Closed Bug 291352 Opened 19 years ago Closed 17 years ago

crash when encounters javascript include on this page [@ GetNearestContainingBlock]

Categories

(Core :: Layout: Block and Inline, defect)

1.7 Branch
x86
Windows 98
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: boyd, Unassigned)

References

()

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

http://www.idg.co.nz/idgnet.nsf crashes browser when the javascript:

<script language="javascript" type="text/javascript"
src="http://acvsrv.mediaonenetwork.net/client/acv211.js"></script>

 is encountered

Reproducible: Always

Steps to Reproduce:
1. load http://www.idg.co.nz/idgnet.nsf in the browser


Actual Results:  
FIREFOX caused an invalid page fault in
module FIREFOX.EXE at 017f:0067b7b2.

Expected Results:  
Not crash

TB5238308E

FIREFOX caused an invalid page fault in
module FIREFOX.EXE at 017f:0067b7b2.
Registers:
EAX=00000000 CS=017f EIP=0067b7b2 EFLGS=00010202
EBX=00c9e1ac SS=0187 ESP=00c9e04c EBP=00c9e068
ECX=00c9e0b4 DS=0187 ESI=00c9e1ac FS=1c1f
EDX=00c9e0b4 ES=0187 EDI=02594260 GS=0000
Bytes at CS:EIP:
8b 78 1c eb 1d 8b 07 8b cf ff 90 cc 00 00 00 3b 
Stack dump:
02594260 00c9e1ac 02587b74 035d4aa8 00000000 00586327 035d4aa8 00c9e0bc 0067b299
00000000 00c9e084 0000002d 40000000 00c9e1ac 00000000 00000000
WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) Gecko/20050414
Firefox/1.0.3
WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050421
Firefox/1.0+
Reporter, did you submit any talkback information? If so, please run /Mozilla
Firefox/Components/talkback.exe and post your talkback IDs. Thanks!
Er, perhaps I should have read your msg properly first :)
TBID TB5238308E
Crash in GetNearestContainingBlock
Reporter, can you try with the latest nightly (1.1beta) firefox from
http://ftp.uni-erlangen.de/pub/mozilla.org/firefox/nightly/latest-trunk/
Thanks!
Keywords: crash
(In reply to comment #2)

> Reporter, can you try with the latest nightly (1.1beta) firefox from
> http://ftp.uni-erlangen.de/pub/mozilla.org/firefox/nightly/latest-trunk/

Tried, that version just hangs windows "XPCOM:EventReciver"

i have stoped this bug by blocking the js url with addblocker
Incident ID: 5238308
Stack Signature	GetNearestContainingBlock dc7af7b0
Product ID	Firefox10
Build ID	2005041417
Trigger Time	2005-04-20 14:58:39.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	FIREFOX.EXE + (0027b7b2)
URL visited	http://www.idg.co.nz/idgnet.nsf
User Comments	
Since Last Crash	779 sec
Total Uptime	779 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 563
Stack Trace 	
GetNearestContainingBlock 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 563]
nsHTMLReflowState::InitAbsoluteConstraints 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 947]
nsHTMLReflowState::InitConstraints 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 1846]
nsHTMLReflowState::Init 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 336]
nsHTMLReflowState::nsHTMLReflowState 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsHTMLReflowState.cpp,
line 309]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsAbsoluteContainingBlock.cpp,
line 424]
nsAbsoluteContainingBlock::IncrementalReflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsAbsoluteContainingBlock.cpp,
line 287]
nsBlockFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 638]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
CanvasFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsHTMLFrame.cpp,
line 554]
nsBoxToBlockAdaptor::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp,
line 884]
nsBoxToBlockAdaptor::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp,
line 626]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 249]
IncrementalReflow::Dispatch 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 904]
PresShell::ProcessReflowCommands 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6401]
PresShell::FlushPendingNotifications 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5114]
nsDocument::FlushPendingNotifications 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3975]
nsHTMLDocument::FlushPendingNotifications 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1357]
nsHTMLDocument::Close 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 2262]
XPTC_InvokeByIndex 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2034]
XPC_WN_CallMethod 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1781]
js_Invoke 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 949]
js_Interpret 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 2993]
js_Execute 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c,
line 1170]
JS_EvaluateUCScriptForPrincipals 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/js/src/jsapi.c,
line 3649]
nsJSContext::EvaluateString 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 946]
nsScriptLoader::EvaluateScript 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 668]
nsScriptLoader::ProcessRequest 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 581]
nsScriptLoader::OnStreamComplete 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 905]
nsStreamLoader::OnStopRequest 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsStreamLoader.cpp,
line 144]
nsStreamListenerTee::OnStopRequest 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsStreamListenerTee.cpp,
line 65]
nsInputStreamPump::OnStateStop 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 499]
Summary: crash when encounters javscript include on this page → crash when encounters javascript include on this page [@ GetNearestContainingBlock]
Assignee: firefox → nobody
Component: General → Layout
Product: Firefox → Core
QA Contact: general → layout
Version: unspecified → 1.7 Branch
Component: Layout → Layout: Block and Inline
QA Contact: layout → layout.block-and-inline
This worksforme also with a 1.0.3 Firefox build and with current trunk builds...
Is this a problem in a trunk build?  Say the Deer Park preview?
This was not a topcrasher with 1.0.3 and has gone away on the Trunk as
well...but is the #5 topcrash for Firefox 1.0.4 (see bug 194952)

*** This bug has been marked as a duplicate of 194952 ***
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Reopening.  Jay, similar (or even same, sometimes) stack doesn't mean it's the
same bug.  The stack here isn't even similar to that in bug 194952 except the
last few frames...
Status: RESOLVED → UNCONFIRMED
Resolution: DUPLICATE → ---
Blocks: 308765
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago17 years ago
Resolution: --- → WORKSFORME
adding a comment of Boyd's "it was win98 years ago. haven't seen it happen since"
Crash Signature: [@ GetNearestContainingBlock]
You need to log in before you can comment on or make changes to this bug.