354908 - crash [@ nsHTMLContainerFrame::CreateViewForFrame e4488abb

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[chris hofmann]

#9 in early fx2 RC1 data.  Might have moved up from #29 in beta2 data.

None of the code around the top of the stack seems to have changed lately...

quite a few of the comments seem to involve some kind of problem with  http://www.cmfu.com  mail.163.com

Stack Signature	 nsHTMLContainerFrame::CreateViewForFrame e4488abb
Product ID	Firefox2
Build ID	2006091818
Trigger Time	2006-09-29 10:23:45.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0026ea36)
URL visited	http://www.cmfu.com/showbook.asp?bl_id=68983
User Comments	Navigating the http://www.cmfu.com then I go to the URL http://www.cmfu.com then crash. But 1 week ago this never happens.
Since Last Crash	46 sec
Total Uptime	128 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 536
Stack Trace 	
nsHTMLContainerFrame::CreateViewForFrame  [mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 536]
nsCSSFrameConstructor::BeginBuildingScrollFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6474]
nsCSSFrameConstructor::ConstructRootFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4804]
PresShell::InitialReflow  [mozilla/layout/base/nsPresShell.cpp, line 2857]
nsContentSink::StartLayout  [mozilla/content/base/src/nsContentSink.cpp, line 924]
nsXMLContentSink::StartLayout  [mozilla/content/xml/document/src/nsXMLContentSink.cpp, line 877]
nsXMLContentSink::OnTransformDone  [mozilla/content/xml/document/src/nsXMLContentSink.cpp, line 432]
txTransformNotifier::SignalTransformEnd  [mozilla/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp, line 957]
txTransformNotifier::StyleSheetLoaded  [mozilla/extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp, line 883]
CSSLoaderImpl::ParseSheet  [mozilla/layout/style/nsCSSLoader.cpp, line 1396]
SheetLoadData::OnStreamComplete  [mozilla/layout/style/nsCSSLoader.cpp, line 811]
nsUnicharStreamLoader::OnStopRequest  [mozilla/netwerk/base/src/nsUnicharStreamLoader.cpp, line 196]
nsHttpChannel::OnStopRequest  [mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp, line 4121]

Full list of recent reports and comments here..
http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsHTMLContainerFrame%3A%3ACreateViewForFrame&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=build&rlimit=500

Comment 1

[Martijn Wargers (dead)]

I can reproduce this crash (but not easily) when reloading often at http://sndasdopassport.sdo.com/sdodownload/passport/W3Pages/SNDANewsBar.QD.xml
That url comes from the iframe that is embedded inside http://www.cmfu.com/showbook.asp?bl_id=68983
Talkback ID: TB23959841E

Comment 2

[Martijn Wargers (dead)]

Bug 346014 has a simplified testcase, which looks very similar to http://sndasdopassport.sdo.com/sdodownload/passport/W3Pages/SNDANewsBar.QD.xml

Comment 3

[chris hofmann]

hi martijn,  any idea if this is a regression or has it been around for awhile?

Comment 4

[[:Aleksej]]

Check Talkback TB24070516E.

Comment 5

[Martijn Wargers (dead)]

Yeah, this seems indeed a regression.

I tested with http://wargers.org/mozilla/bug346014/t.xml
I get the crash usually on reload.

On the 1.8.0.x branch, I get a regression window between 2006-05-25-06 and 2006-05-26-17.
On the 1.8.1 branch, I get a regression window between 2006-05-26-03 and 2006-05-28-03.

I guess/suspect this is somehow a regression from bug 319551.

Comment 6

[chris hofmann]

putting on the radar to keep an eye on for 1) changes in the talkback ranking, 2) a possible fix, and 3) inclusion  in fx2 if there are respins, or follow on releases.

still ranks at #10 this morning, but it is likely to move higher in the RC2 data when https://bugzilla.mozilla.org/show_bug.cgi?id=353227 fixes several crashes in the RC1 top 10 like [nsSubstring::IsDependentOn], [@ PL_DHashTableEnumerate] [@nsSubstring::Assign] [nsSubstring::Capacity]

Comment 7

[Boris Zbarsky [:bzbarsky]]

ccing people who might know about focus...  Is this crash happening on trunk?

Comment 8

[Martijn Wargers (dead)]

No, I can't reproduce this on trunk.

Comment 9

[chris hofmann]

ranking and frequency of this crash seems to have dropped in RC2.  wonder if its a result of some other fixes that went into rc2, or if folks are just staying away from the content and test cases that seem to have generated the crash in the past.

I'm having a hard time trying reproduce the crash with recent rc3 candidates.

Comment 10

[Daniel Veditz [:dveditz]]

removing topcrash since this dropped to #50 in FF2 and #79 on 1.8.0 branch. Would love a fix but not blocking 1.8.1.1

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Minusing for blocking1.9 based on comment 8.

Comment 12

[H. Montoliu]

This crash can be 100% reproduced on trunk and 1_8 debug builds by loading this url: 
http://www.kombirom.nl/online/get.asp?DBNAME=kombi&DBTYPE=txtifil&QRY=(1=home)&DBVERSION=200707&APPVERSION=200707&MACRO_SKIN=_20041001SKIN&DBNUM=51&TYPE=FRAMES

Notice that you'll need to change APPVERSION=200707 to 200708 next month and so on.

This problem is also tracked at Ubuntu's bug tracker  
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/110212

Comment 13

[Boris Zbarsky [:bzbarsky]]

Loading the URI in comment 12 doesn't crash a trunk debug build on Linux for me...

Comment 14

[Jesse Ruderman on Windows]

Up to comment 11, sounds like WFM on 2007-era trunk.  Comment 12 is probably a different bug, and that page no longer exists.  So overall, this bug is WFM.