Closed Bug 200104 Opened 21 years ago Closed 21 years ago

crash when going to ftp://idmcomp.com/wf/xml.txt [@ nsLineBox::IsEmpty ]

Categories

(Core :: Layout: Block and Inline, defect)

Product:
Core
Component:
Layout: Block and Inline
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 136927

People

(Reporter: bugzilla, Unassigned)

References

(
URL
)

Details

(Keywords: crash)

Crash Data

I seem to crash everytime I go to:
ftp://idmcomp.com/wf/xml.txt

20030331
TB18680934Z
Keywords: stackwanted
Crash on 2003032908/OS X as well [checking for dupes & new build before i confirm]

TB ID: TB220119H

**********

Date/Time:  2003-04-01 09:21:36 -0500
OS Version: 10.2.4 (Build 6I32)
Host:       pnhTiObject.local.

Command:    mozilla-bin
PID:        4004

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
 #0   0x00e44a90 in nsLineBox::IsEmpty(nsCompatibility, int, int*) const
 #1   0x00e13604 in nsBlockFrame::IsLineEmpty(nsIPresContext*, nsLineBox const*)
const
 #2   0x00e16b48 in nsBlockFrame::PlaceLine(nsBlockReflowState&, nsLineLayout&,
nsLineList_iterator, int*, int)
 #3   0x00e16174 in nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&,
nsLineLayout&, nsLineList_iterator, int*, unsigned char*, int, int)
 #4   0x00e15d74 in nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState&,
nsLineList_iterator, int*, unsigned char*, int, int)
 #5   0x00e15bf8 in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,
nsLineList_iterator, int*, int, int)
 #6   0x00e14748 in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int)
 #7   0x00e13f08 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
 #8   0x00e1270c in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&)
 #9   0x00e1a924 in nsBlockReflowContext::ReflowBlock(nsRect const&, int,
nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&)
 #10  0x00e156f8 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, int*)
 #11  0x00e143dc in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int)
 #12  0x00e13f08 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
 #13  0x00e1270c in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&)
 #14  0x00e214c8 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
 #15  0x00e35078 in CanvasFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&)
 #16  0x00effcfc in nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState&,
nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&, int,
int, int, int, int)
 #17  0x00eff788 in nsBoxToBlockAdaptor::DoLayout(nsBoxLayoutState&)
 #18  0x00efc4b8 in nsBox::Layout(nsBoxLayoutState&)
 #19  0x00ef2160 in nsScrollBoxFrame::DoLayout(nsBoxLayoutState&)
 #20  0x00efc4b8 in nsBox::Layout(nsBoxLayoutState&)
 #21  0x00f01cf4 in nsContainerBox::LayoutChildAt(nsBoxLayoutState&, nsIBox*,
nsRect const&)
 #22  0x00e318c0 in nsGfxScrollFrameInner::Layout(nsBoxLayoutState&)
 #23  0x00e315bc in nsGfxScrollFrame::DoLayout(nsBoxLayoutState&)
 #24  0x00efc4b8 in nsBox::Layout(nsBoxLayoutState&)
 #25  0x00f0f58c in nsBoxFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&)
 #26  0x00e30a70 in nsGfxScrollFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&)
 #27  0x00e214c8 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
 #28  0x00e78b58 in ViewportFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&)
 #29  0x00e593bc in IncrementalReflow::Dispatch(nsIPresContext*,
nsHTMLReflowMetrics&, nsSize const&, nsIRenderingContext&)
 #30  0x00e6561c in PresShell::ProcessReflowCommands(int)
 #31  0x011c0be8 in ReflowEvent::HandleEvent()
 #32  0x001ac8c0 in PL_HandleEvent
 #33  0x001ac7b8 in PL_ProcessPendingEvents
 #34  0x001accb8 in _md_EventReceiverProc
 #35  0x969a2244 in DispatchEventToHandlers
 #36  0x969a25ac in SendEventToEventTargetInternal
 #37  0x969a59c0 in SendEventToEventTargetWithOptions
 #38  0x969b1f58 in ToolboxEventDispatcherHandler(OpaqueEventHandlerCallRef*,
OpaqueEventRef*, void*)
 #39  0x969a22fc in DispatchEventToHandlers
 #40  0x969a25ac in SendEventToEventTargetInternal
 #41  0x969b4aac in SendEventToEventTarget
 #42  0x969b6870 in ToolboxEventDispatcher(OpaqueEventRef*)
 #43  0x969c7d94 in CallEventDispatchHook
 #44  0x969b32a8 in TryEventDispatcher
 #45  0x969a3b60 in GetOrPeekEvent
 #46  0x969a380c in GetNextEventMatchingMask
 #47  0x969a7664 in WNEInternal
 #48  0x969ad528 in WaitNextEvent
 #49  0x00b2e5b0 in nsMacMessagePump::GetEvent(EventRecord&)
 #50  0x00b2e48c in nsMacMessagePump::DoMessagePump()
 #51  0x00b22b94 in nsAppShell::Run()
 #52  0x00005328 in main1(int, char**, nsISupports*)
 #53  0x00005884 in main
 #54  0x00002150 in _start
 #55  0x00001fd0 in start
Severity: normal → critical
OS: Windows XP → All
Hardware: PC → All
Summary: crash when going to ftp://idmcomp.com/wf/xml.txt → crash when going to ftp://idmcomp.com/wf/xml.txt @ nsLineBox::IsEmpty
.
Assignee: asa → block-and-inline
Component: Browser-General → Layout: Block & Inline
QA Contact: asa → ian
Note that the file has the infamous CRCRLF line endings. WFM on Linux.
same stack on Linux (CVS 20030329 and nightly from 2003032905)

#0  0x40de57da in nsLineBox::IsEmpty (this=0x8872fe4,
    aCompatMode=eCompatibility_NavQuirks, aParentIsPre=0, aResult=0xbfffcaa0)
    at nsLineBox.cpp:289
289         kid->IsEmpty(aCompatMode, aParentIsPre, aResult);
(gdb) frame 1
#1  0x40da5dfa in nsBlockFrame::IsLineEmpty (this=0x88f278c,
    aPresContext=0x8a21858, aLine=0x8872fe4) at nsBlockFrame.cpp:1783
1783      aLine->IsEmpty(compat, isPre, &empty);
(gdb) p styleText->mWhiteSpace
$6 = 0 '\000'

Looks like this case is not handled by the current code:
http://lxr.mozilla.org/seamonkey/source/layout/html/base/src/nsBlockFrame.cpp#1776
Keywords: stackwanted
Summary: crash when going to ftp://idmcomp.com/wf/xml.txt @ nsLineBox::IsEmpty → crash when going to ftp://idmcomp.com/wf/xml.txt [@ nsLineBox::IsEmpty ]
no crash in Win98 and win98SE, but layout seems broken and Java gives
errormessage 'Applet notinited' and some time later the german error message
'Fehler beim Lade des Java-Applets...' ( i.e. 'error loading applet'). Looking
at the source I understand mozillas reaction ;-)
I don´t understand it too, it is only a tagsoup made for test.

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4a) Gecko/20030329
Java Plug-in 1.4.1_02 for Netscape Navigator (DLL Helper)

This testcase triggers the assertions I have in my tree to catch bug 136927.  If
the plugin code destroys frames while they're in the middle of being reflowed,
bad things happen.

*** This bug has been marked as a duplicate of 136927 ***
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → DUPLICATE
Confirming it with build 20030312 (1.3) under Windows XP SP1.

Talkback ID: TB18704223Z
Crash Signature: [@ nsLineBox::IsEmpty ]
You need to log in before you can comment on or make changes to this bug.