18345 - [CRASH] Browser crashes on startup if you have more than 100 bookmarks in the same menu

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[kinmoz]

The browser crashes on startup if you have more than 100 bookmarks in a bookmark
submenu.

I was able to reproduce this by migrating my existing 4.x profile which has alot
of bookmarks. The browser will startup immediately after you do the migration,
but if you quit the browser and restart it, it will crash in:


nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x028299a0, nsCalculatedBoxInfo & {...}) line 320 + 8 bytes
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x023e17d0, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1496 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x023e1798, nsCalculatedBoxInfo & {...}) line 332
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x023dfcb8, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1496 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x023dfc80, nsCalculatedBoxInfo & {...}) line 332
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x023de190, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1496 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x023de158, nsCalculatedBoxInfo & {...}) line 332
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x023dc638, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1496 + 44 bytes
nsToolboxFrame::GetBoxInfo(nsToolboxFrame * const 0x023dc638, nsIPresContext &
{...}, const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 335
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x023dc600, nsCalculatedBoxInfo & {...}) line 332
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x023c6290, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1496 + 44 bytes
nsBoxFrame::Reflow(nsBoxFrame * const 0x023c6258, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 473
nsContainerFrame::ReflowChild(nsIFrame * 0x023c6258, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
RootFrame::Reflow(RootFrame * const 0x027bb9b0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 332
nsContainerFrame::ReflowChild(nsIFrame * 0x027bb9b0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 405 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x027ba040, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 514
PresShell::InitialReflow(PresShell * const 0x020a6c40, int 12600, int 10395)
line 997
nsXULDocument::StartLayout() line 3275
nsXULDocument::ResumeWalk() line 4556
nsXULDocument::OnUnicharStreamComplete(nsXULDocument * const 0x020617b4,
nsIUnicharStreamLoader * 0x00000000, unsigned int 0, const unsigned short *
0x023b9fe8) line 4649 + 11 bytes
nsUnicharStreamLoader::OnStopRequest(nsUnicharStreamLoader * const 0x02729a34,
nsIChannel * 0x02729060, nsISupports * 0x00000000, unsigned int 0, const
unsigned short * 0x00000000) line 122 + 50 bytes
nsChannelListener::OnStopRequest(nsChannelListener * const 0x02729920,
nsIChannel * 0x02729060, nsISupports * 0x00000000, unsigned int 0, const
unsigned short * 0x00000000) line 1382 + 42 bytes
nsFileChannel::OnStopRequest(nsFileChannel * const 0x02729064, nsIChannel *
0x027292d0, nsISupports * 0x00000000, unsigned int 0, const unsigned short *
0x00000000) line 427 + 45 bytes
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x0272a370) line
326
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x0272a0d0) line 173 + 12 bytes
PL_HandleEvent(PLEvent * 0x0272a0d0) line 537 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010716c0) line 498 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00ae0442, unsigned int 49318, unsigned int 0,
long 17241792) line 972 + 9 bytes
USER32! 77e71820()
010716c0()

Spoke to [e-mail], who is the author of the nsBoxFrame code, and he
told me that there is a hard coded limit BoxInfo limit of 100. If you exceed
this limit bad things happen.

Comment 1

[Peter Trudelle]

removing [BLOCKER]from summary since it is now a severity level.

Comment 2

[Eric Vaughan]

Reimplemented boxes data structure to be a linked list instead of a vector of
100. This is now fixed.

Comment 3

[Paul MacQuiddy]

claudius, please check this out at your leisure

Comment 4

[Claudius Gayle]

I can verify that this is fixed because of bug 21477. marking VERIFIED fixed for
20000112 builds

Comment 5

[leger]

BULK MOVE: Changing component from XUL to XP Toolkit/Widgets: XUL.  XUL 
component will be deleted.