Closed Bug 326411 Opened 19 years ago Closed 18 years ago

http://www.it.com.cn/market/gz/ crashes [@ nsComboboxControlFrame::CreateAnonymousContent]

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 318254

People

(Reporter: mmoy, Unassigned)

References

(
URL
)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

Page from http://www.it.com.cn/market/gz/
240.16 KB, text/html
Details 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060202 mmoy CE 1.5.0.1 K8B-X61
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

This was reported to me by several users. I installed 1.5.0.1 Release Installer, went to the web page and FF crashed.

Reproducible: Always

Steps to Reproduce:
1. Visit http://www.it.com.cn/market/gz/
2.
3.

Actual Results:  
Crash

Expected Results:  
Page should load

Page should load
Someone just sent me a note indicating that this doesn't crash in the 2/6/2006 branch build so it may be fixed in the branch but this does need to make it into
the next patch release.
I can confirm a crash here as well. FF 1.5.0.1 release on Windows 2000 Workstation SP4.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

Talkback ID (just entered, probably not in database yet): TB14912572W
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060208 Firefox/1.6a1 ID:2006020806
The site loads fully in trunk, but crashes in 1.5.0.1 and branch.
1.5.0.1: TB14912469Q  TB14912443E
1.5: TB14912331X  TB14912660Z 

Very likely to be dupe of bug 318254. Can you confirm the crash for http://www.it.com.cn/ itself?
I do not get a crash on http://www.it.com.cn/.
(In reply to comment #4)
> Very likely to be dupe of bug 318254. Can you confirm the crash for
> http://www.it.com.cn/ itself?
> 

That page loads fine. I checked that other bug before filing this one. That bug
seems to have been fixed some time ago before 1.5.0.1 came out.
Yet it looks similar. Regressed in the second half of October 2005.

Incident ID: 14912331
Stack Signature	nsComboboxControlFrame::CreateAnonymousContent 8e102ad8
Product ID	Firefox2
Build ID	2006020803
Trigger Time	2006-02-08 08:09:18.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00256380)
URL visited	
User Comments	
Since Last Crash	103 sec
Total Uptime	103 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/forms/nsComboboxControlFrame.cpp, line 2122
Stack Trace 	
nsComboboxControlFrame::CreateAnonymousContent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/forms/nsComboboxControlFrame.cpp, line 2122]
nsCSSFrameConstructor::CreateAnonymousFrames  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5796]
nsCSSFrameConstructor::CreateAnonymousFrames  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5683]
nsCSSFrameConstructor::ConstructSelectFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5046]
nsCSSFrameConstructor::ConstructHTMLFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5445]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7735]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7624]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12011]
nsCSSFrameConstructor::ConstructTableCellFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3889]
nsCSSFrameConstructor::TableProcessChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4149]
nsCSSFrameConstructor::TableProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4037]
nsCSSFrameConstructor::ConstructTableRowFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3737]
nsCSSFrameConstructor::TableProcessChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4134]
nsCSSFrameConstructor::TableProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4037]
nsCSSFrameConstructor::ConstructTableRowGroupFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3626]
nsCSSFrameConstructor::TableProcessChild  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4127]
nsCSSFrameConstructor::TableProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4037]
nsCSSFrameConstructor::ConstructTableFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3498]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6716]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7799]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7624]
nsCSSFrameConstructor::ProcessInlineChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13314]
nsCSSFrameConstructor::ConstructInline  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13126]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6691]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7799]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7624]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12011]
nsCSSFrameConstructor::ConstructTableCellFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3889]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6786]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7799]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7624]
nsCSSFrameConstructor::ContentInserted  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9402]
nsCSSFrameConstructor::ReinsertContent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9527]
nsCSSFrameConstructor::ContentInserted  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9429]
PresShell::ContentInserted  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5487]
nsHTMLDocument::ContentInserted  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp, line 1122]
nsHTMLInputElement::RadioSetChecked  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 887]
nsHTMLInputElement::AddedToRadioGroup  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 2581]
nsHTMLInputElement::BindToTree  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 1733]
nsGenericElement::BindToTree  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 1912]
nsGenericHTMLElement::BindToTree  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1333]
nsGenericHTMLElement::BindToTree  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1333]
nsGenericHTMLElement::BindToTree  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1333]
nsGenericHTMLElement::BindToTree  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1333]
nsGenericElement::InsertChildAt  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2719]
nsGenericElement::InsertBefore  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 3019]
nsGenericHTMLElementTearoff::SetInnerHTML  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 214]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_GetterSetter  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1468]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1274]
js_InternalGetOrSet  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1333]
js_SetProperty  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 3059]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3386]
js_Execute  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1424]
JS_EvaluateUCScriptForPrincipals  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4103]
nsJSContext::EvaluateString  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1061]
nsScriptLoader::EvaluateScript  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsScriptLoader.cpp, line 774]
nsScriptLoader::ProcessRequest  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsScriptLoader.cpp, line 672]
nsScriptLoader::DoProcessScriptElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsScriptLoader.cpp, line 605]
nsScriptLoader::ProcessScriptElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsScriptLoader.cpp, line 358]
nsHTMLScriptElement::MaybeProcessScript  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 663]
nsHTMLScriptElement::BindToTree  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLScriptElement.cpp, line 456]
nsGenericElement::AppendChildTo  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2803]
Keywords: crash
Summary: http://www.it.com.cn/market/gz/ crashes → http://www.it.com.cn/market/gz/ crashes [@ nsComboboxControlFrame::CreateAnonymousContent]
Looking at the 1.5.0.1 talkbacks in the thread, I'm seeing two type of stack traces:

 js_LookupPropertyWithFlags (see TB14912572W, TB14912443E)
 nsComboboxControlFrame::CreateAnonymousContent (see TB14912469Q, and 1.5 traces TB14912331X, TB14912660Z)
Crash on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060214 Firefox/1.5 ID:2006021404

I have attached the page it crash, i have done some clean up.

crash on line 1883:
1879:<SCRIPT>
...
1883:price_menu.innerHTML=span_price_menu.innerHTML;
...
1885:</SCRIPT>

span_price_menu.innerHTML contains tons of things.

*** This bug has been marked as a duplicate of 318254 ***
Status: UNCONFIRMED → RESOLVED
Closed: 18 years ago
Resolution: --- → DUPLICATE
like stated in comment #5 (by someone else), I crash on http://www.it.com.cn/market/gz/ but not on http://www.it.com.cn/

see TB15186695, I'm crashing in Detecting: /mozilla/js/src/jsobj.c, line 2572
François Gagné, please file another bug for that crash if you cannot find a duplicate.
Crash Signature: [@ nsComboboxControlFrame::CreateAnonymousContent]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: