Closed Bug 209575 Opened 21 years ago Closed 21 years ago

trunk topcrash [@ CSSStyleRuleImpl::MapRuleInfoInto]

Tracking

()

Status:

RESOLVED FIXED

People

(Reporter: jcarpenter0524, Assigned: dbaron)

References

Details

(Keywords: crash, topcrash, Whiteboard: [patch])

Crash Data

Attachments

(2 files, 3 obsolete files)

win2k stack from an optimized with symbols 21 years ago Matthias Versen [:Matti] 13.15 KB, text/plain		Details
patch 21 years ago David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla) 5.35 KB, patch		Details \| Diff \| Splinter Review
patch 21 years ago David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla) 5.36 KB, patch		Details \| Diff \| Splinter Review
patch 21 years ago David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla) 6.05 KB, patch		Details \| Diff \| Splinter Review
patch 21 years ago David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla) 6.03 KB, patch	bzbarsky : review+ bzbarsky : superreview+	Details \| Diff \| Splinter Review

Jan Carpenter

Reporter

Description

•

21 years ago

4   CSSStyleRuleImpl::MapRuleInfoInto   11 

 
 	Source File :
c:/builds/seamonkey/mozilla/content/html/style/src/nsCSSStyleRule.cpp line : 1341
 
====================================================================================================
     Count   Offset    Real Signature
[ 4   CSSStyleRuleImpl::MapRuleInfoInto 7799b30f -
CSSStyleRuleImpl::MapRuleInfoInto ]
 
     Crash date range: 2003-06-08 to 2003-06-12 
     Count   Platform List 
     2   Windows NT 5.1 build 2600
     2   Windows NT 5.0 build 2195
 
     Count   Build Id List 
     2   2003060804
     1   2003061104
     1   2003060808
 
     No of Unique Users         2
 
 Stack trace(Frame) 

	 CSSStyleRuleImpl::MapRuleInfoInto
[c:/builds/seamonkey/mozilla/content/html/style/src/nsCSSStyleRule.cpp  line 1341] 
	 nsRuleNode::WalkRuleTree
[c:/builds/seamonkey/mozilla/content/base/src/nsRuleNode.cpp  line 1430] 
	 nsRuleNode::GetDisplayData
[c:/builds/seamonkey/mozilla/content/base/src/nsRuleNode.cpp  line 1158] 
	 nsRuleNode::GetStyleData
[c:/builds/seamonkey/mozilla/content/base/src/nsRuleNode.cpp  line 4501] 
	 nsStyleContext::GetStyleData
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleContext.cpp  line 262] 
	 nsStyleContext::ApplyStyleFixups
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleContext.cpp  line 383] 
	 nsStyleContext::nsStyleContext
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleContext.cpp  line 89] 
	 NS_NewStyleContext
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleContext.cpp  line 867] 
	 StyleSetImpl::GetContext
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp  line 1042] 
	 StyleSetImpl::ResolveStyleFor
[c:/builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp  line 1236] 
	 nsPresContext::ResolveStyleContextFor
[c:/builds/seamonkey/mozilla/layout/base/src/nsPresContext.cpp  line 924] 
	 nsCSSFrameConstructor::ResolveStyleContext
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 6753] 
	 nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7196] 
	 nsCSSFrameConstructor::ProcessInlineChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 13565] 
	 nsCSSFrameConstructor::ConstructInline
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 13333] 
	 nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 6493] 
	 nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7357] 
	 nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7210] 
	 nsCSSFrameConstructor::ProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 12075] 
	 nsCSSFrameConstructor::ConstructTableCellFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2980] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3239] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableRowFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2821] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3225] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableRowGroupFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2709] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3219] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2585] 
	 nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 6544] 
	 nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7357] 
	 nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7210] 
	 nsCSSFrameConstructor::ProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 12075] 
	 nsCSSFrameConstructor::ConstructTableCellFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2980] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3239] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableRowFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2821] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3225] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableRowGroupFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2709] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3219] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2585] 
	 nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 6544] 
	 nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7357] 
	 nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7210] 
	 nsCSSFrameConstructor::ProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 12075] 
	 nsCSSFrameConstructor::ConstructTableCellFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2980] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3239] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableRowFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2821] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3225] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableRowGroupFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2709] 
	 nsCSSFrameConstructor::TableProcessChild
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3219] 
	 nsCSSFrameConstructor::TableProcessChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 3136] 
	 nsCSSFrameConstructor::ConstructTableFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 2585] 
	 nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 6544] 
	 nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7357] 
	 nsCSSFrameConstructor::ConstructFrame
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7210] 
	 nsCSSFrameConstructor::ProcessBlockChildren
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 13250] 
	 nsCSSFrameConstructor::ConstructBlock
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 13194] 
	 nsCSSFrameConstructor::ConstructFrameByDisplayType
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 6473] 
	 nsCSSFrameConstructor::ConstructFrameInternal
[c:/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp 
line 7357]  
 
