18837 - Crash when I pressed the back button.

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Mo DeJong]

I was surfing around looking at HTML files on my local machine
(with the file:// protocol), when I got this crash.

I was running this on a RedHat Linux 5.2 system with
a CVS build from Sun Nov 14th. This crash happened
when I hit the back button. I have
not been able to reproduce this crash, but I did get a
stack trace where the crash happened.





#0  0xdadadada in ?? ()
#1  0x4108756c in nsCSSFrameConstructor::ContentChanged (this=0x419dc990,
    aPresContext=0x41995aa8, aContent=0x41d9239c, aSubContent=0x0)
    at ../../../../../layout/html/style/src/nsCSSFrameConstructor.cpp:6695
#2  0x41178469 in StyleSetImpl::ContentChanged (this=0x413c3480,
    aPresContext=0x41995aa8, aContent=0x41d9239c, aSubContent=0x0)
    at ../../../../layout/base/src/nsStyleSet.cpp:973
#3  0x40f695a4 in PresShell::ContentChanged (this=0x419ef370,
    aDocument=0x419dcdb8, aContent=0x41d9239c, aSubContent=0x0)
    at ../../../../../layout/html/base/src/nsPresShell.cpp:2007
#4  0x409f5e6c in nsXULDocument::ContentChanged (this=0x419dcdb8,
    aContent=0x41d9239c, aSubContent=0x0)
    at ../../../../rdf/content/src/nsXULDocument.cpp:1114
#5  0x4114cfdb in nsGenericDOMDataNode::SetText (this=0x41d923a8,
    aBuffer=0x41f1f758, aLength=48, aNotify=1)
    at ../../../../layout/base/src/nsGenericDOMDataNode.cpp:990
#6  0x4117a0b6 in nsTextNode::SetText (this=0x41d92390, aBuffer=0x41f1f758,
    aLength=48, aNotify=1) at ../../../../layout/base/src/nsTextNode.cpp:73
#7  0x410464ce in nsGfxTextControlFrame::SetTextControlFrameState (
    this=0x41d61e98, aValue=@0xbfffccc8)
    at ../../../../../layout/html/forms/src/nsGfxTextControlFrame.cpp:914
#8  0x41046620 in nsGfxTextControlFrame::SetProperty (this=0x41d61e98,
    aPresContext=0x41995aa8, aName=0x406b7838, aValue=@0xbfffccc8)
    at ../../../../../layout/html/forms/src/nsGfxTextControlFrame.cpp:939
#9  0x40fbe4a5 in nsHTMLInputElement::SetValue (this=0x41b9e0b8,
    aValue=@0xbfffccc8)
    at ../../../../../layout/html/content/src/nsHTMLInputElement.cpp:402
#10 0x40fc085f in nsHTMLInputElement::SetAttribute (this=0x41b9e0b8,
    aName=@0xbfffcad8, aValue=@0xbfffccc8)
    at ../../../../../layout/html/content/src/nsHTMLInputElement.cpp:85
#11 0x414dc068 in setAttribute (shell=0x41760d58, id=0x414e5db0 "urlbar",
    name=0x414e50e9 "value", value=@0xbfffccc8)
    at ../../../../xpfe/browser/src/nsBrowserInstance.cpp:1348
#12 0x414dc520 in nsBrowserInstance::OnStartDocumentLoad (this=0x41f1e2d0,
    aLoader=0x41d90f18, aURL=0x41b5c0b0, aCommand=0x40ac60f2 "load")
    at ../../../../xpfe/browser/src/nsBrowserInstance.cpp:1427
#13 0x40aba26c in nsWebShell::OnStartDocumentLoad (this=0x41d908a8,
    loader=0x41d90f18, aURL=0x41b5c0b0, aCommand=0x40ac60f2 "load")
    at ../../../webshell/src/nsWebShell.cpp:3358
#14 0x40aae9b3 in nsDocLoaderImpl::FireOnStartDocumentLoad (this=0x41d90f18,
    aLoadInitiator=0x41d90f18, aURL=0x41b5c0b0, aCommand=0x40ac60f2 "load")
    at ../../../webshell/src/nsDocLoader.cpp:820
#15 0x40aae659 in nsDocLoaderImpl::OnStartRequest (this=0x41d90f18,
    channel=0x41b81ac8, ctxt=0x0) at ../../../webshell/src/nsDocLoader.cpp:720
#16 0x4051c23d in nsLoadGroup::AddChannel (this=0x41d90f60,
    channel=0x41b81ac8, ctxt=0x0)
    at ../../../../netwerk/base/src/nsLoadGroup.cpp:522
#17 0x4054431e in nsFileChannel::AsyncRead (this=0x41b81ac8, startPosition=0,
    readCount=-1, ctxt=0x0, listener=0x41b35840)
    at ../../../../../netwerk/protocol/file/src/nsFileChannel.cpp:295
#18 0x40aaf7ba in nsDocumentBindInfo::Bind (this=0x41b35840, aURL=0x41b5c0b0,
    aLoadGroup=0x41d90f60, postDataStream=0x0, aReferrer=0x0)
    at ../../../webshell/src/nsDocLoader.cpp:1100
#19 0x40aadeb7 in nsDocLoaderImpl::LoadDocument (this=0x41d90f18,
    aUri=0x41b5c0b0, aCommand=0x40ac6b13 "view", aContainer=0x41d908a8,
    aPostDataStream=0x0, aExtraInfo=0x0, aType=10, aLocalIP=0, aReferrer=0x0)
