194631 - Site loads then crashes browser - Trunk M130 [@ 0x00000000 - nsContainerFrame::Destroy]

Status: VERIFIED DUPLICATE of bug 156982

(SeaMonkey :: General, defect)

Description

[alanjstr]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3b) Gecko/20030221 Phoenix/0.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3b) Gecko/20030221 Phoenix/0.5

No plugins enabled.  Just visiting the URL crashes Mozilla and Phoenix.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3b) Gecko/20030216
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3b) Gecko/20030221 Phoenix/0.5

Talkback will be submitted as soon as it allows me.

Reproducible: Always

Steps to Reproduce:

Comment 1

[alanjstr]

Originally posted at http://www.mozillazine.org/forums/viewtopic.php?p=48091

Comment 2

[alanjstr]

Reported that it doesn´t crash Netscape 7.02.  Regression.

Comment 3

[alanjstr]

Also crashes Phoenix 0.5 milestone from 12/07.

Comment 4

[R.K.Aa.]

dup of bug 186132?

Comment 5

[alanjstr]

I didn't mouse over anything.  

Comment 6

[Boris Zbarsky [:bzbarsky]]

With a current trunk build, no crash (assuming the patch for bug 194584 is applied).

Comment 7

[R.K.Aa.]

i have not applied the patch in bug 194584 but i don't crash with a current
trunk CVS, Linux.

Comment 8

[Matthias Versen [:Matti]]

wfm with win2k build 20030223..

Comment 9

[alanjstr]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3b) Gecko/20030223
Phoenix/0.5

Comment 10

[Matthias Versen [:Matti]]

not fixed since no patch attached

Comment 11

[Matthias Versen [:Matti]]

-> wfm

Comment 12

[Hermann Schwab]

CRASH: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.3b) Gecko/20030222

WFM: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.3b) Gecko/20030223

With my default profile it crashed so horribly that even DocWatson was frozen,
I had to press reset-button.
Then I tested with a fresh profile, and got a talkback, but couldn´t send it.
Unzipped new build over old, to preserve talkback data from that build, but
unsent talkback vanished, sent talkback was preserved.

BuildID 2003022308 is working, 

1.3 should be tested!

Comment 13

[Jochem van Dieten]

CRASH: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.3) Gecko/20030312

Talkback submitted.

Comment 14

[Matthias Versen [:Matti]]

Jochem van Dieten:
Can you please run mozilla/components/Talkback to get the Talkback ID for that
crash ?

Comment 15

[Jochem van Dieten]

TalkbackID TB18125150Q (captured at 3/16/03 11:56 UTC)

Comment 16

[Jochem van Dieten]

CRASH: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312

TalkbackID TB18216941X

Comment 17

[Matthias Versen [:Matti]]

reopening until the stack arrives.

Comment 18

[alanjstr]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030314
Phoenix/0.5

Comment 19

[alanjstr]

And also WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a)
Gecko/20030318 Phoenix/0.5

I'll go test the 1.3 milestone.

Comment 20

[alanjstr]

Well, that tanked.  TB18221664Y
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3) Gecko/20030312

WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4a) Gecko/20030318

Target to 1.3.1?  

Comment 21

[Matthias Versen [:Matti]]

*** Bug 198265 has been marked as a duplicate of this bug. ***

Comment 22

[Jay Patel [:jay]]

Incident ID 18125150
Stack Signature 	0x00000000 46cf3e1d
Email Address 	
Product ID 	MozillaBranch
Build ID 	2003031211
Trigger Time 	2003-03-16 03:56:53
Platform 	Win32
Operating System 	Windows NT 4.0 build 1381
Module 	
URL visited 	http://www.dto.tudelft.nl/
User Comments 	Opened the URL
Trigger Reason 	Access violation
Source File Name 	
Trigger Line No. 	
Stack Trace 	
0x00000000
nsContainerFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 142]
nsBlockFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 425]
nsLineBox::DeleteLineList
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsLineBox.cpp, line 311]
nsBlockFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 424]
nsLineBox::DeleteLineList
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsLineBox.cpp, line 311]
nsBlockFrame::Destroy
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 424]
nsBlockFrame::DoRemoveFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5185]
nsBlockFrame::RemoveFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5002]
FrameManager::RemoveFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsFrameManager.cpp, line 1016]
nsCSSFrameConstructor::ContentRemoved
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 10000]
nsCSSFrameConstructor::RecreateFramesForContent
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 12155]
nsCSSFrameConstructor::AttributeChanged
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 10826]
StyleSetImpl::AttributeChanged
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp, line 1663]
PresShell::AttributeChanged
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5162]
nsDocument::AttributeChanged
[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp, line 2181]
nsHTMLDocument::AttributeChanged
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLDocument.cpp, line
1543]
nsDOMCSSAttributeDeclaration::ParsePropertyValue
[c:/builds/seamonkey/mozilla/content/html/style/src/nsDOMCSSAttrDeclaration.cpp,
line 275]
nsDOMCSSDeclaration::SetProperty
[c:/builds/seamonkey/mozilla/content/html/style/src/nsDOMCSSDeclaration.cpp,
line 252]
CSS2PropertiesTearoff::SetMozOpacity
[../../../../dist/include/content\nsCSSPropList.h, line 217]
XPTC_InvokeByIndex
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2025]
XPC_WN_GetterSetter
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1317]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 845]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 936]
js_SetProperty [c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2640]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2656]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 861]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 936]
JS_CallFunctionValue [c:/builds/seamonkey/mozilla/js/src/jsapi.c, line 3433]
nsJSContext::CallEventHandler
[c:/builds/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1043]
nsJSEventListener::HandleEvent
[c:/builds/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp, line 183]
nsEventListenerManager::HandleEventSubType
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1217]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1901]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 805]
DocumentViewerImpl::LoadComplete
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 963]
nsDocShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4277]
nsWebShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsWebShell.cpp, line 776]
nsDocShell::OnStateChange
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4211]
nsDocLoaderImpl::FireOnStateChange
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 1213]
nsDocLoaderImpl::doStopDocumentLoad
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 867]
nsDocLoaderImpl::DocLoaderIsEmpty
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 765]
nsDocLoaderImpl::OnStopRequest
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 695]
nsLoadGroup::RemoveRequest
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsLoadGroup.cpp, line 703]
PresShell::RemoveDummyLayoutRequest
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6754]
PresShell::ProcessReflowCommands
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6569]
ReflowEvent::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6357]
PL_HandleEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line 664]
PL_ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c,
line 597]
_md_EventReceiverProc [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line
1385] 

This looks like a known bug.   I'm sure there's a bug somewhere for it.  It's
been around for a while I think.

Comment 23

[Matthias Versen [:Matti]]

Thanks Jay !


*** This bug has been marked as a duplicate of 156982 ***

Comment 24

[Henrik Skupin [:whimboo][⌚️UTC+2]]

verified.