270719 - Crash in [@ nsCSSFrameConstructor::WrapFramesInFirstLetterFrame]

Status: VERIFIED DUPLICATE of bug 268119

(Core :: Layout, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: 2004-11-18-05, Windows XP, Seamonkey trunk.

Summary: Crash in [@ nsCSSFrameConstructor::WrapFramesInFirstLetterFrame]

Steps to Reproduce:

1.	Load http://fosisoft.home.ro/
2.	Click on the FAQ button: http://fosisoft.home.ro/faq.html

Crash here:

0x000020d0
nsCSSFrameConstructor::WrapFramesInFirstLetterFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 12345]
nsCSSFrameConstructor::RecoverLetterFrames 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 12605]
nsCSSFrameConstructor::ContentRemoved 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9783]
nsCSSFrameConstructor::ReinsertContent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9302]
nsCSSFrameConstructor::CharacterDataChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 10050]
PresShell::CharacterDataChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5070]
nsDocument::CharacterDataChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 2035]
nsGenericDOMDataNode::AppendData 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericDOMDataNode.cpp,
line 425]
nsTextNode::AppendData 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsTextNode.cpp]
SinkContext::FlushText 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 1855]
SinkContext::CloseContainer 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 1329]
HTMLContentSink::CloseContainer 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 3052]
CNavDTD::CloseContainer 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 3536]
CNavDTD::CloseContainersTo 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 3568]
CNavDTD::CloseContainersTo 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 3754]
CNavDTD::HandleEndToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 2089]
CNavDTD::HandleToken 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 1011]
CNavDTD::BuildModel 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 481]
nsParser::BuildModel 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp,
line 2032]
nsParser::ResumeParse 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp,
line 1896]
nsParser::OnDataAvailable 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/parser/htmlparser/src/nsParser.cpp,
line 2577]
0x01d8b268
necko.dll + 0x5df7c (0x6090df7c)
nsHttpChannel::AddRef 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 2784]
0x8b5610ec

Comment 1

[Mats Palmgren (inactive)]

I added a printf for the "next-in-flow on same line" condition (see bug 268119)
and it appeared just before the crash... I then applied the fix in bug 268119
and could not reproduce the crash anymore...

*** This bug has been marked as a duplicate of 268119 ***

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

verified dup