3090 - Viewer crashes on loading new page from www.netscape.com

Status: VERIFIED FIXED

(Core :: Layout, defect, P1)

Description

[Nisheeth Ranjan]

Stack trace on the 2/9/99 build:

nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x013034d0, nsIPresContext &
{...}) line 430 + 19 bytes
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x013269b0) line
228
nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x01303c40, nsIPresContext &
{...}) line 422 + 16 bytes
nsAreaFrame::DeleteFrame(nsAreaFrame * const 0x01303c40, nsIPresContext & {...})
line 96
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x01303b50,
nsIPresContext & {...}) line 81
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x013038c0,
nsIPresContext & {...}) line 81
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x013035f0,
nsIPresContext & {...}) line 81
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x01303120,
nsIPresContext & {...}) line 81
nsTableFrame::DeleteFrame(nsTableFrame * const 0x01303120, nsIPresContext &
{...}) line 322
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x01302960,
nsIPresContext & {...}) line 81
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x013102d0) line
228
nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x01310120, nsIPresContext &
{...}) line 422 + 16 bytes
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsInlineFrame::DeleteFrame(nsInlineFrame * const 0x013367d0, nsIPresContext &
{...}) line 321
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x01310520) line
228
nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x012fc210, nsIPresContext &
{...}) line 422 + 16 bytes
nsAreaFrame::DeleteFrame(nsAreaFrame * const 0x012fc210, nsIPresContext & {...})
line 96
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012fc120,
nsIPresContext & {...}) line 81
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012957c0,
nsIPresContext & {...}) line 81
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x01295d00,
nsIPresContext & {...}) line 81
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x014552b0,
nsIPresContext & {...}) line 81
nsTableFrame::DeleteFrame(nsTableFrame * const 0x014552b0, nsIPresContext &
{...}) line 322
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x0144e280,
nsIPresContext & {...}) line 81
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x0136f5b0) line
228
nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x01469f80, nsIPresContext &
{...}) line 422 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x012f8d00) line
228
nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x012c3ac0, nsIPresContext &
{...}) line 422 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x012c3f90) line
228
nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x012c3620, nsIPresContext &
{...}) line 422 + 16 bytes
nsAreaFrame::DeleteFrame(nsAreaFrame * const 0x012c3620, nsIPresContext & {...})
line 96
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012c3210,
nsIPresContext & {...}) line 81
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012be1a0,
nsIPresContext & {...}) line 81
nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30
nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012bee90,
nsIPresContext & {...}) line 81
ViewportFrame::DeleteFrame(ViewportFrame * const 0x012bee90, nsIPresContext &
{...}) line 102
PresShell::~PresShell() line 444
PresShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes
PresShell::Release(PresShell * const 0x012b9120) line 390 + 28 bytes
DocumentViewerImpl::~DocumentViewerImpl() line 219 + 18 bytes
DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x014715d0) line 156 + 99
bytes
nsWebShell::Embed(nsWebShell * const 0x012364b0, nsIContentViewer * 0x01348eb0,
char * 0x00000000, nsISupports * 0x00000000) line 648 + 27 bytes
nsDocumentBindInfo::OnStartBinding(nsDocumentBindInfo * const 0x013463d0, nsIURL
* 0x01346420, char * 0x01347ed0) line 1645 + 36 bytes
OnStartBindingProxyEvent::HandleEvent(OnStartBindingProxyEvent * const
0x01347e80) line 509
StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x01347e84) line 474 + 12
bytes
PL_HandleEvent(PLEvent * 0x01347e84) line 472 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x011f4720) line 433 + 9 bytes
_md_EventReceiverProc(void * 0x029e0260, unsigned int 49340, unsigned int 0,
long 18827040) line 784 + 9 bytes
USER32! 77e713ed()

Crash occurs because the mBullet member variable of nsBlockFrame is dereferenced
after it has been freed.

Comment 1

[Nisheeth Ranjan]

Fixing typo in summary...

Comment 2

[Nisheeth Ranjan]

OK, more investigation reveals that we crash any time we go to a new page from
Netscape's home page, www.netscape.com.

Changing URL and summary to reflect that.

Comment 3

[kipp]

Troy fixed this bug for me - I merged to DeleteFrame methods and got the code
into the wrong order...

Comment 4

[Paul MacQuiddy]

verified fixed, you can go to other pages after going to www.netscape.com