Closed Bug 251219 Opened 20 years ago Closed 17 years ago

firefox crashes while rendering the page [@ nsTextFrame::TextStyle::TextStyle() ]

Categories

(Core Graveyard :: GFX: Gtk, defect)

Product:
Core Graveyard
Component:
GFX: Gtk
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED INCOMPLETE

People

(Reporter: rodolfo, Assigned: blizzard)

References

(
URL
)

Details

(Keywords: crash, qawanted, Whiteboard: CLOSEME 07/01)

Crash Data

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040705 Firefox/0.9.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040705 Firefox/0.9.1

firefox just crashes. nothing expectacular. this baby here happens frequently
with  me.

This was originally bugzilla ID 249945, but I've messed the things up a little.
What I thought was a similar bug that happens in another page (a simpler one,
maybe easier to debug), was really another different bug. So the original
bugzilla id now reflects another bug, and this one here reflects the original.
SORRY!

Reproducible: Always
Steps to Reproduce:
1. go to the address
2. press OK when a javascript popup appears
3. wait a little and then CRASH

Actual Results:  
firefox crashes

Expected Results:  
normal rendering of the page

talkback id: TB320973G

stacktrace:

#0  0xffffe410 in ?? ()
#1  0xbfffc258 in ?? ()
#2  0x0000000b in ?? ()
#3  0x00002061 in ?? ()
#4  0x40171de3 in raise () from /lib/libpthread.so.0
#5  0x0878d402 in nsPrintSession::QueryInterface ()
#6  <signal handler called>
#7  0x08449865 in nsPRUint32Key::Clone ()
#8  0x084485a5 in nsPRUint32Key::Clone ()
#9  0x0843222f in nsPRUint32Key::Clone ()
#10 0x0842f17e in nsPRUint32Key::Clone ()
#11 0x0842ee55 in nsPRUint32Key::Clone ()
#12 0x0842ecd0 in nsPRUint32Key::Clone ()
#13 0x0843222f in nsPRUint32Key::Clone ()
#14 0x0841e0dc in nsPRUint32Key::Clone ()
#15 0x0841dfbd in nsPRUint32Key::Clone ()
#16 0x0841dd15 in nsPRUint32Key::Clone ()
#17 0x0841dc12 in nsPRUint32Key::Clone ()
#18 0x0841ca2b in nsPRUint32Key::Clone ()
#19 0x0841c6aa in nsPRUint32Key::Clone ()
#20 0x0841ae48 in nsPRUint32Key::Clone ()
#21 0x08421b11 in nsPRUint32Key::Clone ()
#22 0x0841d60f in nsPRUint32Key::Clone ()
#23 0x0841ca7f in nsPRUint32Key::Clone ()
#24 0x0841c6aa in nsPRUint32Key::Clone ()
#25 0x0841ae48 in nsPRUint32Key::Clone ()
#26 0x08421b11 in nsPRUint32Key::Clone ()
#27 0x0841d60f in nsPRUint32Key::Clone ()
#28 0x0841ca7f in nsPRUint32Key::Clone ()
#29 0x0841c6aa in nsPRUint32Key::Clone ()
#30 0x0841ae48 in nsPRUint32Key::Clone ()
#31 0x0842699b in nsPRUint32Key::Clone ()
#32 0x0842b06c in nsPRUint32Key::Clone ()
#33 0x0846978d in nsPRUint32Key::Clone ()
#34 0x084693a7 in nsPRUint32Key::Clone ()
#35 0x0827e589 in nsReadingIterator<unsigned short>::advance ()
#36 0x0827bd43 in nsReadingIterator<unsigned short>::advance ()
#37 0x0827e589 in nsReadingIterator<unsigned short>::advance ()
#38 0x082812f2 in nsReadingIterator<unsigned short>::advance ()
#39 0x0842699b in nsPRUint32Key::Clone ()
#40 0x08449df7 in nsPRUint32Key::Clone ()
#41 0x0823160e in nsReadingIterator<unsigned short>::advance ()
#42 0x0823aab2 in nsReadingIterator<unsigned short>::advance ()
#43 0x0823b5eb in nsReadingIterator<unsigned short>::advance ()
#44 0x400f2ed6 in PL_HandleEvent () from /opt/firefox-0.9.1/libxpcom.so
#45 0x400f2e2a in PL_ProcessPendingEvents () from /opt/firefox-0.9.1/libxpcom.so
#46 0x400f4432 in nsEventQueueImpl::NotifyObservers () from
/opt/firefox-0.9.1/libxpcom.so
#47 0x0821ba28 in nsReadingIterator<unsigned short>::advance ()
#48 0x406023ff in g_io_unix_dispatch () from /usr/lib/libglib-2.0.so.0
#49 0x405d8687 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#50 0x405da933 in g_main_context_iterate () from /usr/lib/libglib-2.0.so.0
#51 0x405dabea in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#52 0x402a02d4 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#53 0x0821bcd4 in nsReadingIterator<unsigned short>::advance ()
#54 0x085de085 in nsPRUint32Key::Clone ()
#55 0x08789796 in nsPrintSession::QueryInterface ()
#56 0x08073687 in ?? ()
#57 0x00000001 in ?? ()
#58 0xbffff5e4 in ?? ()
#59 0x087a63c0 in _IO_stdin_used ()
#60 0xbffff5b8 in ?? ()
#61 0x409ba4a7 in __libc_start_main () from /lib/libc.so.6
Previous frame identical to this frame (corrupt stack?)
WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707
Firefox/0.8

