265999 - Crash Mozilla Trunk [@ nsLineBox::IsEmpty ] and Firefox Aviary [@ nsLineIterator::FindLineContaining ]

Status: RESOLVED WORKSFORME

(Core :: Layout: Block and Inline, defect)

Description

[Robert Strong (they/them - no direct email)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041025 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041025 Firefox/1.0

The soon to be attached simplified testcase causes a crash @ nsLineBox::IsEmpty
for Mozilla Trunk TB1514330Y and nsLineIterator::FindLineContaining for Firefox
Aviary Branch TB1514369W

Reproducible: Always
Steps to Reproduce:
1. Open testcase
2.
3.

Actual Results:  
Crash or hang

Expected Results:  
No crash or hang

UA's affected:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041024 Firefox/1.0
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1514369W
Stack Signature	 nsLineIterator::FindLineContaining 40e93507
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineBox.cpp,
line 607

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041023
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1514330Y
Stack Signature	 nsLineBox::IsEmpty df8ce4db
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineBox.cpp,
line 285 

There may be a relation to bug 263825 though this does not require a refresh

Comment 1

[Robert Strong (they/them - no direct email)]

Attachment: Testcase (causes crash)

Comment 2

[Robert Strong (they/them - no direct email)]

Adding keywords crash and testcase

Comment 3

[Mitch]

Works for me. Robert please try a newwer nightly build (1.8a5) first before
logging bugs as your issues (all that you've logged today) may be already fixed.
I couldn't reproduce any one of your testcases with a recent build.

Comment 4

[Robert Strong (they/them - no direct email)]

I uninstalled Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5)
Gecko/20041023, deleted the program files / profile directories, installed
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041025, and it
still crashed for me. Also, all of the crashes I reported today happened with
rv:1.8a5 though it was with a 2 day old build. Could you also try verifying any
of the following bugs I reported yesterday that have already been confirmed?
This may  be telling whether it is OS specific or something else. I used the
same methodology for creating the html that caused the crashes I reported today
and all of these have been confirmed.
bug 265867
bug 265899
bug 265902

Comment 5

[Robert Strong (they/them - no direct email)]

Talkback report for this testcase after my previous comment
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1516430M

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Confirming with build 2004-10-25 on Windows XP; hangs for a couple of seconds
and then crashes.

Comment 7

[Boris Zbarsky [:bzbarsky]]

This worksforme with a current (pulled on 2004-10-24) Linux trunk build...  I
get some asserts, no crash.

Comment 8

[Daniel Veditz [:dveditz] (OOO: back Aug 26)]

This crashes me on Winxp with trunk Mozilla source from 2004102511. Crashing
with a null kid as in bug 265973 but at nsLineBox::IsEmpty() as mentioned in
comment 0

crash is here:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsLineBox.cpp&rev=1.79#285

Comment 9

[Robert Strong (they/them - no direct email)]

Attachment: Assertions before crash

Comment 10

[Bernd]

wfm winxp 2004111204

Comment 11

[Robert Strong (they/them - no direct email)]

Testcase still crashes for me using winxp pro sp2 and 20041112
The latest talkback is TB1914695E but it hasn't been processed on the server as
of this post. I suspect that talkback may be down though it is receiving the
reports since my last two have not shown up over the last couple of hours.

Comment 12

[timeless]

can we wallpaper over this in the interim? the testcase crashes my debug build,
i'll gladly allow someone to drag me through it this week.

Comment 13

[Martijn Wargers (dead)]

Can it be that this is fixed?
It doesn't crash for me in 20050323 trunk build, but it crashes for me in
20050318 build. I think that the fix for bug 263825 could have fixed this.

Comment 14

[Robert Strong (they/them - no direct email)]

It would appear that the checkin for bug 263825 has fixed this.

Comment 15

[Bob Clary [:bc] (inactive)]

layout/base/crashtests/265999-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3