322759 - crash if define html:input of type checkbox inside listitem [@ AppendUTF8toUTF16] [@ nsSubstring::MutatePrep] Stack overflow

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Willy also]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20051110 Firefox/1.6a1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20051110 Firefox/1.6a1

<vbox>
		<listbox rows="2">
			<listitem label="listitem"/>
			<listitem><html:input type="checkbox" style="margin:0px;"/></listitem>
		</listbox>
</vbox>

There must be
1. the definition of rows in listbox
2. at least one listitem before the listitem with <html:input ....
3. the <html:input of type checkbox or radio
4. a style definition with margin:0px;

crash

Reproducible: Always

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

I can confirm the crash.
Also crashes Mozilla1.7, so no recent regression.

Comment 3

[Martijn Wargers (dead)]

I'm unable to get a backtrace in my debug build, I only get this:
Program received signal SIGSEGV, Segmentation fault.
0x77f949c5 in ?? () from ntdll.dll
It seems like an infinite recursion crash or something like that.

Comment 4

[Hermann Schwab]

4. a style definition with margin:0px;  can also be non-zero

TB13721317Z martinjn's testcase 
TB13721541M martinjn's testcase modified to 2px

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=322759&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 5

[Adam Guthrie]

Incident ID: 13721317
Stack Signature	AppendUTF8toUTF16 a4f0f852
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2006-01-08 15:34:58.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766222
Module	XPCOM_CORE.DLL + (0003ae51)
URL visited	https://bugzilla.mozilla.org/attachment.cgi?id=207929&action=view
User Comments	Bug 322759 crash if define html:input of type checkbox inside listitem
Since Last Crash	39364 sec
Total Uptime	39364 sec
Trigger Reason	Stack overflow
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/string/src/nsReadableUtils.cpp, line 230
Stack Trace 	
AppendUTF8toUTF16  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/string/src/nsReadableUtils.cpp, line 230]
AtomImpl::ToString  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/ds/nsAtomTable.cpp, line 362]
nsAttrValue::ToString  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsAttrValue.cpp, line 318]
nsXULElement::GetAttr  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1566]
nsSliderFrame::GetIntegerAttribute  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSliderFrame.cpp, line 214]
nsSliderFrame::GetMaxPosition  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSliderFrame.cpp, line 194]
nsCSSFrameConstructor::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10572]
PresShell::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5435]
nsXULElement::SetAttrAndNotify  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1519]
nsXULElement::SetAttr  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1440]
nsXBLPrototypeBinding::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLPrototypeBinding.cpp, line 504]
nsXBLBinding::AttributeChanged  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLBinding.cpp, line 779]
nsXULElement::SetAttr  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1440]
nsGfxScrollFrameInner::SetAttribute  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2482]
nsGfxScrollFrameInner::LayoutScrollbars  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2368]
nsXULScrollFrame::Layout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2331]
nsXULScrollFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 1283]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsGridLayout2::Layout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridLayout2.cpp, line 74]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1106]
nsRootBoxFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 227]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 904]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 240]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 914]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6870]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]
PresShell::HandlePostedReflowCallbacks  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5234]
PresShell::DidDoReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6785]
PresShell::FlushPendingNotifications  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5333]

The second stack is pretty much the same except the top two frames are different :

nsSubstring::MutatePrep  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/string/src/nsTSubstring.cpp, line 64]
nsSubstring::SetLength  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/string/src/nsTSubstring.cpp, line 551]

Comment 6

[timeless]

ispiked, what matters is this line:
Trigger Reason  Stack overflow

it means that the top frame in the stack is likely to vary among the top frames you see here based on what else was on the stack before bad stuff happened.

Comment 7

[Adam Guthrie]

*** Bug 359786 has been marked as a duplicate of this bug. ***

Comment 8

[Adam Guthrie]

So it looks like the issue is the nested <listitem>s. This appears to be fixed on trunk, but still crashes branch. We should figure out when it got fixed on trunk.

Comment 9

[Martijn Wargers (dead)]

Well, I'm still crashing on trunk with the testcase, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061108 Minefield/3.0a1
So for me this isn't fixed on trunk for me.

Comment 10

[Martijn Wargers (dead)]

Attachment: backtrace from debug build

Comment 11

[Martijn Wargers (dead)]

I suspect this would be fixed with a fix for bug 281147.

Comment 12

[Martijn Wargers (dead)]

This is worksforme with a reflow branch build of:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061107 Minefield/3.0a1

Comment 13

[Peter van der Woude [:Peter6]]

fixed on reflow branch

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Adding in-testsuite? nomination per bz's request in m.d.t.l. Sorry for the bugspam.

Comment 15

[Willy also]

(In reply to comment #12)
> This is worksforme with a reflow branch build of:
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061107
> Minefield/3.0a1
> 

Test with:

Mozilla/5.0 (Windows; U; Windows NT 5.0;
en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1

crash

This bug is one of 3 or 4 bugs I reported and all of them produce a crash.
All of this examples do NOT use any privileged code and all of them I reported at least one year ago.
Not even one of this bugs are fixed.

Great !