265947 - Mangler crash [@ nsCSSFrameConstructor::GetFloatContainingBlock]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Daniel Veditz [:dveditz]]

Michal Zalewski sends in another crashing test case. Unfortunately needs to be
trimmed a lot to find the real cause. Crashes 10/15 nightly right away, my
curent trunk debug build limps along for a bit (not quite right) then crashes later.

Not sure if the difference is optimized vs. debug, or if one of the earlier
mangler fixes got rid of the immediate crash that was masking a deeper flaw. A
few talkback stacks mention the test case "mozilla_die3" crashing with different
stacks. Here's my nightly crash stack (incident 1508445):

0x00000000
nsCSSFrameConstructor::GetFloatContainingBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 7554]
nsCSSFrameConstructor::ContentAppended 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 8296]
PresShell::EndReflowBatching 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5022]
nsDocument::GetDoctype 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 2210]
nsHTMLDocument::GetElementsByTagName 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1399]
HTMLContentSink::ProcessSTYLETag 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 4352]
HTMLContentSink::Init 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 2062]
HTMLContentSink::NotifyAppend 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 4034]
HTMLContentSink::AddDocTypeDecl 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 3368]
CNavDTD::AddHeadLeaf 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 3812]
CNavDTD::HandleStartToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 1808]
CNavDTD::HandleToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 961]
CNavDTD::BuildModel 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 468]
nsParser::DetectMetaTag 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp,
line 2213]
nsParser::ResumeParse 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp,
line 1855]
nsParser::Tokenize 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp,
line 2568]
nsDocumentOpenInfo::OnStopRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 360]

Comment 1

[Daniel Veditz [:dveditz]]

Attachment: another Zalewski crash

Comment 2

[Daniel Veditz [:dveditz]]

Doesn't seem to affect a 10/24 Firefox 1.0 build.

Comment 3

[Jacek Piskozub]

WFM with fresh (20041024) Mozilla trunk and 1.7.x builds on Windows ME.

Marking WORKSFORME per my observations and comment 2.

Comment 4

[Daniel Veditz [:dveditz]]

I concur: I updated from cvs and the trunk problems went away here too.