    at ../../../webshell/src/nsDocLoader.cpp:513
#20 0x40ab6bea in nsWebShell::DoLoadURL (this=0x41d908a8, aUri=0x41b5c0b0,
    aCommand=0x40ac6b13 "view", aPostDataStream=0x0, aType=10, aLocalIP=0,
    aReferrer=0x0) at ../../../webshell/src/nsWebShell.cpp:2138
#21 0x40ab70a7 in nsWebShell::LoadURI (this=0x41d908a8, aUri=0x41b5c0b0,
    aCommand=0x40ac6b13 "view", aPostDataStream=0x0, aModifyHistory=0,
    aType=10, aLocalIP=0, aHistoryState=0x41b35a80, aReferrer=0x0)
    at ../../../webshell/src/nsWebShell.cpp:2214
#22 0x40ab7e9b in nsWebShell::LoadURL (this=0x41d908a8, aURLSpec=0x41b81a30,
    aCommand=0x40ac6b13 "view", aPostDataStream=0x0, aModifyHistory=0,
    aType=10, aLocalIP=0, aHistoryState=0x41b35a80, aReferrer=0x0)
    at ../../../webshell/src/nsWebShell.cpp:2406
#23 0x40ab5e81 in nsWebShell::LoadURL (this=0x41d908a8, aURLSpec=0x41b81a30,
    aPostDataStream=0x0, aModifyHistory=0, aType=10, aLocalIP=0,
    aHistoryState=0x41b35a80, aReferrer=0x0)
    at ../../../webshell/src/nsWebShell.cpp:1965
#24 0x4039b0b5 in nsHistoryEntry::Load (this=0x41b5cd08,
    aPrevEntry=0x41d908a8, aIsReload=0)
    at ../../../../xpfe/appshell/src/nsSessionHistory.cpp:550
#25 0x4039c46a in nsSessionHistory::Goto (this=0x41f1e320, aGotoIndex=1,
    prev=0x41d908a8, aIsReload=0)
    at ../../../../xpfe/appshell/src/nsSessionHistory.cpp:1138
#26 0x4039c505 in nsSessionHistory::GoBack (this=0x41f1e320, aPrev=0x41d908a8)
    at ../../../../xpfe/appshell/src/nsSessionHistory.cpp:1168
#27 0x414dd7ab in nsBrowserInstance::GoBack (this=0x41f1e2d0, aPrev=0x41d908a8)
    at ../../../../xpfe/browser/src/nsBrowserInstance.cpp:1739
#28 0x414d792b in nsBrowserInstance::Back (this=0x41f1e2d0)
    at ../../../../xpfe/browser/src/nsBrowserInstance.cpp:279
#29 0x4015f671 in XPTC_InvokeByIndex (that=0x41f1e2d0, methodIndex=3,
    paramCount=0, params=0xbfffdcd0)
    at
../../../../../../../xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:159
#30 0x4034a7ba in nsXPCWrappedNativeClass::CallWrappedMethod (this=0x41f1e350,
    cx=0x417701b8, wrapper=0x41f1e5e0, desc=0x41f1e394, callMode=CALL_METHOD,
    argc=0, argv=0x41b71710, vp=0xbfffde40)
    at ../../../../../js/src/xpconnect/src/xpcwrappednativeclass.cpp:890
#31 0x4034c783 in WrappedNative_CallMethod (cx=0x417701b8, obj=0x41b03440,
    argc=0, argv=0x41b71710, vp=0xbfffde40)
    at ../../../../../js/src/xpconnect/src/xpcwrappednativejsops.cpp:189
#32 0x40079afb in js_Invoke (cx=0x417701b8, argc=0, flags=0)
    at ../../../js/src/jsinterp.c:673
#33 0x4008a3ee in js_Interpret (cx=0x417701b8, result=0xbfffe27c)
    at ../../../js/src/jsinterp.c:2244
#34 0x40079b5d in js_Invoke (cx=0x417701b8, argc=0, flags=0)
    at ../../../js/src/jsinterp.c:689
#35 0x4008a3ee in js_Interpret (cx=0x417701b8, result=0xbfffe6e4)
    at ../../../js/src/jsinterp.c:2244
#36 0x40079b5d in js_Invoke (cx=0x417701b8, argc=1, flags=2)
    at ../../../js/src/jsinterp.c:689
#37 0x40079e60 in js_InternalCall (cx=0x417701b8, obj=0x419f4240,
    fval=1100956232, argc=1, argv=0xbfffe940, rval=0xbfffe848)
    at ../../../js/src/jsinterp.c:766
#38 0x400509e4 in JS_CallFunction (cx=0x417701b8, obj=0x419f4240,
    fun=0x41d14588, argc=1, argv=0xbfffe940, rval=0xbfffe848)
    at ../../../js/src/jsapi.c:2731
#39 0x403e2957 in nsJSContext::CallFunction (this=0x41571160, aObj=0x419f4240,
    aFunction=0x41d14588, argc=1, argv=0xbfffe940, aBoolResult=0xbfffe894)
    at ../../../../dom/src/base/nsJSEnvironment.cpp:466
#40 0x4041cc81 in nsJSEventListener::HandleEvent (this=0x41d147b8,
    aEvent=0x41b5f6c4) at ../../../../dom/src/events/nsJSEventListener.cpp:107
#41 0x40f1ad1e in nsEventListenerManager::HandleEvent (this=0x41d14530,
    aPresContext=@0x41995aa8, aEvent=0xbfffec2c, aDOMEvent=0xbfffebf0,
    aFlags=7, aEventStatus=@0xbfffec6c)
    at ../../../../layout/events/src/nsEventListenerManager.cpp:1194
#42 0x409d504f in nsXULElement::HandleDOMEvent (this=0x41b9a708,
    aPresContext=@0x41995aa8, aEvent=0xbfffec2c, aDOMEvent=0xbfffebf0,
