linux version to
try. Can someone else try this?

Are you sure this is fixed?

Comment 28

[troy]

Look, it's fixed so stop re-opening the bug...

Comment 29

[troy]

What you're describing is a completely different problem. The bug report is that
_loading_ the page is crashing.

Look at the stack trace you get when you click on the button and you'll see it's
completely unrelated

Comment 30

[Jan Carpenter]

seems to be fixed.
Verified.

Comment 31

[troy]

*** Bug 19076 has been marked as a duplicate of this bug. ***

Comment 32

[Pulsebot]

Pushed by ffxbld-merge:
https://hg.mozilla.org/releases/mozilla-beta/rev/7dcce3622342
[fenix] For 17798: Sync Menu Item