23847 - Crash when viewing Tinderbox

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[scottputterman]

When viewing Tinderbox, I crash at

CellData::IsZeroRowSpan() line 111 + 3 bytes
nsCellMap::GetMapCellAt(int 9, int 4, int 13) line 1657 + 8 bytes
nsCellMap::AppendCell(nsTableCellMap & {...}, nsTableCellFrame & {...}, int 9,
int 0) line 690 + 25 bytes
nsCellMap::ExpandWithRows(nsTableCellMap & {...}, nsVoidArray & {...}, int 0)
line 943
nsCellMap::InsertRows(nsTableCellMap & {...}, nsVoidArray & {...}, int 0, int 1)
line 644
nsTableCellMap::InsertRows(nsTableRowGroupFrame & {...}, nsVoidArray & {...},
int 0, int 1) line 263
nsTableFrame::InsertRows(nsIPresContext & {...}, nsTableRowGroupFrame & {...},
nsVoidArray & {...}, int 0, int 1) line 1062
nsTableFrame::InsertRowGroups(nsIPresContext & {...}, nsIFrame * 0x0281474c, int
0) line 1203
nsTableFrame::AppendRowGroups(nsIPresContext & {...}, nsIFrame * 0x0281474c)
line 1121
nsTableFrame::SetInitialChildList(nsTableFrame * const 0x028146e0,
nsIPresContext * 0x0324b1c0, nsIAtom * 0x00000000 {???}, nsIFrame * 0x0281474c)
line 343
nsCSSFrameConstructor::ConstructTableFrame(nsIPresShell * 0x02be0670,
nsIPresContext * 0x0324b1c0, nsFrameConstructorState & {...}, nsIContent *
0x02cdb8dc, nsIFrame * 0x028144e4, nsIStyleContext * 0x03292c40, nsIFrame * &
0x0281468c, nsTableCreator & {...}) line 1171
nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x02be0670,
nsIPresContext * 0x0324b1c0, nsFrameConstructorState & {...}, const
nsStyleDisplay * 0x03292e70, nsIContent * 0x02cdb8dc, nsIFrame * 0x028144e4,
nsIStyleContext * 0x03292c40, nsFrameItems & {...}) line 4950 + 46 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x02be0670, nsIPresContext
* 0x0324b1c0, nsFrameConstructorState & {...}, nsIContent * 0x02cdb8dc, nsIFrame
* 0x028144e4, nsFrameItems & {...}) line 5450 + 45 bytes
nsCSSFrameConstructor::ProcessBlockChildren(nsIPresShell * 0x02be0670,
nsIPresContext * 0x0324b1c0, nsFrameConstructorState & {...}, nsIContent *
0x02cdc15c, nsIFrame * 0x028144e4, int 1, nsFrameItems & {...}, int 1) line 9869
+ 37 bytes
nsCSSFrameConstructor::ConstructBlock(nsIPresShell * 0x02be0670, nsIPresContext
* 0x0324b1c0, nsFrameConstructorState & {...}, const nsStyleDisplay *
0x0328bb40, nsIContent * 0x02cdc15c, nsIFrame * 0x0118c764, nsIStyleContext *
0x0328b910, nsIFrame * 0x028144e4) line 9822 + 36 bytes
nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x02be0670,
nsIPresContext * 0x0324b1c0, nsFrameConstructorState & {...}, const
nsStyleDisplay * 0x0328bb40, nsIContent * 0x02cdc15c, nsIFrame * 0x0118c764,
nsIStyleContext * 0x0328b910, nsFrameItems & {...}) line 4909 + 43 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x02be0670, nsIPresContext
* 0x0324b1c0, nsFrameConstructorState & {...}, nsIContent * 0x02cdc15c, nsIFrame
* 0x0118c764, nsFrameItems & {...}) line 5450 + 45 bytes
nsCSSFrameConstructor::ContentAppended(nsCSSFrameConstructor * const 0x02be08c0,
nsIPresContext * 0x0324b1c0, nsIContent * 0x02bee57c, int 5) line 6022
StyleSetImpl::ContentAppended(StyleSetImpl * const 0x02be0960, nsIPresContext *
0x0324b1c0, nsIContent * 0x02bee57c, int 5) line 939
PresShell::ContentAppended(PresShell * const 0x02be0678, nsIDocument *
0x0324a320, nsIContent * 0x02bee57c, int 5) line 2391 + 46 bytes
nsDocument::ContentAppended(nsDocument * const 0x0324a320, nsIContent *
0x02bee57c, int 5) line 1545
nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x0324a320, nsIContent *
0x02bee57c, int 5) line 1112
HTMLContentSink::NotifyAppend(nsIContent * 0x02bee57c, int 5) line 3776
SinkContext::FlushTags() line 1830
SinkContext::DidAddContent(nsIContent * 0x03268a2c, int 0) line 1154
SinkContext::FlushText(int * 0x00000000, int 1) line 1922
SinkContext::FlushTextAndRelease(int * 0x00000000) line 345
SinkContext::OpenContainer(const nsIParserNode & {...}) line 1162
HTMLContentSink::OpenContainer(HTMLContentSink * const 0x0324e650, const
nsIParserNode & {...}) line 2785 + 15 bytes
CNavDTD::OpenContainer(const nsIParserNode * 0x02c6d1b0, nsHTMLTag eHTMLTag_a,
int 1, nsEntryStack * 0x00000000) line 2948 + 31 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x0203be50, nsHTMLTag eHTMLTag_a,
nsIParserNode * 0x02c6d1b0) line 1153 + 20 bytes
CNavDTD::HandleStartToken(CToken * 0x0203be50) line 1467 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x02be9e30, CToken * 0x0203be50, nsIParser
* 0x0324c910) line 824 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x02be9e30, nsIParser * 0x0324c910,
nsITokenizer * 0x02bebc00, nsITokenObserver * 0x00000000, nsIContentSink *
0x0324e650) line 568 + 20 bytes
nsParser::BuildModel() line 1049 + 34 bytes
nsParser::ResumeParse(nsIDTD * 0x00000000, int 0) line 973 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x0324c914, nsIChannel * 0x032480c0,
nsISupports * 0x00000000, nsIInputStream * 0x02bc27c8, unsigned int 0, unsigned
int 8192) line 1343 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x032484c0,
nsIChannel * 0x032480c0, nsISupports * 0x00000000, nsIInputStream * 0x02bc27c8,
unsigned int 0, unsigned int 8192) line 235 + 46 bytes
nsHTTPResponseListener::OnDataAvailable(nsHTTPResponseListener * const
0x02bc1070, nsIChannel * 0x03242174, nsISupports * 0x032480c0, nsIInputStream *
0x02bc27c8, unsigned int 49152, unsigned int 8192) line 195 + 58 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x03284610)
line 370
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x03284530) line 93 + 12 bytes
PL_HandleEvent(PLEvent * 0x03284530) line 522 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010518c0) line 483 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x000e0b10, unsigned int 49480, unsigned int 0,
long 17111232) line 951 + 9 bytes
USER32! 77e71820()
010518c0()

Comment 1

[Jon Granrose]

I crash on linux with today's verification build when viewing tinderbox also.

changed to all/all and blocker.

Comment 2

[cpratt]

It isn't just Tinderbox. For example, www.chinatimes.com.tw crashes (and that's
a smoke test verification site).

Comment 3

[karnaze (gone)]

Fixed with Hyatt's latest checkin.

Comment 4

[Chris Petersen]

I'm not able to repro this crash with the Jan 18th.