Closed Bug 312495 Opened 19 years ago Closed 15 years ago

crash when exiting a page with Java Bubble viewer [@ nsBlockReflowContext::ComputeCollapsedTopMargin]

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: sglaser, Unassigned)

References

()

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051006 Firefox/1.4.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051006 Firefox/1.4.1

This is a real estate virtual tour site. Clicking on a tab with a 360 view,
selecting the Java Bubble viewer and they trying to view any other tab hangs the
browser. In Mozilla, it crashes the browser.

Reproducible: Always

Steps to Reproduce:
1. go the the web site http://tours.tourfactory.com/tours/tour.asp?t=240027
2. click on one of the tabs with a yellow dot (e.g. Living_360)
3. select the Jvav Bubble viewer (bottom of the picture)
4. select any other picture (e.g. Living)
5. experience crash and/or hang
Severity: normal → critical
Component: OS Integration → Plug-ins
Product: Firefox → Core
Summary: crash / infinite loop → crash when exiting a page with Java Bubble viewer
Version: unspecified → Trunk
QA Contact: os.integration → plugins
can you provide talkback ?
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051014
Firefox/1.6a1 ID:2005101412

Talkback doesn't come up, which means it's probably the plug-in itself that's
crashing.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051013
Firefox/1.4.1

I get Talkback: TB10667268W
Keywords: talkbackid
I assume since there's talkback that you guys have reproduced this and don't
need anything else from me (the submitter). If not, please let me know what I
can do to help.
(In reply to comment #3)
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051013
> Firefox/1.4.1
> 
> I get Talkback: TB10667268W

Talkbackreport contains wrong URL, from previous crash, that's a bug in
Talkback. Workaround: put some text in trhe URL-field, if there is an old URL

I'm getting similar Talkbacks: TB10683072H, TB10683001G
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051012 SeaMonkey/1.1a
Java(TM) 2 Platform Standard Edition 5.0 Update 5
Java Plug-in 1.5.0_05 for Netscape Navigator (DLL Helper)

The tabs with yellow dots offer different viewers, flash, or the java
bubbleviewer, which is crashing here. I didn't test other viewers.
Java Bubble Viewer crashes if you change from a yellow .tab to another tab,
doesn't matter if yellow or not. (works only on yellow tabs!)
Doesn't crash on closing the browser tab. 

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7





Keywords: crash
Incident ID: 10683072
Stack Signature	nsBlockReflowContext::ComputeCollapsedTopMargin 9b44302f
Product ID	MozillaTrunk
Build ID	2005101205
Trigger Time	2005-10-15 02:42:07.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766222
Module	GKLAYOUT.DLL + (000644a3)
URL visited	http://tours.tourfactory.com/tours/tour.asp?t=240027
User Comments	Bug 312495 crash when exiting a page with Java Bubble viewer
jre1.5.0_05, changed from living_360 to front_360
Since Last Crash	515 sec
Total Uptime	70502 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 145
Stack Trace 	
nsBlockReflowContext::ComputeCollapsedTopMargin 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 145]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3324]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2598]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2251]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 885]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsTableCellFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableCellFrame.cpp,
line 857]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsTableRowFrame::IR_TargetIsChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp,
line 1261]
nsTableRowFrame::IncrementalReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp,
line 1145]
nsTableRowFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp,
line 1446]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsTableRowGroupFrame::IR_TargetIsChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp,
line 1638]
nsTableRowGroupFrame::IncrementalReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp,
line 1322]
nsTableRowGroupFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp,
line 1228]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsTableFrame::IR_TargetIsChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 2932]
nsTableFrame::IncrementalReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 2669]
nsTableFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 1925]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsTableOuterFrame::OuterReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1312]
nsTableOuterFrame::IR_InnerTableReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1660]
nsTableOuterFrame::IR_TargetIsInnerTableFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1425]
nsTableOuterFrame::IR_TargetIsChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1407]
nsTableOuterFrame::IncrementalReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1376]
nsTableOuterFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1922]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 606]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3436]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2598]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2251]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 885]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 606]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3436]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2598]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2251]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 885]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 606]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3436]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2598]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2251]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 885]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
CanvasFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLFrame.cpp,
line 534]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
nsHTMLScrollFrame::ReflowScrolledFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 527]
nsHTMLScrollFrame::ReflowContents 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 590]
nsHTMLScrollFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 784]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 891]
ViewportFrame::Reflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsViewportFrame.cpp,
line 239]
IncrementalReflow::Dispatch 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 859]
PresShell::ProcessReflowCommands 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6492]
ReflowEvent::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6317]
PL_HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 689]
0x778b0c24
Component: Plug-ins → Layout
Keywords: talkbackid
QA Contact: plugins → layout
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4
So regressed sometime between 1.8b4 20050908 and 1.8b5 20051006
Keywords: regression
I was wrong in comment 4, didn't check the  Java Bubble viewer
regressed earlier

hang Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4
hang Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050908 Firefox/1.6a1
hang Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050916 Firefox/1.6a1
hang Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051012 Firefox/1.6a1
crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051016 Firefox/1.6a1
in comment 8 I meant I was wrong in comment 7, not comment 4.
I don't think it is a regression, I retested 1.0.7 and crashed too.
Didn't find a build not hanging or crashing.

crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7a) Gecko/20040210 Firebird/0.8.0+
crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7b) Gecko/20040406 Firefox/0.8.0+
crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a2) Gecko/20040619 Firefox/0.8.0+
TB10727019G Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041001
Firefox/0.9.1+
hang Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050216 Firefox/1.0+
TB10726368K Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050417
Firefox/1.0+
TB10726094Q Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050523
Firefox/1.0+

TB10728359E Mozilla/5.0 (Windows; U; Win98; de-DE; rv:1.7.12) Gecko/20050919
Firefox/1.0.7
Keywords: regression
crashed using Mozilla 1.4.2
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4.2) Gecko/20040426
still present in RC1

*** This bug has been marked as a duplicate of 315111 ***
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051208 SeaMonkey/1.5a
Talkback TB12832720H

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8) Gecko/20051210 Firefox/1.5
Talkback TB12832773G

jre1.5.0_06 Java(TM) 2 Platform Standard Edition 5.0 Update 6
JRE 5.0 Update 6 from http://java.sun.com/j2se/1.5.0/download.jsp

Steps to repeat:
1. Load http://tours.tourfactory.com/tours/tour.asp?t=240027
2. Select one of the tabs with yellow dot, let's say Front 360
http://tours.tourfactory.com/tours/Tour.asp?t=240027&home=http%3A%2F%2Fwww%2EAustinHouses%2Ecom&slink=%2D2&af=1&sc=1684231&s=3
3. Select 'Java Viewer(Bubble)' below the right lower edge of the image
4. Select another one of the tabs with yellow dot, let's say Living_360
http://tours.tourfactory.com/tours/Tour.asp?t=240027&home=http%3A%2F%2Fwww%2EAustinHouses%2Ecom&slink=%2D3&af=1&sc=1679245&s=8

right now I can't reproduce the bug in the very same Firefox I got my Talkbacks from. But I started differently, instead of switching the view in the same tab I opened a new tab and got two different views. Copying the URL back to the old tab I had identical views, switching the view in the tab didn't crash.
I see two Java Icons in the tray, staying after I close Firefox. They are going, after I kill Firefox using Process Explorer.
Status: RESOLVED → UNCONFIRMED
Resolution: DUPLICATE → ---
See bug 315111 comment 52. This is a problem in the Java plug-in which has yet to be fixed.
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago19 years ago
Resolution: --- → INVALID
(In reply to comment #14)
> See bug 315111 comment 52. This is a problem in the Java plug-in which has yet
> to be fixed.

See bug 315111 comment 49. This is a problem in the Java plug-in which gives a different stack.

I'll reopen this bug, and resolve it, when the other bug is verified.
We'll see end of march next year, if a new plugin wqill fix it, or not.
Status: RESOLVED → UNCONFIRMED
Depends on: 315111
Resolution: INVALID → ---
tested with : Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1a2) Gecko/20060516 BonEcho/2.0a2

this WFM
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago18 years ago
Resolution: --- → WORKSFORME
sorry, I missed the exiting page part.... hang in this case.
Status: RESOLVED → UNCONFIRMED
Resolution: WORKSFORME → ---
Blocks: 353557
Hermann in comment #15
> Adam in comment #14
> > See bug 315111 comment 52. This is a problem in the Java plug-in which has yet
> > to be fixed.
> 
> See bug 315111 comment 49. This is a problem in the Java plug-in which gives a
> different stack.
> 
> I'll reopen this bug, and resolve it, when the other bug is verified.
> We'll see end of march next year, if a new plugin wqill fix it, or not.


perhaps not - 1 year later...

odd results for me - crashes SM and not FF

crashes SM:
*Java Plug-in 1.5.0_08 TB23565724M
*Java Plug-in 1.5.0 TB23565724M
- both on Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060918 SeaMonkey/1.5a

on the same machine does NOT crash Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8) Gecko/20051111 Firefox/1.5 
*Java Plug-in 1.5.0_08
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060921 Minefield/3.0a1 

also does not crash FF in different machine:
*Java Plug-in 1.4.2
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060915 Minefield/3.0a1


TB23565724
Stack Signature	 morkRowObject::CloseRowObject cde9e06a
Product ID	MozillaTrunk
Build ID	2006091810
Operating System	Windows NT 5.0 build 2195
Module	mork.dll + (00011c09)
User Comments	testing bug 312495 with SM s/vseerror
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/db/mork/src/morkRowObject.cpp, line 606
Stack Trace 	
morkRowObject::CloseRowObject  [mozilla/db/mork/src/morkRowObject.cpp, line 606]
No longer blocks: 353557
Hermann, Tracy, still seethis?
should summary include  @ nsBlockReflowContext::ComputeCollapsedTopMargin 
 for the crash?
WFM Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b2) Gecko/20081125 Firefox/3.1b2
Status: UNCONFIRMED → RESOLVED
Closed: 18 years ago15 years ago
Resolution: --- → WORKSFORME
Summary: crash when exiting a page with Java Bubble viewer → crash when exiting a page with Java Bubble viewer [@ nsBlockReflowContext::ComputeCollapsedTopMargin]
Crash Signature: [@ nsBlockReflowContext::ComputeCollapsedTopMargin]
You need to log in before you can comment on or make changes to this bug.