Crash Mozilla Trunk [@ nsLineBox::IsEmpty ] and Firefox Aviary [@ nsLineIterator::FindLineContaining ]

RESOLVED WORKSFORME

Status

()

defect
--
critical
RESOLVED WORKSFORME
15 years ago
5 years ago

People

(Reporter: rstrong, Unassigned)

Tracking

({crash, testcase})

Trunk
x86
Windows XP
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041025 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041025 Firefox/1.0

The soon to be attached simplified testcase causes a crash @ nsLineBox::IsEmpty
for Mozilla Trunk TB1514330Y and nsLineIterator::FindLineContaining for Firefox
Aviary Branch TB1514369W

Reproducible: Always
Steps to Reproduce:
1. Open testcase
2.
3.

Actual Results:  
Crash or hang

Expected Results:  
No crash or hang

UA's affected:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041024 Firefox/1.0
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1514369W
Stack Signature	 nsLineIterator::FindLineContaining 40e93507
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineBox.cpp,
line 607

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041023
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1514330Y
Stack Signature	 nsLineBox::IsEmpty df8ce4db
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsLineBox.cpp,
line 285 

There may be a relation to bug 263825 though this does not require a refresh
Adding keywords crash and testcase
Keywords: crash, testcase
Works for me. Robert please try a newwer nightly build (1.8a5) first before
logging bugs as your issues (all that you've logged today) may be already fixed.
I couldn't reproduce any one of your testcases with a recent build.
I uninstalled Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5)
Gecko/20041023, deleted the program files / profile directories, installed
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041025, and it
still crashed for me. Also, all of the crashes I reported today happened with
rv:1.8a5 though it was with a 2 day old build. Could you also try verifying any
of the following bugs I reported yesterday that have already been confirmed?
This may  be telling whether it is OS specific or something else. I used the
same methodology for creating the html that caused the crashes I reported today
and all of these have been confirmed.
bug 265867
bug 265899
bug 265902
Confirming with build 2004-10-25 on Windows XP; hangs for a couple of seconds
and then crashes.
Assignee: general → nobody
Status: UNCONFIRMED → NEW
Component: Browser-General → Layout: Block and Inline
Ever confirmed: true
QA Contact: general → core.layout.block-and-inline
This worksforme with a current (pulled on 2004-10-24) Linux trunk build...  I
get some asserts, no crash.
This crashes me on Winxp with trunk Mozilla source from 2004102511. Crashing
with a null kid as in bug 265973 but at nsLineBox::IsEmpty() as mentioned in
comment 0

crash is here:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/html/base/src/nsLineBox.cpp&rev=1.79#285
wfm winxp 2004111204
Testcase still crashes for me using winxp pro sp2 and 20041112
The latest talkback is TB1914695E but it hasn't been processed on the server as
of this post. I suspect that talkback may be down though it is receiving the
reports since my last two have not shown up over the last couple of hours.
can we wallpaper over this in the interim? the testcase crashes my debug build,
i'll gladly allow someone to drag me through it this week.
Can it be that this is fixed?
It doesn't crash for me in 20050323 trunk build, but it crashes for me in
20050318 build. I think that the fix for bug 263825 could have fixed this.
It would appear that the checkin for bug 263825 has fixed this.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
layout/base/crashtests/265999-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3
Flags: in-testsuite+
Crash Signature: [@ nsLineBox::IsEmpty ] [@ nsLineIterator::FindLineContaining ]
You need to log in before you can comment on or make changes to this bug.