317900 - Browser crash during load, interaction or navigation [@ QBCurve::SubDivide]

Status: RESOLVED DUPLICATE of bug 316821

(Core :: Layout, defect)

Description

[Thomas O'Connor]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

Firefox 1.5 rc2/rc3 crashes during intial load, user interaction such as scrolling the page or hovering links, or during load of another page after navigating to a link.

Incident ID from 1.5 rc2 crash - TB12291931Z

Reproducible: Always

Steps to Reproduce:
1. Visit http://auspid.org/public/system/welcome/
2. Navigate to another page (main cause) - or interact with the page (i.e.: scroll, hover, etc.)
3. Wait. It should crash within a few seconds.

Actual Results:  
Browser crashes.

Expected Results:  
Browser remains running and completes the desired action.

Works fine in 1.5rc1 and earlier - I believe way back to before-Firefox even :)

Comment 1

[Adam Guthrie]

Incident ID: 12291931
Stack Signature	QBCurve::SubDivide 0cffec65
Product ID	Firefox15
Build ID	2005110712
Trigger Time	2005-11-26 18:39:35.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0029892e)
URL visited	http://auspid.org/public/
User Comments	loading page
Since Last Crash	41 sec
Total Uptime	41 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSRendering.cpp, line 3971
Stack Trace 	
QBCurve::SubDivide  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSRendering.cpp, line 3971]
nsCSSRendering::RenderSide  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSRendering.cpp, line 3594]
nsCSSRendering::PaintRoundedBorder  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSRendering.cpp, line 3476]
nsCSSRendering::PaintBorder  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSRendering.cpp, line 1710]
nsFrame::PaintSelf  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 947]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6245]
PresShell::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5806]
nsView::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 316]
nsViewManager::RenderDisplayListElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1460]
nsViewManager::RenderViews  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1375]
nsViewManager::Refresh  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 930]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2047]
HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1252]
nsWindow::ProcessMessage  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4362]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1434]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0xb4c0 (0x77d4b4c0)
USER32.dll + 0xb50c (0x77d4b50c)
ntdll.dll + 0xeae3 (0x7c90eae3)
nsWindow::DispatchStarvedPaints  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4182]
USER32.dll + 0xda57 (0x77d4da57)
nsWindow::DispatchPendingEvents  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4220]
nsWindow::ProcessMessage  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4627]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1434]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Bill Gianopoulos [:WG9s]]

Confirming.  This is 1.8 branch only.  Current trunk build does not crash.

Comment 3

[Adam Guthrie]

I'm pretty sure that when the patch for bug 316821 (a follow-up for an oversight in the fix for bug 265736) gets checked in, this will be solved.

Comment 4

[Andrew Schultz]

The URL crashes trunk build 2005-11-17-04 and not 2005-11-18-04, so this is definitely the same.

*** This bug has been marked as a duplicate of 316821 ***