334780 - Browser-crash when opening links [@ nsIFrame::MarkDirtyChildren]

Status: RESOLVED DUPLICATE of bug 327973

(Core :: Layout, defect)

Description

[www.ProMoozz.org]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)
Build Identifier: Mozilla/5.0 (Windows; U; Win98; nl; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2

Examples:
http://www.phpmyadmin.net/home_page/docs.php
http://www.megaupload.com/

** error: **
FIREFOX heeft een fout met betrekking tot een ongeldige pagina veroorzaakt in
module <onbekend> op0000:00000017.
Registers:
EAX=02784a6f CS=0167 EIP=00000017 EFLGS=00010257
EBX=0275d2a0 SS=016f ESP=00d1bac0 EBP=00d1bb00
ECX=02784aff DS=016f ESI=027503a0 FS=43e7
EDX=0275d2a0 ES=016f EDI=0230fe20 GS=0000
Bytes in CS:EIP:
f0 18 81 00 f0 16 e8 00 f0 00 00 00 c8 d2 08 b0 
Stackdump:
00d1bac4 00564648 027503a0 00d1bae8 00000000 00604ea1 00d1bae8 0231584c 027503a0 0231584c 0230fe20 00000000 00000000 00000000 00000000 00000000 

Reproducible: Always

Steps to Reproduce:
1. browse to a page (some pages are no problem, see examples for testing)
2. click a link (all links seem to be affected)
3. browser crashes with "page-error" (so i guess it is a memory problem)

Actual Results:  
crash

Expected Results:  
go to the new link

windows 98 SE, only patches from last patch-tuesday aren't installed yet.

problem since 1.5.02

Comment 1

[www.ProMoozz.org]

It seems to happen when a new window/tab should open, most of the times one want to download a file when FF crashes.

The bug is reproducable on certain links, but it doesn't happen with all links.

Comment 2

[Adam Guthrie]

Could you install Talkback and get a Talkaback ID for the crash? http://kb.mozillazine.org/Talkback

Comment 3

[www.ProMoozz.org]

(In reply to comment #2)
> Could you install Talkback and get a Talkaback ID for the crash?
> http://kb.mozillazine.org/Talkback

TB18217390W, TB18217225M

Comment 4

[Adam Guthrie]

Incident ID: 18217390
Stack Signature	nsIFrame::MarkDirtyChildren bf7f670c
Product ID	Firefox15
Build ID	2006030804
Trigger Time	2006-05-02 12:09:52.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	FIREFOX.EXE + (00164642)
URL visited	<a href='http://www.phpmyadmin.net/home_page/docs.php'>http://www.phpmyadmin.net/home_page/docs.php</a>
User Comments	
Since Last Crash	213 sec
Total Uptime	291 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 309
Stack Trace 	
nsIFrame::MarkDirtyChildren  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 309]
nsFrameManager::RemoveFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsFrameManager.cpp, line 705]
nsCSSFrameConstructor::ContentRemoved  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10028]
PresShell::ContentRemoved  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5521]
nsDocument::ContentRemoved  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp, line 2446]
nsXULContentBuilder::RemoveGeneratedContent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 1403]
nsXULContentBuilder::RebuildAll  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 1879]
nsXULTemplateBuilder::Rebuild  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 244]
XPTC_InvokeByIndex  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3562]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
nsXPCWrappedJSClass::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1372]
nsXPCWrappedJS::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462]
SharedStub  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1684]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1785]
nsGlobalWindow::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1601]
nsXULDocument::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 1243]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2136]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2133]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2133]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2133]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2133]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2133]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2133]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2133]
nsXULElement::HandleChromeEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2834]
nsGlobalWindow::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1588]
DocumentViewerImpl::LoadComplete  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/layout/base/nsDocumentViewer.cpp, line 1012]
nsDocShell::EndPageLoad  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp, line 4800]
nsWebShell::EndPageLoad  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/docshell/base/nsWebShell.cpp, line 664]
nsDocShell::OnStateChange  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/docshell/base/nsDocShell.cpp, line 4726]
nsDocLoader::FireOnStateChange  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/uriloader/base/nsDocLoader.cpp, line 1210]
nsDocLoader::doStopDocumentLoad  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/uriloader/base/nsDocLoader.cpp, line 844]
nsDocLoader::OnStopRequest  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/uriloader/base/nsDocLoader.cpp, line 665]
nsLoadGroup::RemoveRequest  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsLoadGroup.cpp, line 732]
nsInputStreamChannel::OnStopRequest  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsInputStreamChannel.cpp, line 375]
nsInputStreamChannel::`vftable'
nsRDFXMLSerializer::AddRef  [c:/builds/tinderbox/Fx-Mozilla1.8.0/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFXMLSerializer.cpp, line 150]
0x8b560c45

*** This bug has been marked as a duplicate of 327973 ***