359657 - [FIX]Firefox crashes on businessweek

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[jayram]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061105 Minefield/3.0a1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061105 Minefield/3.0a1

Open following link.Firefox crashes

http://www.businessweek.com/ap/financialnews/D8L7DQR80.htm


Reproducible: Always

Steps to Reproduce:
1.Click on http://www.businessweek.com/ap/financialnews/D8L7DQR80.htm
2. Crash
3.

Actual Results:  
Firefox crashes. No TB generated. Clean new profile.

Comment 1

[-fullmetaljacket-]

wfm trunk on vista rc2

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9a1) Gecko/20061105 Minefield/3.0a1 ID:2006110520 [cairo]

Comment 2

[Arie Paap [:wildmyron]]

Regression window on Windows XP SP1:

2006110304 works
2006110323 crash

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061103 Minefield/3.0a1 ID:2006110323 [cairo]

Using a clean install of current nightly (2006110504) and clean profile Talkback does not come up.

With my regular profile: TB25581007Z
A not very useful Stack Trace:
firefox.exe + 0x2f3c6a (0x006f3c6a)
firefox.exe + 0x367f55 (0x00767f55)

Comment 3

[Volkmar Kostka]

Seems to be related to a script on businessweek. Works if scripts are forbidden. If the scripts from Businessweek are allowed FF crashes. TB: TB25578961H (not very informative)

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061105 Minefield/3.0a1 ID:2006110504 [cairo]

Comment 4

[philippe (part-time)]

Crashed Camino trunk build as well. Apple crash log reports:
Thread 0 Crashed:
0   org.mozilla.camino       	0x005ba514 nsSubDocumentFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) + 228
Crashlog follows.

Comment 5

[philippe (part-time)]

Attachment: Apple crashlog

Comment 6

[Peter van der Woude [:Peter6]]

Martijn, can you check if a debug build produces a usefull stack ?

Comment 7

[Peter van der Woude [:Peter6]]

Correct regressionwindow:

works in firefox-3.0a1.en-US.win32_20061104_0142pdt build
fails in firefox-3.0a1.en-US.win32_20061104_0347pdt build

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&filetype=match&whotype=match&sortby=Date&hours=2&date=explicit&mindate=20061104+010000&maxdate=20061104+034700&cvsroot=%2Fcvsroot

(moz.org doesn't work so I can't point at a bug atm)

Comment 8

[Peter van der Woude [:Peter6]]

(In reply to comment #7)
> Correct regressionwindow:
> 
> works in firefox-3.0a1.en-US.win32_20061104_0142pdt build
> fails in firefox-3.0a1.en-US.win32_20061104_0347pdt build
> 
> http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&filetype=match&whotype=match&sortby=Date&hours=2&date=explicit&mindate=20061104+010000&maxdate=20061104+034700&cvsroot=%2Fcvsroot
> 
> (moz.org doesn't work so I can't point at a bug atm)
> 

Crap, I took the wrong builds

The correct regressionwindow is:

works in firefox-3.0a1.en-US.win32_20061103_1449pdt build
fails in firefox-3.0a1.en-US.win32_20061104_0142pdt build

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&filetype=match&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-11-03+14%3A00%3A00&maxdate=2006-11-04+01%3A42%3A00&cvsroot=%2Fcvsroot

Comment 9

[Peter van der Woude [:Peter6]]

Bug 343730 or Bug 318592 ?
Can you make anything out of this Boris ?

Comment 10

[Boris Zbarsky [:bzbarsky]]

I can't reproduce this with my debug builds on Linux (Firefox and Seamonkey both, pulled at MOZ_CO_DATE="Fri Nov 3 20:40:49 CST 2006").  So bug 318592 is probably not the problem...

I _can_ reproduce it with a slightly later build, though.  I get:

###!!! ASSERTION: Already have an undisplayed context entry for aContent: '!GetUndisplayedContent(aContent)', file ../../../mozilla/layout/base/nsFrameManager.cpp, line 580

and

###!!! ASSERTION: node in map twice: 'Not Reached', file ../../../mozilla/layout/base/nsFrameManager.cpp, line 1658

a bunch of times, then crash in nsSubDocumentFrame::Reflow because mInnerView is null.

Looking at the stack to that first assertion, the node in question (the one that already has an undisplayed content entry) is an HTMLScriptElement.  The general stack to the notification is (with some frames skipped):

PresShell::ContentAppended (aContainer is the body)
...
HTMLContentSink::NotifyAppend
SinkContext::FlushTags
HTMLContentSink::FlushPendingNotifications
nsHTMLDocument::FlushPendingNotifications
nsHTMLDocument::ResolveName
(script on the page)
nsScriptLoader::EvaluateScript
nsScriptLoader::ProcessRequest
...
nsScriptLoader::OnStreamComplete

So it looks like we're notifying twice on some content; doing that for <iframe>s is bad.

At a guess, this is a regression from bug 343730...

Comment 11

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Comment 12

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 244846 [details] [diff] [review]
Fix

Thanks man!

Comment 13

[Boris Zbarsky [:bzbarsky]]

It'd be wonderful to have a minimal-ish testcase here to add to the regression tests... I tried to create a testcase based on my understanding of the code and it doesn't crash...

Comment 14

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Checked in on request from bz

Comment 15

[Boris Zbarsky [:bzbarsky]]

Fixed.  Still great to have a testcase.  Even a non-minimal standalone one would be great; I can minimize it myself at that point...

Comment 16

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20061106 Minefield/3.0a1 ID:2006110621 [cairo]

VERIFIED/FIXED

thanks for the quick fix Boris

Comment 17

[Arie Paap [:wildmyron]]

Attachment: Javascript for testcase

Comment 18

[Arie Paap [:wildmyron]]

Attachment: testcase

I tried to include the javascript in the html file but I couldn't get that to work. I hope this is useful as it is.

Comment 19

[Boris Zbarsky [:bzbarsky]]

Attachment: Self-contained testcase using data: URL

Arie Paap, thank you for reducing this!

Comment 20

[Boris Zbarsky [:bzbarsky]]

Added that testcase to mochitest.