    aFlags=1, aEventStatus=@0xbfffec6c)
    at ../../../../rdf/content/src/nsXULElement.cpp:2578
#43 0x4110c6c4 in nsTitledButtonFrame::MouseClicked (this=0x41d5b378,
    aPresContext=@0x41995aa8)
    at ../../../../../layout/xul/base/src/nsTitledButtonFrame.cpp:1236
#44 0x4110c520 in nsTitledButtonFrame::HandleEvent (this=0x41d5b378,
    aPresContext=@0x41995aa8, aEvent=0xbfffecd4, aEventStatus=@0xbffff050)
    at ../../../../../layout/xul/base/src/nsTitledButtonFrame.cpp:1173
#45 0x40f1f302 in nsEventStateManager::CheckForAndDispatchClick (
    this=0x41d2a9f0, aPresContext=@0x41995aa8, aEvent=0xbffff140,
    aStatus=@0xbffff050)
    at ../../../../layout/events/src/nsEventStateManager.cpp:1209
#46 0x40f1d604 in nsEventStateManager::PostHandleEvent (this=0x41d2a9f0,
    aPresContext=@0x41995aa8, aEvent=0xbffff140, aTargetFrame=0x41d5b378,
    aStatus=@0xbffff050, aView=0x417ab268)
    at ../../../../layout/events/src/nsEventStateManager.cpp:622
#47 0x40f6a909 in PresShell::HandleEvent (this=0x419ef370, aView=0x417ab268,
    aEvent=0xbffff140, aEventStatus=@0xbffff050)
    at ../../../../../layout/html/base/src/nsPresShell.cpp:2424
#48 0x41431717 in nsView::HandleEvent (this=0x417ab268, event=0xbffff140,
    aEventFlags=28, aStatus=@0xbffff050, aHandled=@0xbfffeff4)
    at ../../../view/src/nsView.cpp:839
#49 0x4143d213 in nsViewManager::DispatchEvent (this=0x41577130,
    aEvent=0xbffff140, aStatus=@0xbffff050)
    at ../../../view/src/nsViewManager.cpp:1722
#50 0x4142f838 in HandleEvent (aEvent=0xbffff140)
    at ../../../view/src/nsView.cpp:68
#51 0x405bb4bc in nsWidget::DispatchEvent (this=0x41941dc8, aEvent=0xbffff140,
    aStatus=@0xbffff0e8) at ../../../../widget/src/gtk/nsWidget.cpp:1307
#52 0x405bb200 in nsWidget::DispatchWindowEvent (this=0x41941dc8,
    event=0xbffff140) at ../../../../widget/src/gtk/nsWidget.cpp:1212
#53 0x405bb570 in nsWidget::DispatchMouseEvent (this=0x41941dc8,
    aEvent=@0xbffff140) at ../../../../widget/src/gtk/nsWidget.cpp:1334
#54 0x405bc6c3 in nsWidget::OnButtonReleaseSignal (this=0x41941dc8,
    aGdkButtonEvent=0x4156cf7c) at ../../../../widget/src/gtk/nsWidget.cpp:1945
#55 0x405bd376 in nsWidget::ButtonReleaseSignal (aWidget=0x417a3ca8,
    aGdkButtonEvent=0x4156cf7c, aData=0x41941dc8)
    at ../../../../widget/src/gtk/nsWidget.cpp:2386
#56 0x407f5a99 in gtk_marshal_BOOL__POINTER (object=0x417a3ca8,
    func=0x405bd298 <nsWidget::ButtonReleaseSignal(_GtkWidget *, _GdkEventButton
*, void *)>, func_data=0x41941dc8, args=0xbffff25c) at gtkmarshal.c:30
#57 0x407bac52 in gtk_handlers_run (handlers=0x4198b248, signal=0xbffff218,
    object=0x417a3ca8, params=0xbffff25c, after=0) at gtksignal.c:1909
#58 0x407ba158 in gtk_signal_real_emit (object=0x417a3ca8, signal_id=21,
    params=0xbffff25c) at gtksignal.c:1469
#59 0x407b8468 in gtk_signal_emit (object=0x417a3ca8, signal_id=21)
    at gtksignal.c:552
#60 0x407ed110 in gtk_widget_event (widget=0x417a3ca8, event=0x4156cf7c)
    at gtkwidget.c:2790
#61 0x4078d13d in gtk_propagate_event (widget=0x417a3ca8, event=0x4156cf7c)
    at gtkmain.c:1296
#62 0x4078c472 in gtk_main_do_event (event=0x4156cf7c) at gtkmain.c:753
#63 0x40831ed6 in gdk_event_dispatch (source_data=0x0,
    current_time=0xbffff5dc, user_data=0x0) at gdkevents.c:2098
#64 0x405ebc8f in g_main_dispatch (current_time=0xbffff5dc) at gmain.c:652
#65 0x405ec277 in g_main_iterate (block=1, dispatch=1) at gmain.c:870
#66 0x405ec3f9 in g_main_run (loop=0x4066c658) at gmain.c:928
#67 0x4078bedf in gtk_main () at gtkmain.c:475
#68 0x405a5735 in nsAppShell::Run (this=0x40601870)
    at ../../../../widget/src/gtk/nsAppShell.cpp:399
#69 0x40383609 in nsAppShellService::Run (this=0x812af68)
    at ../../../../xpfe/appshell/src/nsAppShellService.cpp:488
#70 0x804cbb3 in main1 (argc=1, argv=0xbffff834)
    at ../../../xpfe/bootstrap/nsAppRunner.cpp:580
#71 0x804ce65 in main (argc=1, argv=0xbffff834)
    at ../../../xpfe/bootstrap/nsAppRunner.cpp:670






