270221 - Crash when closing tab/window while stuck spinning, possible in Java plugin [@ nsAbsoluteContainingBlock::`vftable']

Status: RESOLVED WORKSFORME

(Core :: Layout: Block and Inline, defect)

Description

[Magnus Ihse Bursie]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

When clicking on some menu items, a thread in the Firefox process starts using
99% CPU. My guess is that it's stuck somewhere in the Java plugin. What's worse,
if you try to close the tab or the complete Firefox process, it will crash.


Reproducible: Always
Steps to Reproduce:
1. Go to http://www.pgw.se/shop/index.html
2. Click on "Öltillbehör" in the menu to the left
3. In the menu that expands, click "Malt". Notice that CPU goes to 99% and page
gets stuck.
4. Now close the tab, and watch Firefox crash.
Actual Results:  
Firefox crashes.

Expected Results:  
Preferably, to load and display the page correctly after step 3. :-) At least,
not crash when I close it.


I believe the problem is due to the Java plugin, somehow. When the process was
spinning, after step 3 above, I attached with a debugger and got the following
stack trace (only first part posted here)
 	jvm.dll!08071133() 	
 	jvm.dll!080ac134() 	
 	msctf.dll!74730e6c() 	
 	jvm.dll!08071119() 	
 	jvm.dll!08074a35() 	
 	user32.dll!77d48709() 	
 	user32.dll!77d49655() 	
 	user32.dll!77d4969a() 	
 	user32.dll!77d49669() 	
 	jvm.dll!0807598c() 	
 	ntdll.dll!7c90ea53() 	
 	jpinsp.dll!6d385c15() 	
 	jpinsp.dll!6d3866ad() 	
 	jpinsp.dll!6d381bb2() 	
 	jpins7.dll!6d371599() 	
 	firefox.exe!0053c5fc() 	
 	firefox.exe!0053c26f() 	
 	firefox.exe!00647c19() 	
 	firefox.exe!00646619() 	

However, the same page renders without problem in Internet Explorer, with the
same JVM.

I am using a Sun JVM, which identifies itself as "Version 1.4.2_05 (build
1.4.2_05-b04)". This is the same JVM which is used in MSIE, where the same page
works.

Comment 1

[timeless]

when it crashes, do you get a talkback dialog? if so, please run
components\talkback.exe and copy the incident id here.

Comment 2

[Magnus Ihse Bursie]

Yes, I get a talkback. I sent in a new incident right now, it has ID TB2004518K.
However, I also simultaneously get a "FIREFOX.EXE has encountered a problem an
needs to close" dialog. Don't know if that affects the dump talkback sends to you...

Comment 3

[Hermann Schwab]

TB2004518K Stack Signature: nsAbsoluteContainingBlock::`vftable' 6f1e46ad
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2004518K

11 bugs with identical signature, 2 different URLs:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsAbsoluteContainingBlock%3A%3A%60vftable%27+6f1e46ad&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
oldest: MozillaOrgFirefox10Win322004102711

407 crashes found where the Stack Signature contains
'nsabsolutecontainingblock::`vftable''

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsAbsoluteContainingBlock%3A%3A%60vftable%27+&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=build
oldest: MozillaOrgFirefox10Win322004091322  	


All talkbacks were showing Firefox only, no Mozilla found.

Comment 4

[timeless]

nsAbsoluteContainingBlock::`vftable'
nsBlockFrame::ReflowInlineFrame 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3748]
nsBlockFrame::DoReflowInlineFrames 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3446]
nsBlockFrame::DoReflowInlineFramesAuto 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3347]
nsBlockFrame::ReflowInlineFrames 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3292]
nsBlockFrame::ReflowLine 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2456]
nsBlockFrame::ReflowDirtyLines 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2098]
nsBlockFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 817]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableCellFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 890]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableRowFrame::ReflowChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 965]
nsTableRowFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 1409]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableRowGroupFrame::ReflowChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 429]
nsTableRowGroupFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 1290]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableFrame::ReflowChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 3246]
nsTableFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1937]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableOuterFrame::OuterReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 1335]
nsTableOuterFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 2000]
nsBlockReflowContext::ReflowBlock 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3068]
nsBlockFrame::ReflowLine 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2334]
nsBlockFrame::ReflowDirtyLines 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2098]
nsBlockFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 817]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableCellFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 890]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableRowFrame::ReflowChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 965]
nsTableRowFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 1409]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableRowGroupFrame::ReflowChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 429]
nsTableRowGroupFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 1290]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableFrame::ReflowChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 3246]
nsTableFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1937]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableOuterFrame::OuterReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 1335]
nsTableOuterFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 2000]
nsBlockReflowContext::ReflowBlock 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3068]
nsBlockFrame::ReflowLine 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2334]
nsBlockFrame::ReflowDirtyLines 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2098]
nsBlockFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 817]
nsBlockReflowContext::ReflowBlock 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3068]
nsBlockFrame::ReflowLine 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2334]
nsBlockFrame::ReflowDirtyLines 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2098]
nsBlockFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 817]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
CanvasFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsHTMLFrame.cpp,
line 554]
nsBoxToBlockAdaptor::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp,
line 884]
nsBoxToBlockAdaptor::DoLayout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp,
line 626]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsGfxScrollFrameInner::LayoutBox 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1264]
nsGfxScrollFrame::DoLayout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1273]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsGfxScrollFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 873]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 249]
IncrementalReflow::Dispatch 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 904]

