294343 - crash when * { overflow:hidden; } is added to userContent.css [@ nsGfxScrollFrame::SetInitialChildList]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Michal 'hramrach' Suchanek]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Crash on startup

Reproducible: Always

Steps to Reproduce:
1. put a line saying "* { overflow:hidden; } into userChrome.css
2. restart firefox


Actual Results:  
crash on startup

Expected Results:  
enjoying weird looking web

Talkback IDs TB5872337E  TB5872338Y  TB5872598X

Comment 1

[Matthias Versen [:Matti]]

Do you also crash if you try it with a recent trunk build ?
The Gecko in FF1.0.X is over one year old...

Comment 2

[timeless]

Incident ID: 5872337
Stack Signature	nsGfxScrollFrame::SetInitialChildList() cca6d11d
Product ID	Firefox10
Build ID	2005051112
Trigger Time	2005-05-16 05:35:38.0
Platform	MacOSX
Operating System	Darwin 7.9.0
Module	firefox-bin + (004844e4)
URL visited	
User Comments	crash on start with * {overflow:hidden; } in userContent.css
Since Last Crash	2369 sec
Total Uptime	2369 sec
Trigger Reason	SIGBUS: Bus Error: (signal 10)
Source File, Line No.
/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 509
Stack Trace 	
nsGfxScrollFrame::SetInitialChildList() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 509]
nsGfxScrollFrame::SetInitialChildList() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 509]
nsCSSFrameConstructor::ConstructRootFrame() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 919]
PresShell::InitialReflow() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 88]
nsContentSink::StartLayout() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/content/base/src/nsContentSink.cpp,
line 158]
HTMLContentSink::StartLayout() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 3725]
HTMLContentSink::OpenBody() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 2836]
CNavDTD::OpenBody() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 3172]
CNavDTD::OpenContainer() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 3407]
CNavDTD::HandleDefaultStartToken() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 1457]
CNavDTD::HandleStartToken() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 1835]
CNavDTD::HandleToken() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 1019]
CNavDTD::BuildModel() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 517]
nsParser::BuildModel() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/nsParser.cpp,
line 704]
nsParser::ResumeParse() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/nsParser.cpp,
line 1868]
nsParser::OnDataAvailable() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/htmlparser/src/nsParser.cpp,
line 2551]
nsDocumentOpenInfo::OnDataAvailable() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/uriloader/base/nsURILoader.cpp,
line 710]
nsInputStreamChannel::OnDataAvailable() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/netwerk/base/src/nsInputStreamChannel.cpp,
line 710]
nsInputStreamPump::OnStateTransfer() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 436]
nsInputStreamPump::OnInputStreamReady() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 336]
nsInputStreamReadyEvent::EventHandler()
PL_HandleEvent() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/xpcom/threads/plevent.c,
line 608]
_md_EventReceiverProc() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/xpcom/threads/plevent.c,
line 1578]
HIToolbox.145.0.0 + 0x1fa0 (0x9a7f1fa0)
HIToolbox.145.0.0 + 0x2214 (0x9a7f2214)
HIToolbox.145.0.0 + 0x6694 (0x9a7f6694)
HIToolbox.145.0.0 + 0x12d2c (0x9a802d2c)
HIToolbox.145.0.0 + 0x205c (0x9a7f205c)
HIToolbox.145.0.0 + 0x2214 (0x9a7f2214)
HIToolbox.145.0.0 + 0x146bc (0x9a8046bc)
HIToolbox.145.0.0 + 0x185d8 (0x9a8085d8)
HIToolbox.145.0.0 + 0x28718 (0x9a818718)
HIToolbox.145.0.0 + 0x8d88 (0x9a7f8d88)
HIToolbox.145.0.0 + 0x8f3c (0x9a7f8f3c)
HIToolbox.145.0.0 + 0x1c9f0 (0x9a80c9f0)
HIToolbox.145.0.0 + 0x2d708 (0x9a81d708)
nsMacMessagePump::GetEvent() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/widget/src/mac/nsMacMessagePump.cpp,
line 407]
nsMacMessagePump::DoMessagePump() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/widget/src/mac/nsMacMessagePump.cpp,
line 312]
nsAppShell::Run() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/widget/src/mac/nsAppShell.cpp,
line 114]
xre_main() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.7.0_Depend/mozilla/toolkit/xre/nsAppRunner.cpp,
line 710]
_start()   start()

Comment 3

[Michal 'hramrach' Suchanek]

well, it works with a trunk build.

Which means it will probably go away in 2.0.
And it is not likely to be seen very often unless it also manifests under more
common conditions ;-)

Comment 4

[Matthias Versen [:Matti]]

It will go into the coming FF1.1.
I mark this wfm because I don't think that this will be fixed on the avairy
branch. (no topcrasher)