248975 - Website http://www.parasoft.com/ causes crash [@ nsGenericHTMLElement::RecreateFrames ]

Status: RESOLVED DUPLICATE of bug 246556

(Core :: Layout, defect)

Description

[Martin Thomson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040614 Lightningtiger/0.9 (Firefox/0.9 polymorph)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040614 Lightningtiger/0.9 (Firefox/0.9 polymorph)

Navigating to a particular page on this site causes the browser to crash.  I'm
not sure how many pages, but that particular one works every time.

Reproducible: Always
Steps to Reproduce:
1. Navigate to http://www.parasoft.com/
2. Click the link "Unit Testing" (near the bottom)
3. Crash

Actual Results:  
Crashed Firefox - it appeared to be half way through loading or rendering the page.

Expected Results:  
The page should render.

Default theme but the following extensions installed:
livehttpheaders 0.8, mouse gestures 0.9-20040608, user agent switcher 0.4, web
developer 0.8, firesomething 1.5.1, download manager tweak 0.4.3, single window
1.0, javascript console status 1.5, open book 1.0, chromedit 0.0.5.1.1,
flashblock (latest from mozdev)
None of these use native code as far as I know, so I wouldn't have thought they
could cause a crash.

Moz 1.7 handles the page well enough.

Comment 1

[Bernard Alleysson]

(In reply to comment #0)
> None of these use native code as far as I know, so I wouldn't have thought they
> could cause a crash.

You would be right if the Mozilla code base was not buggy, but it is not (just
search bugzilla !).
 
> Moz 1.7 handles the page well enough.

Please try without extensions on a clean install

Comment 2

[Adam Hauner]

WFM Ff 0.9/W2K
Martin Thomson: Could you provide TalkBack incident id?

Comment 3

[Martin Thomson]

Firefox 0.9.1 doesn't crash, until I add all the extensions back (I didn't
bother with chromedit).  Funny thing is that while the crash is 100% reliable,
it didn't crash with the history sidebar open.

Talkback doesn't seem to have the incident yet:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=url&match=contains&searchfor=parasoft

Comment 4

[Adam Hauner]

TB188909:
nsGenericHTMLElement::RecreateFrames 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 538]
SinkContext::CloseContainer 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 1477]
HTMLContentSink::CloseContainer 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 3123]
CNavDTD::CloseContainersTo 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 3764]
CNavDTD::HandleEndToken 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 2097]
CNavDTD::HandleToken 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 1022]
CNavDTD::BuildModel 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 511]
nsParser::BuildModel 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 1899]

Similar stack has James Ross' fixed bug 246556, ccing.

Comment 5

[Adam Hauner]

-> Layout

Comment 6

[James Ross]

According to Bonsai (and it's lovely new graph feature), the fix for bug 246556
did NOT make the Firefox 0.9.1 branch. Observe:

http://webtools.mozilla.org/bonsai/cvsblame.cgi?file=mozilla/content/html/content/src/nsGenericHTMLElement.cpp&rev=FIREFOX_0_9_1_BRANCH&cvsroot=/cvsroot&mark=538#535

This should probably just be DUPed to bug 246556.

Comment 7

[Adam Hauner]

*** This bug has been marked as a duplicate of 246556 ***

Comment 8

[Bernard Alleysson]

It has been fixed on the AVIARY_1_0_20040515_BRANCH on 2004-06-17 18:58 by
dbaron%dbaron.org:
mozilla/content/html/content/src/nsGenericHTMLElement.cpp 1.495.2.1.4.2 
AVIARY_1_0_20040515_BRANCH  	4/0  	Merging changes on MOZILLA_1_7_BRANCH between
AVIARY_1_0_20040515_BASE and MOZILLA_1_7_RELEASE: bug 246556.

FIREFOX_0_9_1_BRANCH was created on 2004-06-23 23:38 but it doesn't include the
fix for a 2004-06-17 18:58 checkin ?

I don't get it, but in any case you can verified it FIXED in a latest firefox
0.9 nightly.