214188 - crash upon entering page as soon as rendering starts

Status: RESOLVED DUPLICATE of bug 203041

(SeaMonkey :: General, defect)

Description

[Nicholas Cook]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5a) Gecko/20030718
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5a) Gecko/20030718 + tested with 1.4

I have narrowed down the page as much as I can that makes mozilla crash. 
Everytime you go to the page, the page downloads, then starts to render and then
crashes mozilla.  The original full page (it is large) is at
http://intropolis.com/mozilla-test-full.html.  This page does render in other
browsers.


Reproducible: Always

Steps to Reproduce:
1. go to http://www.intropolis.com/mozilla-test.html
2.
3.

Actual Results:  
Talkback agent pops up.

Expected Results:  
Displayed the page.

Comment 1

[Hermann Schwab]

Mozilla 1.3.1, TB22269116M
Mozilla 1.4 crashed, but didn´t trigger talkback, as I'm using a test version.

Reporter, can you please report your Talkback-IDs, if you submitted talkback?
You can see them if you start talkback.exe from Mozillas Component directory.
In newer versions you can copy&paste.

Comment 2

[Nicholas Cook]

Talkback id's TB22269451Q, TB22269436W, TB22264426H.  These are from 1.5 alpha
build.  Talkback id's from 1.4 seem to be gone from when I upgraded. 
TB22269436W is for the shortened example page.  TB22269451Q is produced by me
going to the orinigal page.

Comment 3

[Hermann Schwab]

Testing with Mozilla 1.02 I didn´t get a crash, but saw nothing on the testpage.
In the source of the testpage I found a closing </form>, but no opening form tag.
I did download both files with Mozilla 1.02, and the original file rendered
fine, locally, or loaded from net.
Using Mozilla 1.4, I could load this page locally, but loaded from the net, it
instantly crashed. I'm testing on Win98.

Comment 4

[Boris Zbarsky [:bzbarsky]]

The crash happens at:

11264             if (aParentContent == kidContent ||

because of:

(gdb) p kidContent
$9 = (nsIContent *) 0xdddddddd
(gdb) p *kidFrame
$10 = {<nsISupports> = {_vptr.nsISupports = 0x867f2b0}, mRect = {x = -572662307, 
    y = -572662307, width = -572662307, height = -572662307}, mContent =
0xdddddddd, 
  mStyleContext = 0xdddddddd, mParent = 0xdddddddd, mNextSibling = 0xdddddddd, 
  mState = 3722304989}

This bug 203041 

*** This bug has been marked as a duplicate of 203041 ***

*** This bug has been marked as a duplicate of 203041 ***