     (20976872)	URL: http://www.realtor.com
     (20879588)	URL: http://www.realtor.com
     (20879588)	Comments: search on realtor.com

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 1

•

21 years ago

I'm not seeing a crash.  Anyone know the steps to reproduce?

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 2

•

21 years ago

The talkback reports show the crash is on the third-to-last instruction of the
function:

61570141 8b4814           mov     ecx,[eax+0x14]      <=== crash here
61570144 e8de010000       call    61570327
61570149 c20800           ret     0x8

This doesn't make any sense to me.  If |this| were garbage, we'd have crashed
already (virtual function call).  Furthermore, the inner call is a non-virtual
function call.

The registers aren't available.

Matthias Versen [:Matti]

Comment 3

•

21 years ago

I got this crash today while opening 5 different blogs in new Tabs from gemal
blog page ( http://gemal.dk/mozilla/blogupdates.html ) but I can't reproduce
this with the same steps :-(

(1 day old win2k trunk)

Matthias Versen [:Matti]

Comment 4

•

21 years ago

Attached file win2k stack from an optimized with symbols — Details

A screenshot from MSVC++ : http://matti.no-ip.org/debug.gif
(domain is blocked from the NSCP Firewall but you can use my IRC IP to access
it)

crashed again while opening 5-10 Tabs very fast (middle click + loading in the
background) : Chris Nelson's Weblog, adot's notblog*, doron's blaahg, Zach's
Blog, Blogzilla - a blog about Mozilla, Surf*Mind*Musings, <Glazblog/>, Hixie's
Natural Log, DougT's Ramblings, kovu's blog )

I hope this helps...

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 5

•

21 years ago

What was |mDeclaration| ?  And was the memory corrupt?

Matthias Versen [:Matti]

Comment 6

•

21 years ago

This were an optimized with symbols and MSVC++ couldn't show |mDeclaration| :-( 

Dunno if the memory is corrupt because I'm no developer (=I'm dumb)

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 7

•

21 years ago

[06-26 18:10:25] <Matti> dbaron: i got the crash again and i have the debugger open
[06-26 18:10:49] <Matti> you want to know "mDeclaration" right ?
[06-26 18:13:37] <Matti> mDeclaration is "0x00000000" this time and aRuleData is
0x0012dde0

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 8

•

21 years ago

Comment on attachment 126556 [details]
win2k stack from an optimized with symbols

Oh, this part of the stack shows the problem pretty clearly:

>nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x037f9178, nsIContent * 0x03932ad0, int 16) line 1381 + 10 bytes
[...]
>HTMLContentSink::BeginUpdate(HTMLContentSink * const 0x026eca30, nsIDocument * 0x037f9178) line 5383
>nsDocument::BeginUpdate(nsDocument * const 0x037f9178) line 1835 + 7 bytes
>nsGenericHTMLElement::SetHTMLAttribute(nsGenericHTMLElement * const 0x00000000, nsIAtom * 0x0024e950, const nsHTMLValue & {...}, int 1) line 2013
>nsDOMCSSAttributeDeclaration::DeclarationChanged(nsDOMCSSAttributeDeclaration * const 0x014729c0 const  CSSStyleRuleImpl::`vftable'{for `nsICSSStyleRule'}) line 96 + 32 bytes
>nsDOMCSSDeclaration::ParsePropertyValue(nsDOMCSSDeclaration * const 0x014729c0 const  CSSStyleRuleImpl::`vftable'{for `nsICSSStyleRule'}, const nsAString & {...}, const nsAString & {...}) line 288 + 7 bytes

I'm not yet sure what to do about it, though.

