216343 - aocusa.com crashes browser

Status: RESOLVED WORKSFORME

(Core :: Layout: Block and Inline, defect)

Description

[Jim Castleberry]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624

While browsing around aocusa.com the browser hangs.  It's not always at
the same place, but it always crashes within 4 or 5 clicks.  The Talkback
dialog pops up, then after I click "submit" for that the browser window
is hung and I have to kill the mozilla process.
I recreated the crash twice in a row by starting mozilla, typing in
    http://aocusa.com/fans.asp?manufac=EVERCOOL
and clicking Reseller List in the Where To Buy popdown menu on the page.

Reproducible: Always

Steps to Reproduce:
1.Go to http://aocusa.com/fans.asp?manufac=EVERCOOL
2.Pick Reseller List on the Where To Buy popdown menu.
3.If that doesn't crash, try clicking on other links in the page.

Actual Results:  
Talkback diaplog popped up.  After I submitted it the browser was hung, didn't
redraw the window, and I had to kill the process to recover.

Expected Results:  
Displayed the page and not crashed.

Tried "rm -rf ~/.mozilla" before starting the browser to make sure my settings
weren't causing it.  Didn't help.  I submitted several Talkback reports via the
popup but didn't record any ID's for them.

Comment 1

[Jim Castleberry]

Turning off javascript makes the crashes go away.  The site looks
a lot different then, but it works.  Changing component to javascript.

Comment 2

[Hermann Schwab]

TB22794460E with Mozilla 1.4 (no talkback packaged with trunk)
crash with Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5b) Gecko/20030815
and with BuildID 20030813. 
Because these builds are missing the talkbackcomponent, I tested with Mozilla 1.4

Jim, it makes life easier if you post the Talkback IDs. I don´t know how to get
them with Linux, with windows you simply start talkback.exe from Mozillas
Components directory, after the report has been sent.

Comment 3

[Hermann Schwab]

TB22799723W
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5b) Gecko/20030815 installed from
win32-talkback.zip

Stack summary from DocWatson shows, that GKLAYOUT.DLL is calling EDITOR.DLL?

Comment 4

[Phil Schwartau]

Attachment: TALBACK STACK TRACES (2)

Comment 5

[Phil Schwartau]

The Talkback stack traces implicate Layout, not JavaScript Engine.
Reassigning to Layout component -

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

->Editor:Core, since both crashes are within initialization of the editor inside
a text input

Comment 7

[Andrew Schultz]

dupe of bug 117695?  I can't seem to reproduce either one.

Comment 8

[Jim Castleberry]

Okay, looks like I can get talkback id's on Linux by running
components/talkback/talkback. In case it's still of any use,
the talkback id's I sent while trying to narrow down the problem
before submitting this bug are:
  TB22791251W
  TB22791290M
  TB22791310E
  TB22791330Y
  TB22791361K
  TB22791380K
  TB22791488M
  TB22791822M

Comment 9

[Joe Francis]

So far I can't reproduce this.  Between the included stacks and the talkback
stacks i see 2 crashes in editor, one in selection, and a bunch in nsLineBox. 
My build info is Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.5b)
Gecko/20030708; this despite building today.  I'm going to clobber and try again.

Comment 10

[Joe Francis]

With a fresh build I am still unable to reproduce this.  I only have Mac OS X
access now.  cc'ing dbaron in case he can repro this.