looks like infinite recursion, but maybe not. also note bug 269075

Comment 5

[Bernd]

wfm with current trunk

Comment 6

[Magnus Ihse Bursie]

Confirmed. I downloaded the nightly build "2004-11-17-07-trunk", and it works
for me too. As far as I'm concerned, this bug could be closed.

However, a side issue: I checked the list of the 407 crashes posted by Hermann
Schwab, and since several descriptions matched my experience: "java applet stuck
spinning, then crashes", I though I should follow some of the entered links to
see if there was any problem for me on those links too. It was at most of those
I tested. And none of those that crashed with Firefox 1.0 crashed with the
nightly build.

However, one of them -- http://www.hifx.com/index.asp -- still had some problem
with the nightly build. When loading the applet, the Firefox process still
started spinning, stealing all CPU, and I could not navigate in the page. It
didn't crash, though, but I had to quit since I could do no more navigation in
that Firefox process.

I guess it should be filed as a separate bug, unless it's an already known issue.

Comment 7

[Hermann Schwab]

(In reply to comment #6)
> Confirmed. I downloaded the nightly build "2004-11-17-07-trunk", and it works
> for me too. As far as I'm concerned, this bug could be closed.

I´ve just been looking at the nightlies, 2004-11-17-07-trunk is Firefox.

> However, a side issue: I checked the list of the 407 crashes posted by Hermann
> Schwab, and since several descriptions matched my experience: "java applet stuck
> spinning, then crashes", I though I should follow some of the entered links to
> see if there was any problem for me on those links too. It was at most of those
> I tested. And none of those that crashed with Firefox 1.0 crashed with the
> nightly build.
> 
> However, one of them -- http://www.hifx.com/index.asp -- still had some problem
> with the nightly build. When loading the applet, the Firefox process still
> started spinning, stealing all CPU, and I could not navigate in the page. It
> didn't crash, though, but I had to quit since I could do no more navigation in
> that Firefox process.
> 
> I guess it should be filed as a separate bug, unless it's an already known issue.

This URL seems to be different, as in the 400+ long lists of Talkbacks of this
bugs Stack Signature there was only Firefox mentioned, no Mozilla 1.7, no
Mozilla 1.8.

I tested http://www.hifx.com/index.asp using Mozilla/5.0 (Windows; U; Win98;
en-US; rv:1.8a5) Gecko/20041117 with Java 1.5 and Java Console open, trace level
set to 5.

The website was showing a very small table of stockprices, and mothing else, 95%
of the page unused or not rendered. The status line load progress indicator
seemed to be nearly full, maybe 98%.

The Java Console was showing Liveconnect, maybe 10 Lines/second for maybe a
minute or two, and then slowing down to about 2 lines/second.
I could change from the page to Java Console, and vice versa, change was slow,
but responded. I couldn´t open the edit menu to look for preferences, was to
slow. Then I closed the page using the x from the tabbar.
JAVA console was still showing traffic. I used the clear button to clear the
content, and Java console immediately filled again. Repeated clear, same result.
Pressing button once again Mozilla crashed.
 
TB2039067E  JPINSCP.DLL + 0x2a96 (0x6d422a96) da2fb27a

I will file a separate bug if I get more info.

Comment 8

[Hermann Schwab]

closing as wfm according to reporters comment #6

filed a new bug for remaining issue in comment 6 and comment 7

Bug 270834 Crash after closing www.hifx.com or Java console in or loading again
after close.