216065 - Mozilla crashed when I tried to sort the rows [@ 0x00000000 ][@ nsCSSFrameConstructor::FindFrameWithContent ]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Mihail Daskalov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030808
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030808

The page display a table, with arrows in the header. if you click the arrow it
sorts the table contents by the column you clicked on.

Reproducible: Always

Steps to Reproduce:
1.Go to http://www.softcomplex.com/products/tigra_tables_pro/demo1.html
2.Click in the header of the table (so that to sort the rows in the table)
3.

Actual Results:  
Mozilla crashes.

Expected Results:  
not crash.

with Thunderburd 0.6.1 this is not happening.

Talkback ID:  TB22718196K

Sorry for not specifying the right component but I'm not sure if it JS Engine,
or DOM something.

Comment 1

[Mihail Daskalov]

For sure it doesn't crash everytime.

Comment 2

[Ronald Tilby]

confirmed using Mozilla 2003081304 nightly on Windows 2000.
Suggest: Status: NEW, Keywords:Crash

Comment 3

[Chase Tingley]

Confirming per Ron Tilby; I also see this with a trunk linux build from Sunday
when sorting by the second column.

Stack coming shortly.  As a side note, there's a whole pile of these when
rendering the page.

###!!! ASSERTION: frame was not removed from primary frame map before
destruction or was readded to map after being removed:
'!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame', file
nsFrameManager.cpp, line 1026
Break: at file nsFrameManager.cpp, line 1026

Comment 4

[Chase Tingley]

Attachment: stack trace

100-some-odd frames deep in layout:

#7  0x40fddabe in nsCSSFrameConstructor::FindPrimaryFrameFor(nsIPresContext*,
nsIFrameManager*, nsIContent*, nsIFrame**, nsFindFrameHint*) (this=0x870ec28, 
    aPresContext=0x870d468, aFrameManager=0x8722748, aContent=0x879a690,
    aFrame=0xbfffb808, aHint=0x0) at nsCSSFrameConstructor.cpp:11349

There are also a great many SetDocument() calls further up.

Comment 5

[Chase Tingley]

-> Layout.  May be a dup of bug 119029, which is also in FPFF.

Comment 6

[Andrew Schultz]

worksforme with linux trunk 20030812 and debug CVS.  a testcase would be nice.

> May be a dup of bug 119029,

that bug had no solid steps to reproduce and no activity and I marked it WFM...

Comment 7

[Chase Tingley]

I updated my tree just now, and was still able to reproduce it.  However, it
took a lot of clicking, whereas before it would crash almost every time.

Comment 8

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: stack trace

Blew up for me first time (sorted the first column by clicking the
downward-pointing arrow).

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030817 Mozilla
Firebird/0.6.1+

Comment 9

[Olivier Cahagne]

dupe of bug 203041 ?

Comment 10

[Hermann Schwab]

URL produces some errors in Javascript Console, but doesn´t show the table, so I
couldn´t test the crash.
Opera is working on this URL.

http://www.softcomplex.com/products/tigra_tables_pro/demo1.html

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7b) Gecko/20040316

Comment 11

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7b) Gecko/20040330

last crash reports were from 1.5b, more than 7 months ago, does anybody still
see crashes with a more current version of Mozilla, i.e. 1.4.1, 1.6 or 1.7.x ?

From BuildID 2004010508 to BuildID 2004032909 the table wasn´t shown,
Bug 238945 do;while(0)return needs autosemicolon insertion (JS generated table
not shown, works in 1.4.1 and 1.6)

Comment 12

[Olivier Cahagne]

wfm FF 20040401 on Linux

Comment 13

[Andrew Schultz]

The page itself has changed (it's v2.0 now).  I have the original, but I don't
have the relevant javascript (which also changed), so I can't reproduce it with
that either.

marking WORKSFORME... reopen if you have the original archived somewhere and it
still crashes Mozilla.