276053 - Closeing a tab with http://linuxblog.sytes.net loaded in it causes Firefox to crash [@ nsView::GetDimensions]

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Eric Marsch]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041226 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041226 Firefox/1.0+

If you load http://linuxblog.sytes.net in a tab and close the tab it will crash
Firefox

Reproducible: Always

Steps to Reproduce:
1.Go to http://linuxblog.sytes.net
2.Wait for page to load
3.Close tab

Actual Results:  
Firefox crashs

Expected Results:  
Closed the tab and keep running

32-bit Windows exception
Im not sure where to find the module that crashed
Its the most recent nightly build

Comment 1

[Phil Ringnalda (:philor)]

*** Bug 276054 has been marked as a duplicate of this bug. ***

Comment 2

[Chris Blore]

Confirmed under Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6)
Gecko/20041226 Firefox/1.0+. This appears to be a regression since 20041224
because there was no crash under this build but after installation of 20041226,
the crash begins to occur. 

Comment 3

[Martijn Wargers (dead)]

Confirmed, using 20041227 windows trunk build.
Talkback ID: TB2775350Y

nsView::GetDimensions 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.h, line 252]
nsViewManager::UpdateWidgetArea 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1705]
nsViewManager::UpdateView 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1821]
nsViewManager::UpdateView 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1646]
nsViewManager::RemoveChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2661]
nsSplittableFrame::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsSplittableFrame.cpp,
line 71]
CanvasFrame::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLFrame.cpp,
line 238]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrameList.cpp,
line 129]
nsBoxFrame::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1113]
nsPositionedInlineFrame::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsInlineFrame.cpp,
line 1107]
DocumentViewerImpl::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsDocumentViewer.cpp,
line 1203]
nsDocShell::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 3183]
nsWebShell::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/docshell/base/nsWebShell.cpp,
line 1148]
nsGenericHTMLFrameElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 3579]
nsGenericElement::SetDocumentInChildrenOf 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1721]
nsGenericHTMLElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1330]
nsGenericHTMLElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1330]
nsGenericHTMLElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1330]
nsGenericHTMLElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1330]
nsGenericHTMLElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1330]
nsGenericHTMLElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1330]
nsGenericHTMLElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1330]
nsGenericHTMLElement::SetDocument 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1330]
DocumentViewerImpl::Close 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsDocumentViewer.cpp,
line 1119]
nsDocShell::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 3182]
nsWebShell::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/docshell/base/nsWebShell.cpp,
line 1148]
nsSubDocumentFrame::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrameFrame.cpp,
line 571]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrameList.cpp,
line 129]
nsBoxFrame::Destroy 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1113]
nsFrameManager::RemoveFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsFrameManager.cpp,
line 740]
nsCSSFrameConstructor::ContentRemoved 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9755]
PresShell::ContentRemoved 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5122]
nsGenericElement::doRemoveChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 3134]
nsXULElement::RemoveChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 855]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2034]
XPC_WN_CallMethod 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1286]
js_Interpret 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3557]
js_Invoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1306]
js_InternalInvoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1383]
JS_CallFunctionValue 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 3772]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1352]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1519]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1596]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2819]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2838]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2838]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5916]
PresShell::HandleEventWithTarget 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5834]
nsEventStateManager::CheckForAndDispatchClick 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2941]
nsEventStateManager::PostHandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1934]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5968]
PresShell::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5772]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2404]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2129]
HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1102]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5387]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5638]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x27b17 (0x77d37b17)
USER32.dll + 0x2cdce (0x77d3cdce)
USER32.dll + 0x4435 (0x77d14435)

Comment 4

[Martijn Wargers (dead)]

For me, I don't get a crash, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041226
Firefox/1.0+ 7:41am
But I get a crash, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041227
Firefox/1.0+ 8:54am

I don't get a crash, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041227-05

Bonsai link:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-12-26+07%3A00%3A00&maxdate=2004-12-27+09%3A00%3A00&cvsroot=%2Fcvsroot

That makes me think the fix for bug 276092 is to blame.

Comment 5

[Martijn Wargers (dead)]

Sorry, forget about comment 4. It doesn't seem to crash always, hence the wrong
observation in comment 4.
It hasn't crashed for me once in:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041224
Firefox/1.0+ 0:32 (which is the 2004-12-25 build, in fact)
But it crashed for me, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041226
Firefox/1.0+ 7:41am

I haven't been able to crash it with the latest Mozilla trunk nightly
(2004-12-27) build.

Comment 6

[Martijn Wargers (dead)]

Attachment: Testcase

Sorry, for the above spam. Ignore comment 4 and comment 5.
This is a minimal testcase from that site, it uses Hyatt's hack to trigger the
bug.

Regression range for green iframe rendering/not rendering:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041026
Firefox/0.9.1+ 6:32am
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041027
Firefox/0.9.1+ 6:57am
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-10-26+05%3A00%3A00&maxdate=2004-10-27+07%3A00%3A00&cvsroot=%2Fcvsroot


Regression range for not crashing/crashing on closing:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041029
Firefox/0.9.1+ 6:22am
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041030
Firefox/0.9.1+ 7:18am
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-10-29+06%3A00%3A00&maxdate=2004-10-30+08%3A00%3A00&cvsroot=%2Fcvsroot

Comment 7

[Martijn Wargers (dead)]

Attachment: backtrace

Backtrace of crash from debug build.
Before I crash, I get an assertion:
###!!! ASSERTION: Unexpected root view: 'rootView ==
origView->GetViewManager()-
>RootViewManager()->GetRootView()', file
c:/mozilla/mozilla/view/src/nsViewManag
er.cpp, line 3972
Break: at file c:/mozilla/mozilla/view/src/nsViewManager.cpp, line 3972

this assertion was added with the fix for bug 244290. That fix was checked in
at 2004-10-29, so that might be responsible for the crash.

Comment 8

[Martijn Wargers (dead)]

Ok, I've built a debug build of Mozilla from the 2004-10-26 source.
->Neither of the two bugs mentioned in comment 6 are showing up.

After that, I've applied the patch from bug 263406 and rebuilt
->The first bug is showing up (green iframe not rendering). Also I get this
assertion, when closing the tab:
###!!! ASSERTION: no document: 'mDocument != nsnull', file c:/mozilla/mozilla/co
ntent/xul/content/src/nsXULElement.cpp, line 3223
But Mozilla is not crashing.

After that, I've applied the patch from bug 244290 and rebuilt
->After that Mozilla is also crashing when closing the tab.

Comment 9

[Boris Zbarsky [:bzbarsky]]

The non-rendering problem is bug 271422.  The crash is a consequence of the
frames getting lost, so fixing bug 271422 should fix it (it's not there in a
debug build with that patch).

Martijn, thanks for hunting down the problem here!

Comment 10

[Boris Zbarsky [:bzbarsky]]

Fixed by bug 271422 checkin.

Comment 11

[Bob Clary [:bc] (inactive)]

layout/base/crashtests/276053-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3