crash if define html:input of type checkbox inside listitem [@ AppendUTF8toUTF16] [@ nsSubstring::MutatePrep] Stack overflow

VERIFIED FIXED

Status

()

Core
Layout
--
critical
VERIFIED FIXED
13 years ago
6 years ago

People

(Reporter: Willy also, Unassigned)

Tracking

(Depends on: 1 bug, {crash, testcase})

Trunk
crash, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [reflow-refactor], crash signature)

Attachments

(2 attachments)

(Reporter)

Description

13 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20051110 Firefox/1.6a1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20051110 Firefox/1.6a1

<vbox>
		<listbox rows="2">
			<listitem label="listitem"/>
			<listitem><html:input type="checkbox" style="margin:0px;"/></listitem>
		</listbox>
</vbox>

There must be
1. the definition of rows in listbox
2. at least one listitem before the listitem with <html:input ....
3. the <html:input of type checkbox or radio
4. a style definition with margin:0px;

crash

Reproducible: Always
I can confirm the crash.
Also crashes Mozilla1.7, so no recent regression.
Assignee: guifeatures → nobody
Status: UNCONFIRMED → NEW
Component: XP Apps: GUI Features → Layout
Ever confirmed: true
Keywords: crash, testcase
Product: Mozilla Application Suite → Core
QA Contact: layout
Version: unspecified → Trunk
I'm unable to get a backtrace in my debug build, I only get this:
Program received signal SIGSEGV, Segmentation fault.
0x77f949c5 in ?? () from ntdll.dll
It seems like an infinite recursion crash or something like that.

Comment 4

13 years ago
4. a style definition with margin:0px;  can also be non-zero

TB13721317Z martinjn's testcase 
TB13721541M martinjn's testcase modified to 2px

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=322759&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 5

13 years ago
Incident ID: 13721317
Stack Signature	AppendUTF8toUTF16 a4f0f852
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2006-01-08 15:34:58.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766222
Module	XPCOM_CORE.DLL + (0003ae51)
URL visited	https://bugzilla.mozilla.org/attachment.cgi?id=207929&action=view
User Comments	Bug 322759 crash if define html:input of type checkbox inside listitem
Since Last Crash	39364 sec
Total Uptime	39364 sec
Trigger Reason	Stack overflow
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/string/src/nsReadableUtils.cpp, line 230
Stack Trace 	
AppendUTF8toUTF16  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/string/src/nsReadableUtils.cpp, line 230]
AtomImpl::ToString  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/ds/nsAtomTable.cpp, line 362]
nsAttrValue::ToString  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsAttrValue.cpp, line 318]
nsXULElement::GetAttr  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1566]
nsSliderFrame::GetIntegerAttribute  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSliderFrame.cpp, line 214]
nsSliderFrame::GetMaxPosition  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSliderFrame.cpp, line 194]
nsCSSFrameConstructor::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10572]
PresShell::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5435]
nsXULElement::SetAttrAndNotify  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1519]
nsXULElement::SetAttr  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1440]
nsXBLPrototypeBinding::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp, line 504]
nsXBLBinding::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLBinding.cpp, line 779]
nsXULElement::SetAttr  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1440]
nsGfxScrollFrameInner::SetAttribute  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2482]
nsGfxScrollFrameInner::LayoutScrollbars  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2368]
nsXULScrollFrame::Layout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2331]
nsXULScrollFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 1283]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsGridLayout2::Layout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridLayout2.cpp, line 74]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsRootBoxFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 227]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 904]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 240]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 914]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6870]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]

The second stack is pretty much the same except the top two frames are different :

nsSubstring::MutatePrep  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/string/src/nsTSubstring.cpp, line 64]
nsSubstring::SetLength  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/string/src/nsTSubstring.cpp, line 551]
Summary: crash if define html:input of type checkbox inside listitem → crash if define html:input of type checkbox inside listitem [@ AppendUTF8toUTF16] [@ nsSubstring::MutatePrep]

Comment 6

13 years ago
ispiked, what matters is this line:
Trigger Reason  Stack overflow

it means that the top frame in the stack is likely to vary among the top frames you see here based on what else was on the stack before bad stuff happened.
Summary: crash if define html:input of type checkbox inside listitem [@ AppendUTF8toUTF16] [@ nsSubstring::MutatePrep] → crash if define html:input of type checkbox inside listitem [@ AppendUTF8toUTF16] [@ nsSubstring::MutatePrep] Stack overflow
Flags: blocking1.9?

Comment 7

12 years ago
*** Bug 359786 has been marked as a duplicate of this bug. ***

Comment 8

12 years ago
So it looks like the issue is the nested <listitem>s. This appears to be fixed on trunk, but still crashes branch. We should figure out when it got fixed on trunk.
Flags: blocking1.9?
OS: Windows 2000 → All
Hardware: PC → All
Version: Trunk → 1.8 Branch
Well, I'm still crashing on trunk with the testcase, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061108 Minefield/3.0a1
So for me this isn't fixed on trunk for me.
Version: 1.8 Branch → Trunk
Created attachment 246661 [details]
backtrace from debug build
I suspect this would be fixed with a fix for bug 281147.
Depends on: 281147
This is worksforme with a reflow branch build of:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061107 Minefield/3.0a1
Whiteboard: [reflow-refactor]
fixed on reflow branch
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Depends on: 300030
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
Adding in-testsuite? nomination per bz's request in m.d.t.l. Sorry for the bugspam.
Flags: in-testsuite?
(Reporter)

Comment 15

12 years ago
(In reply to comment #12)
> This is worksforme with a reflow branch build of:
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061107
> Minefield/3.0a1
> 

Test with:

Mozilla/5.0 (Windows; U; Windows NT 5.0;
en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1

crash

This bug is one of 3 or 4 bugs I reported and all of them produce a crash.
All of this examples do NOT use any privileged code and all of them I reported at least one year ago.
Not even one of this bugs are fixed.

Great !
(Assignee)

Updated

7 years ago
Crash Signature: [@ AppendUTF8toUTF16] [@ nsSubstring::MutatePrep]
Crash Signature: [@ AppendUTF8toUTF16] [@ nsSubstring::MutatePrep] → [@ AppendUTF8toUTF16] [@ nsSubstring::MutatePrep]
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.