318451 - Crash with earthlink.net

Status: RESOLVED DUPLICATE of bug 315752

(Core :: Layout, defect)

Comment 1

[Martijn Wargers (dead)]

From the talkback ID:

0x0365b5ff
DoDeletingFrameSubtree  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9687]
DoDeletingFrameSubtree  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9687]
DeletingFrameSubtree  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9733]
nsCSSFrameConstructor::RemoveMappingsForFrameSubtree  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9783]
nsFrameList::DestroyFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 234]
DeletingFrameSubtree  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9767]
nsCSSFrameConstructor::ContentRemoved  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9918]
nsCSSFrameConstructor::RecreateFramesForContent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11530]
nsCSSFrameConstructor::RestyleElement  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10412]
nsCSSFrameConstructor::ProcessOneRestyle  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ProcessPendingRestyles  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13298]
nsCSSFrameConstructor::RestyleEvent::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13365]
SHELL32.dll + 0x520c24 (0x778b0c24)

So this could have the same cause as bug 310426.

Comment 2

[Martijn Wargers (dead)]

Note that this was a follow-up from bug 316636. That bug is fixed on trunk and has blocking 1.8.0.1? flag set.
This crash could be the same as bug 310426, which is a trunk only crasher.

Comment 3

[Bernd]

Martijn, so does that mean we crash later than before?

Comment 4

[Martijn Wargers (dead)]

Yes, I think so, although I never crashed with the same stacktrace in bug 316636 (which is why I got a different minimised testcase there).

Comment 5

[Martijn Wargers (dead)]

This is fixed by bug 315752.
Tested with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051220 Firefox/1.6a1
Doesn't crash anymore.

Comment 6

[Daniel Veditz [:dveditz]]

Bob: is this a trunk only crash like 315752? If so please remove the 1.8.0.1 nomination.

Comment 8

[Boris Zbarsky [:bzbarsky]]

> but see a crash similar to bug 307809

Bug 307809 was only fixed on trunk, not on branch.  Do we need that fix on branch?

Comment 9

[Bob Clary [:bc] (inactive)]

(In reply to comment #8)

> Bug 307809 was only fixed on trunk, not on branch.  Do we need that fix on
> branch?

Not that I can see. It was not a real security issue and was just easy to fix on trunk right?

Comment 10

[Boris Zbarsky [:bzbarsky]]

Yeah, it was a null-pointer-dereference crash, so not a security issue.