the identifier in the help/about says is firefox/0.8 but it actually is
firefox/0.9.2. is this another bug?
(In reply to comment #1)
> WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707
> Firefox/0.8
> 
> the identifier in the help/about says is firefox/0.8 but it actually is
> firefox/0.9.2. is this another bug?

yes, that is another bug. You didn´t do a clean install, some extension still is
showing the 0.8 (TBE or Multizilla?)
TB320973G:
nsTextFrame::TextStyle::TextStyle()
nsTextFrame::Reflow() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsTextFrame.cpp,
line 5222]
nsLineLayout::ReflowFrame() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 997]
nsInlineFrame::ReflowInlineFrame(nsIPresContext*, nsHTMLReflowState const&,
nsInlineFrame::InlineReflowState&,() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 709]
nsInlineFrame::ReflowFrames(nsIPresContext*, nsHTMLReflowState const&,
nsInlineFrame::InlineReflowState&,() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 529]
nsInlineFrame::Reflow() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 443]
nsLineLayout::ReflowFrame() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsLineLayout.cpp,
line 997]
nsBlockFrame::ReflowInlineFrame() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3571]
nsBlockFrame::DoReflowInlineFrames() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3429]
nsBlockFrame::DoReflowInlineFramesAuto() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3332]
nsBlockFrame::ReflowInlineFrames() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3273]
nsBlockFrame::ReflowLine() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2440]
nsBlockFrame::ReflowDirtyLines() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2096]
nsBlockFrame::Reflow() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 816]
...

Same signature as bug 250061, but different stack.
-> Layout
Assignee: general → nobody
Component: Browser-General → Layout
Keywords: crash
QA Contact: general → core.layout
Summary: firefox crashes while rendering the page → firefox crashes while rendering the page [@ nsTextFrame::TextStyle::TextStyle() ]
another crash with a similar backtrace, so I think it's related to this bug.
This crash's talkback id: TB334910X

