Closed Bug 276159 Opened 20 years ago Closed 20 years ago

crash with image inside map

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
1.7 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED DUPLICATE of bug 266015

People

(Reporter: taviso, Unassigned)

Details

(Keywords: crash)

Attachments

(1 file)

testcase
64 bytes, text/html
Details 
User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041123 Firefox/1.0
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041123 Firefox/1.0

testcase attached, as small as I can make it and still reliably reproduce.

Reproducible: Always
Attached file testcase — 
the src doesnt seem to be important for me, I can set it to file:///dev/null or
anything else and still dump core, but a windows using friend tells me that
that doesnt work for him, the javascript: thing works for both of us.
Incident ID: 2778585
Stack Signature	nsHTMLReflowState::Init() 14985633
Product ID	Firefox10
Build ID	2004110711
Trigger Time	2004-12-27 17:04:17.0
Platform	MacOSX
Operating System	Darwin 7.7.0
Module	firefox-bin + (003733a4)
URL visited	https://bugzilla.mozilla.org/attachment.cgi?id=169668
User Comments	https://bugzilla.mozilla.org/attachment.cgi?id=169668
Since Last Crash	1209 sec
Total Uptime	1209 sec
Trigger Reason	SIGBUS: Bus Error: (signal 10)
Source File, Line No.
/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 595
Stack Trace 	
nsHTMLReflowState::Init() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 595]
nsHTMLReflowState::nsHTMLReflowState() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 220]
nsTableCellFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableCellFrame.cpp,
line 863]
nsContainerFrame::ReflowChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableRowFrame::IR_TargetIsChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 53]
nsTableRowFrame::IncrementalReflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 91]
nsTableRowFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableRowFrame.cpp,
line 1400]
nsContainerFrame::ReflowChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableRowGroupFrame::IR_TargetIsChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 60]
nsTableRowGroupFrame::IncrementalReflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 91]
nsTableRowGroupFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp,
line 1281]
nsContainerFrame::ReflowChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableFrame::IR_TargetIsChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 60]
nsTableFrame::IncrementalReflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 91]
nsTableFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 1953]
nsContainerFrame::ReflowChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
nsTableOuterFrame::OuterReflowChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 1335]
nsTableOuterFrame::IR_InnerTableReflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 1695]
nsTableOuterFrame::IR_TargetIsChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 1439]
nsTableOuterFrame::IncrementalReflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 91]
nsTableOuterFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 1957]
nsBlockReflowContext::ReflowBlock() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 189]
nsBlockFrame::ReflowBlockFrame() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3071]
nsBlockFrame::ReflowLine() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 545]
nsBlockFrame::ReflowDirtyLines() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2098]
nsBlockFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 817]
nsBlockReflowContext::ReflowBlock() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockReflowContext.cpp,
line 189]
nsBlockFrame::ReflowBlockFrame() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3071]
nsBlockFrame::ReflowLine() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 545]
nsBlockFrame::ReflowDirtyLines() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 2098]
nsBlockFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 817]
nsContainerFrame::ReflowChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
CanvasFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsHTMLFrame.cpp,
line 554]
nsBoxToBlockAdaptor::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp,
line 884]
nsBoxToBlockAdaptor::DoLayout() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp,
line 628]
nsBox::Layout() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsScrollBoxFrame::DoLayout() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp,
line 337]
nsBox::Layout() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::LayoutChildAt() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 654]
nsGfxScrollFrameInner::Layout() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1424]
nsGfxScrollFrame::DoLayout() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 1273]
nsBox::Layout() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsBoxFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 868]
nsGfxScrollFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 873]
nsContainerFrame::ReflowChild() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 250]
IncrementalReflow::Dispatch() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 53]
PresShell::ProcessReflowCommands() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6397]
ReflowEvent::HandleEvent()
PL_HandleEvent() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 608]
_md_EventReceiverProc() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 1578]
HIToolbox.145.0.0 + 0x1fa0 (0x927d1fa0)
HIToolbox.145.0.0 + 0x2214 (0x927d2214)
HIToolbox.145.0.0 + 0x6694 (0x927d6694)
HIToolbox.145.0.0 + 0x12d2c (0x927e2d2c)
HIToolbox.145.0.0 + 0x205c (0x927d205c)
HIToolbox.145.0.0 + 0x2214 (0x927d2214)
HIToolbox.145.0.0 + 0x146bc (0x927e46bc)
HIToolbox.145.0.0 + 0x185d8 (0x927e85d8)
HIToolbox.145.0.0 + 0x28718 (0x927f8718)
HIToolbox.145.0.0 + 0x8d88 (0x927d8d88)
HIToolbox.145.0.0 + 0x8f3c (0x927d8f3c)
HIToolbox.145.0.0 + 0x1c9f0 (0x927ec9f0)
HIToolbox.145.0.0 + 0x2d708 (0x927fd708)
nsMacMessagePump::GetEvent() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsMacMessagePump.cpp,
line 407]
nsMacMessagePump::DoMessagePump() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsMacMessagePump.cpp,
line 312]
nsAppShell::Run() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/widget/src/mac/nsAppShell.cpp,
line 114]
xre_main() 
[/builds/tinderbox/firefox-1.0/Darwin_7.4.0_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 710]
_start()   start()
Severity: normal → critical
Keywords: crash
OS: Linux → All
Hardware: PC → All
Assignee: firefox → nobody
Component: General → Layout
Product: Firefox → Core
QA Contact: firefox.general → core.layout
Version: unspecified → 1.7 Branch

*** This bug has been marked as a duplicate of 266015 ***
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → DUPLICATE
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: