272077 - Crash or Hang-up on MozillaZine-JT

Status: RESOLVED DUPLICATE of bug 268119

(Core :: Layout, defect)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

The newer than 2004-10-08 builds crash or hang-up on MozillaZine-JT.
But it is reproduced sometime(e.g., reload or click the link of "mozillazine").

The crash reports are:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2067865H
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2067936G
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2207743H
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2207709K

Bonsai:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=MozillaTinderboxAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-10-07&maxdate=2004-10-08+08%3A00%3A00&cvsroot=%2Fcvsroot

Comment 1

[Mats Palmgren (inactive)]

Attachment: Stack

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Umm... I found bug 266360 before this report.
But bug 266360 is reproduced on older than 2004-10-07 builds.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

This is regression of bug 251162.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

ASSERTION before crash on 2004-10-08 06:00:00 PDT build.

###!!! ASSERTION: frame not in line: 'line->Contains(aDeletedFrame)', file
m:/mozilla-w/src/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5012
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file
m:/mozilla-w/src/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5146
###!!! ASSERTION: bad prevSibling: '!prevSibling ||
prevSibling->GetNextSibling() == aDeletedFrame', file
m:/mozilla-w/src/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5008

Comment 5

[Martijn Wargers (dead)]

I did a bit of testing. The site has a rule with :first-letter.
.itemText:first-letter {font-size: 133%; font-weight: bold;}
Putting <script>var x=document.body.offsetHeight;</script> at the end of a div
with class="itemText" makes it hang. Removing the :first-letter rule and it
works again.
So I think this is probably the same bug as bug 268119.

Comment 6

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Martijn Wargers:

Yes. I tested 2004-10-08 05:00:00 PDT build and 2004-10-08 06:00:00 PDT build on
attachment 268119 [details] [diff] [review].

*** This bug has been marked as a duplicate of 268119 ***