backtrace:
#0  0xffffe410 in ?? ()
#1  0xbfffcf08 in ?? ()
#2  0x0000000b in ?? ()
#3  0x00000888 in ?? ()
#4  0x40171de3 in raise () from /lib/libpthread.so.0
#5  0x0878d402 in nsPrintSession::QueryInterface ()
#6  <signal handler called>
#7  0x08449865 in nsPRUint32Key::Clone ()
#8  0x08441dff in nsPRUint32Key::Clone ()
#9  0x08425c8f in nsPRUint32Key::Clone ()
#10 0x08425bae in nsPRUint32Key::Clone ()
#11 0x0842a1d2 in nsPRUint32Key::Clone ()
#12 0x0842ebbe in nsPRUint32Key::Clone ()
#13 0x08425c8f in nsPRUint32Key::Clone ()
#14 0x08425bae in nsPRUint32Key::Clone ()
#15 0x0842a1d2 in nsPRUint32Key::Clone ()
#16 0x0842ebbe in nsPRUint32Key::Clone ()
#17 0x08425c8f in nsPRUint32Key::Clone ()
#18 0x0841ffc5 in nsPRUint32Key::Clone ()
#19 0x0842a1d2 in nsPRUint32Key::Clone ()
#20 0x0841fd45 in nsPRUint32Key::Clone ()
#21 0x08425c8f in nsPRUint32Key::Clone ()
#22 0x08425bae in nsPRUint32Key::Clone ()
#23 0x0825f674 in nsReadingIterator<unsigned short>::advance ()
#24 0x08425c8f in nsPRUint32Key::Clone ()
#25 0x08425bae in nsPRUint32Key::Clone ()
#26 0x082746b1 in nsReadingIterator<unsigned short>::advance ()
#27 0x082768f9 in nsReadingIterator<unsigned short>::advance ()
#28 0x082767af in nsReadingIterator<unsigned short>::advance ()
#29 0x08425c8f in nsPRUint32Key::Clone ()
#30 0x08425bae in nsPRUint32Key::Clone ()
#31 0x08263ed0 in nsReadingIterator<unsigned short>::advance ()
#32 0x08263fac in nsReadingIterator<unsigned short>::advance ()
#33 0x08425c8f in nsPRUint32Key::Clone ()
#34 0x08270099 in nsReadingIterator<unsigned short>::advance ()
#35 0x08425c8f in nsPRUint32Key::Clone ()
#36 0x0841ffc5 in nsPRUint32Key::Clone ()
#37 0x0842a1d2 in nsPRUint32Key::Clone ()
#38 0x0841fd45 in nsPRUint32Key::Clone ()
#39 0x08425c8f in nsPRUint32Key::Clone ()
#40 0x0841ffc5 in nsPRUint32Key::Clone ()
#41 0x0842a1d2 in nsPRUint32Key::Clone ()
#42 0x0841fd45 in nsPRUint32Key::Clone ()
#43 0x08425c8f in nsPRUint32Key::Clone ()
#44 0x08425bae in nsPRUint32Key::Clone ()
#45 0x0842a164 in nsPRUint32Key::Clone ()
#46 0x0842ad1e in nsPRUint32Key::Clone ()
#47 0x0823974e in nsReadingIterator<unsigned short>::advance ()
#48 0x083a09d2 in nsPRUint32Key::Clone ()
#49 0x083a50a2 in nsPRUint32Key::Clone ()
#50 0x083a4aca in nsPRUint32Key::Clone ()
#51 0x083a39e6 in nsPRUint32Key::Clone ()
#52 0x083a5b36 in nsPRUint32Key::Clone ()
#53 0x083a03a6 in nsPRUint32Key::Clone ()
#54 0x0821c85d in nsReadingIterator<unsigned short>::advance ()
#55 0x082167de in nsReadingIterator<unsigned short>::advance ()
#56 0x0821a284 in nsReadingIterator<unsigned short>::advance ()
#57 0x402a3034 in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#58 0x4057774b in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#59 0x4058ea70 in signal_emit_unlocked_R () from /usr/lib/libgobject-2.0.so.0
#60 0xbfffe954 in ?? ()
#61 0x00000002 in ?? ()
#62 0xbfffeaa4 in ?? ()
#63 0xbfffe97c in ?? ()
#64 0xbfffe7cc in ?? ()
#65 0x00000000 in ?? ()
#66 0x00000000 in ?? ()
#67 0x00000000 in ?? ()
#68 0x00000000 in ?? ()
#69 0xbfffe808 in ?? ()
#70 0xbfffe92c in ?? ()
#71 0xbfffe97c in ?? ()
#72 0xbfffe934 in ?? ()
#73 0xbfffe924 in ?? ()
#74 0xbfffe97c in ?? ()
#75 0xbfffe974 in ?? ()
#76 0xbfffe954 in ?? ()
#77 0x08cde158 in ?? ()
#78 0xbfffe900 in ?? ()
#79 0x08b98550 in ?? ()
#80 0x00000cd7 in ?? ()
#81 0x08cde158 in ?? ()
#82 0x08cde12c in ?? ()
#83 0xbfffe900 in ?? ()
#84 0xbfffe850 in ?? ()
#85 0x0828498f in nsReadingIterator<unsigned short>::advance ()

Can someone produce a minimal testcase?
Depends on: 250061
Keywords: qawanted
Assignee: nobody → blizzard
Status: UNCONFIRMED → NEW
Component: Layout → GFX: Gtk
Ever confirmed: true
QA Contact: core.layout → ian
Does this bug still occur in a recent trunk build?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/
Whiteboard: CLOSEME 07/01
The link in the URL field is no longer valid. Closing this bug as INCOMPLETE due to lack of information. Please file a new bug if you can reproduce something similar.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → INCOMPLETE
Product: Core → Core Graveyard
Crash Signature: [@ nsTextFrame::TextStyle::TextStyle() ]
You need to log in before you can comment on or make changes to this bug.