316049 - crash on GM Canada web site [@ nsHTMLDocument::GetPixelDimensions 936bc96d]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[François Gagné]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

crash on GM Canada web site when configuring a car, choosing 'view deatil' on the car options.

Reproducible: Always

Steps to Reproduce:
1.Open to soon to be attach test case

Actual Results:  
crash Firefox

Comment 1

[François Gagné]

Attachment: (Loading this file crash Firefox!), The page on GM web site that cause the crash

Comment 2

[François Gagné]

I think it's related to js_LookupPropertyWithFlags but I cannot be sure since I'm not able to get my talkback (from http://talkback-public.mozilla.org/).

Some people crashing on GM Canada web site has js_LookupPropertyWithFlags has talkback.

Comment 3

[Ria Klaassen (not reading all bugmail)]

TB11720776G (trunk).
Regression is somewhere between 1 Aug and 1 Sep 2004.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

This is a DOM bug (per the talkback from comment 3) and my own testing.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Flushing is causing the shell to go away. We need to hold a strong ref so that it doesn't really die until we're done with it. jst says r+sr=jst, looking over my shoulder.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 7

[Jay Patel [:jay]]

Looking at the current Talkback data for Firefox15, there aren't enough crashes to   make this a topcrasher, but I will keep an eye on it.  If we see enough crashes in 1.5 final, we should be ready to get this checked in for 1.5 (since we DO have a reproducible testcase). Adding testcase keyword

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Note that, at least on Linux, this crash seems to trash the stack pretty badly, so Linux talkback numbers for this crash might be unrealistically low.

Comment 9

[François Gagné]

I would also add that this bug is happening on a high profile website: General Motors Canada.

Comment 10

[François Gagné]

I got this crash again when starting Firefox with sessionsaver loading : http://www.mininova.org/tor/165768

TB12556461

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 202715 [details] [diff] [review]
Fix

a=dveditz for drivers

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into branches.

Comment 13

[Marcia Knous [:marcia]]

verified fixed on the branch using Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1.  The testcase specified in https://bugzilla.mozilla.org/show_bug.cgi?id=316049 no longer crashes, but it doesn't appear that the page lays out properly either.