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 9

•

21 years ago

Attached patch patch (obsolete) — Details — Splinter Review

This should work as a temporary fix, at least.

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Updated

•

21 years ago

Attachment #126598 - Flags: superreview?(bzbarsky)

Attachment #126598 - Flags: review?(bzbarsky)

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 10

•

21 years ago

Comment on attachment 126598 [details] [diff] [review]
patch

There's something wrong here.

Attachment #126598 - Attachment is obsolete: true

Attachment #126598 - Flags: superreview?(bzbarsky)

Attachment #126598 - Flags: review?(bzbarsky)

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 11

•

21 years ago

Attached patch patch (obsolete) — Details — Splinter Review

Only change the way we handle the declaration, not the selector.

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Updated

•

21 years ago

Attachment #126605 - Flags: superreview?(bzbarsky)

Attachment #126605 - Flags: review?(bzbarsky)

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Updated

•

21 years ago

Whiteboard: [patch]

Boris Zbarsky [:bzbarsky]

Comment 12

•

21 years ago

Comment on attachment 126605 [details] [diff] [review]
patch

I'm not sure what I think of removing those |if (mDeclaration)| checks, given
that Clone() can return null on OOM...

Other than that looks reasonable; I'm assuming we have scripts setting inline
style on nodes that have not been flushed from the sink yet....

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 13

•

21 years ago

Attached patch patch (obsolete) — Details — Splinter Review

Also make CSSStyleRuleImpl::Clone return null/NS_ERROR_OUT_OF_MEMORY whenever
declaration / selector allocation fails.

Attachment #126605 - Attachment is obsolete: true

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Updated

•

21 years ago

Attachment #126716 - Flags: superreview?(bzbarsky)

Attachment #126716 - Flags: review?(bzbarsky)

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Updated

•

21 years ago

Attachment #126605 - Flags: superreview?(bzbarsky)

Attachment #126605 - Flags: review?(bzbarsky)

Boris Zbarsky [:bzbarsky]

Comment 14

•

21 years ago

Comment on attachment 126716 [details] [diff] [review]
patch

Um... this still removes those checks for mDeclaration being non-null...

Attachment #126716 - Flags: superreview?(bzbarsky)

Attachment #126716 - Flags: superreview-

Attachment #126716 - Flags: review?(bzbarsky)

Attachment #126716 - Flags: review-

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 15

•

21 years ago

Comment on attachment 126716 [details] [diff] [review]
patch

Could you describe a codepath that would make it null?	(See comment 13.)

Attachment #126716 - Flags: superreview?(bzbarsky)

Attachment #126716 - Flags: superreview-

Attachment #126716 - Flags: review?(bzbarsky)

Attachment #126716 - Flags: review-

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 16

•

21 years ago

Attached patch patch — Details — Splinter Review

Attachment #126716 - Attachment is obsolete: true

Boris Zbarsky [:bzbarsky]

Updated

•

21 years ago

Attachment #126716 - Flags: superreview?(bzbarsky)

Attachment #126716 - Flags: review?(bzbarsky)

Boris Zbarsky [:bzbarsky]

Comment 17

•

21 years ago

Comment on attachment 126753 [details] [diff] [review]
patch

r+sr=bzbarsky

Attachment #126753 - Flags: superreview+

Attachment #126753 - Flags: review+

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 18

•

21 years ago

Fix checked in to trunk, 2003-06-30 14:31 -0700.

Status: NEW → RESOLVED

Closed: 21 years ago

Resolution: --- → FIXED

Olivier Cahagne

Comment 19

•

21 years ago

*** Bug 211125 has been marked as a duplicate of this bug. ***

David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)

Assignee

Comment 20

•

21 years ago

Talkback isn't showing any reports after 2003063008.  (I'm assuming talkback has
been working in those builds, which I'm not sure of, since there have been some
talkback problems recently.)

Jay Patel [:jay]

Comment 21

•

21 years ago

David: Talkback reports have not successfully completed since July 1st.  I think
I  have fixed the problem and tommorrow's reports should have the latest
Talkback data for the past 10 days.

Nobody; OK to take it and work on it

Updated

•

13 years ago

Crash Signature: [@ CSSStyleRuleImpl::MapRuleInfoInto]

You need to log in before you can comment on or make changes to this bug.