#1  0x4108756c in nsCSSFrameConstructor::ContentChanged (this=0x419dc990,
    aPresContext=0x41995aa8, aContent=0x41d9239c, aSubContent=0x0)
    at ../../../../../layout/html/style/src/nsCSSFrameConstructor.cpp:6695

layout/html/style/src/nsCSSFrameConstructor.cpp:6695


6690        // that is part of a first-letter situation.
6691        PRBool doContentChanged = PR_TRUE;
6692        nsCOMPtr<nsITextContent> textContent(do_QueryInterface(aContent));
6693        if (textContent) {
6694          // Ok, it's text content. Now do some real work...
6695          nsIFrame* block = GetFloaterContainingBlock(aPresContext, frame);
6696          if (block) {
6697            // See if the block has first-letter style applied to it.
6698            nsCOMPtr<nsIContent> blockContent;
6699            block->GetContent(getter_AddRefs(blockContent));

Comment 1

[Chris McAfee]

shist, radha?

Comment 2

[Radha on family leave (not reading bugmail)]

The crash seems to be in layout in which case, I won't be  of great help. Shall
look in to it dependeing how reproducible this is.

Comment 3

[leger]

rickg, what do you think?

Comment 4

[troy]

I can't reproduce the problem

Comment 5

[Chris Petersen]

I haven't be able to reproduce this crash described. Tested on Nov 29th Linux
build (1999112908).