Comment 11

[David Bradley]

I'm seeing the selection deleted while the editor still has a pointer to it.
Below is the stack where the selection is getting deleted.

delete(void *) [delop.cpp:6]
nsSelection::`scalar deleting destructor'(UINT) [gklayout.dll]
nsSelection::Release(void) [nsSelection.cpp:993]
nsCOMPtr<nsIFrameSelection>::~nsCOMPtr<nsIFrameSelection>(void) [nsCOMPtr.h:474]
nsTextInputSelectionImpl::~nsTextInputSelectionImpl(void)
[nsTextControlFrame.cpp:410]
nsTextInputSelectionImpl::`scalar deleting destructor'(UINT) [gklayout.dll]
nsTextInputSelectionImpl::Release(void) [nsTextControlFrame.cpp:501]
   
nsCOMPtr<nsISelectionController>::assign_assuming_AddRef(nsISelectionController
*) [nsCOMPtr.h:455]
nsCOMPtr<nsISelectionController>::assign_with_AddRef(nsISupports *) [nsCOMPtr.h:957]
nsCOMPtr<nsISelectionController>::=(nsISelectionController *) [nsCOMPtr.h:568]

Comment 12

[Matthias Versen [:Matti]]

Attachment: 2 stacktraces from my win2k builds

Comment 13

[David Bradley]

The crash I'm getting is fairly reproduceable and is in a debug build. I'd say
lets focus on the deleted nsSelection issue, get it fixed, and then see if their
are additional crashes. Optimized builds might go a ways before realizing things
went wrong.

Comment 14

[Joe Francis]

over to layout.  The editor is properly addrefing and releasing the selection
object, so I think there must be a refcount balance problem elsewhere.

Comment 15

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: Call stack

stack (CVS Firebird), WinXP.

Comment 16

[Ronald Tilby]

The URL wfm using 2004050609 Nightly on Windows XP.
What's the right thing to do with crasher bugs that can't be reproduced anymore?

Comment 17

[David Bradley]

Can anyone see if this is showing up on Talkback?

Comment 18

[Jay Patel [:jay]]

Unless someone is able to reproduce this crash with recent Mozilla/Firebird
builds, it'll be tough to find incidents in Talkback data.  We recently moved to
a fresh db at the Mozilla Foundation and so we no longer have access to the old
Netscape/AOL Talkback servers.  If anyone is able to reproduce this crash,
please post your Talkback IDs.  Thanks.

Comment 19

[Asa Dotzler [:asa]]

We should look at talkback after final and close this if it's not showing up there. 

Comment 20

[Hermann Schwab]

crashed Mozilla 1.4.2: 2004042614
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a2) Gecko/20040528

http://aocusa.com/fans.asp?manufac=EVERCOOL crash with Mozilla 1.4.2
missing images on this page:
http://aocusa.com/images/retail/.gif
http://aocusa.com/images/fans/1.jpg
http://aocusa.com/images/fans/2.jpg

Comment 21

[Hermann Schwab]

reproducible crashing with Mozilla 1.4.2: 2004042614 on Win98
Javascript must be enabled, script options can all be disabled, 
load http://aocusa.com/fans.asp?manufac=EVERCOOL and crash, no action needed.

Made a local copy, didn´t crash, as long as I couldn´t access this file:
<script language="JavaScript1.2" src="/images/mm_menu.js"></script>
When I included that script in my local copy, or set the correct path to it,
Mozilla 1.4.2 was crashing.

http://aocusa.com/images/mm_menu.js

With Mozilla 1.8a2 I get a lot of JS warnings, mostly noise ( if document.all),
some references or accesses to undefined variables or properties.

I don´t think this bug is in the trunk anymore, today I couldn´t see it in
Mozilla 1.6, 1.7b, 1.8a2, but it is still living in the 1.4 branch, as seen in
1.4.2. Should Version be changed from 'Trunk' to '1.4 Branch' ?

Comment 22

[Ronald Tilby]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040917
Nightly 2004091704 on Windows XP SP2 fully patched.
None of the specific pages cited here currently exist.  The current aocusa.com
pages WFM.  Is this crash still happening to anyone?  Can this bug be closed?

Comment 23

[Ronald Tilby]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050323
Please close this old dead bug.  The aocusa.com pages WFM, talkback search
doesn't find any crashes.

Comment 24

[Andrew Schultz]

resolving WORKSFORME since nobody can reproduce the crash