Closed Bug 340717 Opened 19 years ago Closed 19 years ago

Firefox crashes when entering large amount of text into form (stack overflow, mostly nsTextFrame::GetChildFrameContainingOffset)

Categories

(Toolkit :: Form Manager, defect)

Product:
Toolkit
Component:
Form Manager
Version:
1.8.0 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 275654

People

(Reporter: koua, Unassigned)

Details

(Keywords: crash)

User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4 Firefox crashes if you enter in a large amount of text into a textarea form/field. It is simple to reproduce by entering in some text, make a copy of the text, and hold down the ctrl-v or command-v (for pasting). After a few seconds, firefox will crash (buffer overrun?). I have confirmed this on 1.5.0.3 and 1.5.0.4 on Win32, Linux, Mac OS X. I'm sure this bug is true for other platforms as well. Reproducible: Always Steps to Reproduce: 1. type in some text (a normal size paragraph will do) 2. copy the paragraph 3. hit control+v on PC/Linux, command+v on Mac and HOLD 4. after a few seconds (15-20 seconds), firefox will crash Actual Results: Firefox crashes. Expected Results: Firefox should not crash. This bug is not limited to one particular OS/Platform.
I just tried reproducing the bug by pasting large chunks of text into the comments form on this page. Firefox did become sluggish and ate >1GB memory (waiting for it to run out of memory would take a lot of time), but didn't crash. Do you have talkback IDs for the crashes? http://kb.mozillazine.org/Talkback
Keywords: crash
Summary: Firefox crashes when entering text into form → Firefox crashes when entering large amount of text into form
Version: unspecified → 1.5.0.x Branch
I have confirmed this with several of my colleagues here at the University - it deffinitely crashes. I do not have talkback IDs for the crashes (not sure if the new binaries does not contain talkback or that the crash prevents talkback from even showing up). Both Windows and Linux crashed without talkback poping up. Under Mac OS X, the OS catches the crash, but again, no talkback. Here is the crash dump in Mac OS X (probably not very helpful): Date/Time: 2006-06-12 08:21:09.580 -0500 OS Version: 10.4.6 (Build 8I1119) Report Version: 4 Command: firefox-bin Path: /Applications/Firefox.app/Contents/MacOS/firefox-bin Parent: WindowServer [63] Version: 1.5.0.4 (1.5.0.4) PID: 341 Thread: Unknown Link (dyld) error: no suitable image found. Did find: /Library/Internet Plug-Ins/iPhotoPhotocast.plugin: not a file Model: MacBookPro1,1, BootROM MBP11.0055.B03, 2 processors, Intel Core Duo, 1.83 GHz, 1.5 GB Graphics: ATI Radeon X1600, ATY,RadeonX1600, PCIe, 128 MB Memory Module: DIMM0/BANK 0, 1 GB, DDR2 SDRAM, 667 MHz Memory Module: DIMM1/BANK 1, 512 MB, DDR2 SDRAM, 667 MHz AirPort: spairport_wireless_card_type_airport_extreme (0x168C, 0x86), 0.1.17 Bluetooth: Version 1.7.3f4, 2 service, 0 devices, 1 incoming serial ports Network Service: Built-in Ethernet, Ethernet, en0 Network Service: Parallels Host-Guest Adapter, Ethernet, en2 Serial ATA Device: ST98823AS, 74.53 GB Parallel ATA Device: MATSHITADVD-R UJ-857 USB Device: Built-in iSight, Micron, Up to 480 Mb/sec, 500 mA USB Device: Apple Internal Keyboard / Trackpad, Apple Computer, Up to 12 Mb/sec, 500 mA USB Device: IR Receiver, Apple Computer, Inc., Up to 12 Mb/sec, 500 mA USB Device: Bluetooth HCI, Up to 12 Mb/sec, 500 mA I noticed this dump seems to be pointing to some kind of an "image" problem, but all I did was paste some text. I will post more dumps if possible.
arg. do you have admin like rights? i.e. can you kill or otherwise maim: /Library/Internet Plug-Ins/iPhotoPhotocast.plugin ? we really need plugin blacklisting on osx because of this insanity about system plug-ins.
Fascinating. I renamed iPhotoPhotocast.plugin to iPhotoPhotocast.plugin.orig and it no longer crashes. I hope this sheds some light on the Linux and Windows side.
I just sent in Talkback dump of the crash on a Windows machine (brand new install - OS and Firefox, nothing else installed at the moment). It apparently is still crashing on Mac OS X as well.
Can you paste the Talkback ID here? See http://kb.mozillazine.org/Talkback for how to get the Talkback ID for a crash report you have submitted.
Incident ID: 20045600 Stack Signature nsTextFrame::GetChildFrameContainingOffset 1e971f88 Product ID Firefox15 Build ID 2006050817 Trigger Time 2006-06-19 12:22:48.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module firefox.exe + (002486d4) URL visited User Comments This is a follow up to bug number: 340717 I finally re-installed Firefox with talkback enabled. Here's the TB info. Since Last Crash 263 sec Total Uptime 263 sec Trigger Reason Stack overflow Source File, Line No. c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4315 Stack Trace nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4315] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] nsTextFrame::GetChildFrameContainingOffset [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsTextFrame.cpp, line 4361] *** This bug has been marked as a duplicate of 275654 ***
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Summary: Firefox crashes when entering large amount of text into form → Firefox crashes when entering large amount of text into form (stack overflow, mostly nsTextFrame::GetChildFrameContainingOffset)
Product: Firefox → Toolkit
You need to log in before you can comment on or make changes to this bug.