243671 - Crash in [@ QBCurve::MidPointDivide] scrolling / closing Print Preview of http://www.kibo.com/webtv/webtv.html

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: 2004-05-14-09, Windows XP.

It could possibly be the world's most annoying webpage (that's the idea, I
think), but closing Print Preview of:

http://www.kibo.com/webtv/webtv.html

crashes reliably here:

QBCurve::MidPointDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 4009]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3972]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]
QBCurve::SubDivide
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 3981]

Comment 1

[Boris Zbarsky [:bzbarsky]]

Can you attach the full stack to this bug, please?

That looks like an infinite recursion crash to me.  Local variable values would
be ideal.

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Stack/comments from http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=48044

Comment 3

[Boris Zbarsky [:bzbarsky]]

Stephen, that's just the top of the stack (see the "stack overflow" reason). 
The full stack is probably a few thousand items long... And I was sorta hoping
to see who the original caller is.  :(

Can someone minimize the testcase?  The rounded corners (I assume there are some
based on the function involved) should be relevant.

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Actually, just loading Print Preview and then scrolling within that view
triggers the crash for me 100%.

Comment 5

[chris hofmann]

if there is an easy fix we might want to get it for 1.7 final

Comment 6

[Frank Wein [:mcsmurf]]

This produces many
WARNING: NS_ENSURE_TRUE(container) failed, file
d:/mozilla/tree6/mozilla/content/base/src/nsDocument.cpp, line 2686 but thats all
when scrolling but no crash on win2k with a current cvs trunk debug build. Also
it seems when scrolling on every new page in the lower part of the page i get
100% cpu usage for 2-3 seconds.

Comment 7

[chris hofmann]

I can't seem to reproduce with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.7) Gecko/20040511

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

This is crashing again with build 2004-06-02 on Windows XP.

Comment 9

[Olivier Cahagne]

there's a hanging (crashing ?) testcase in bug 27650 (sorry, cannot check myself
atm).

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

In https://bugzilla.mozilla.org/show_bug.cgi?id=265736, the testcase

https://bugzilla.mozilla.org/attachment.cgi?id=163706&action=view

crashes right away in the same method.  It might not be a DUP, but it'll be
interesting to see if this bug is fixed when that minimized testcase is fixed, too.

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

This no longer crashes for me, Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8b2) Gecko/20050226