36451 - Crash at selecting menu View|Translate menu in this page

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P3)

Description

[Teruko Kobayashi]

When you want to translate this English page into Japanese, Netscape
will crash at selecting menu View|Translate menu.

Steps of reproduce
1. Go to above URL
2. Select menu View|Translate

Netscape will crash.

Talkback incident #9026464

 Thread ID:   
 Call Stack:    (Signature = nsHTMLInputElement::~nsHTMLInputElement 9cf4fe2d) 

 nsHTMLInputElement::~nsHTMLInputElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp, 
line 213]
  
 nsHTMLInputElement::`scalar deleting destructor' 

 nsHTMLInputElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLInputElement.cpp, 
line 258]
  
 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2819]
  
 nsHTMLTableRowElement::~nsHTMLTableRowElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, 
line 257]
  
 nsHTMLTableRowElement::`scalar deleting destructor' 
                                                                     
 nsHTMLTableRowElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableRowElement.cpp, 
line 261]
  
 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2819]
  
 nsHTMLTableSectionElement::~nsHTMLTableSectionElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c
pp, line 121]
  
 nsHTMLTableSectionElement::`scalar deleting destructor' 

 nsHTMLTableSectionElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableSectionElement.c
pp, line 125]
  
 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2819]
  
 nsHTMLTableElement::~nsHTMLTableElement 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, 
line 363]
  
 nsHTMLTableElement::`scalar deleting destructor' 
                                                                     
 nsHTMLTableElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, 
line 367]
  
 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2819]
  
 nsBodyInner::~nsBodyInner 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLBodyElement.cpp, line 
157]
  
 nsHTMLBodyElement::`scalar deleting destructor' 
                                                                     
 nsHTMLBodyElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLBodyElement.cpp, line 
661]
  
 nsGenericHTMLContainerElement::~nsGenericHTMLContainerElement
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 2819]
  
 nsHTMLHtmlElement::`scalar deleting destructor' 

 nsHTMLDivElement::Release 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLDivElement.cpp, line 
106]
  
 nsDocument::~nsDocument 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 674]
  
 nsHTMLDocument::~nsHTMLDocument 
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 
274]

 nsDocument::Release 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 803]
  
 nsHTMLDocument::Release 
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 
310]
  
 nsCOMPtr_base::~nsCOMPtr_base 
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 50]
  
 DocumentViewerImpl::`scalar deleting destructor' 
                                                                     
 nsCOMPtr_base::assign_with_AddRef 
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 59]
  
 nsWebShell::SetupNewViewer 
[d:\builds\seamonkey\mozilla\webshell\src\nsWebShell.cpp, line 581]

Tested 2000041909 Win32 build.

Comment 1

[troy]

Using today's build (that I just built myself) it doesn't crash when I view the 
translation

Comment 2

[troy]

Oops. Wait a minute. It did crash this time

Comment 3

[troy]

I crash and the debugger shows we're in JS code:

nsDestroyJSPrincipals(JSContext * 0x032194a8, JSPrincipals * 0x034a3dd8) line 45 
+ 30 bytes
js_DestroyScript(JSContext * 0x032194a8, JSScript * 0x034a8a50) line 782 + 53 
bytes
script_finalize(JSContext * 0x032194a8, JSObject * 0x0347e708) line 612 + 13 
bytes
js_FinalizeObject(JSContext * 0x032194a8, JSObject * 0x0347e708) line 1472 + 114 
bytes
js_GC(JSContext * 0x032194a8) line 898 + 11 bytes
js_ForceGC(JSContext * 0x032194a8) line 678 + 9 bytes
JS_GC(JSContext * 0x032194a8) line 1161 + 9 bytes
nsJSContext::GC(nsJSContext * const 0x03219430) line 947 + 13 bytes
nsDocShell::SetupNewViewer(nsDocShell * const 0x03506170, nsIContentViewer * 
0x03a716f8) line 2246
nsWebShell::SetupNewViewer(nsWebShell * const 0x03506170, nsIContentViewer * 
0x03a716f8) line 577 + 13 bytes
nsDocShell::CreateContentViewer(nsDocShell * const 0x03506170, const char * 
0x0012fa94, nsIChannel * 0x03b44a30, nsIStreamListener * * 0x0012fad4) line 2132 
+ 24 bytes
nsDSURIContentListener::DoContent(nsDSURIContentListener * const 0x03506758, 
const char * 0x0012fa94, int 0, const char * 0x10093f10 gCommonEmptyBuffer, 
nsIChannel * 0x03b44a30, nsIStreamListener * * 0x0012fad4, int * 0x0012fa78) 
line 100 + 33 bytes
nsDocumentOpenInfo::DispatchContent(nsIChannel * 0x03b44a30, nsISupports * 
0x00000000) line 407 + 109 bytes
nsDocumentOpenInfo::OnStartRequest(nsDocumentOpenInfo * const 0x034e87d0, 
nsIChannel * 0x03b44a30, nsISupports * 0x00000000) line 260 + 16 bytes
nsHTTPServerListener::FinishedResponseHeaders() line 975 + 48 bytes
nsHTTPServerListener::OnDataAvailable(nsHTTPServerListener * const 0x03599ab8, 
nsIChannel * 0x032ff1d4, nsISupports * 0x03b44a30, nsIInputStream * 0x03a65f74, 
unsigned int 27, unsigned int 0) line 345 + 8 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x034f88f8) 
line 406 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x03226b88) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x03226b88) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0122e218) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x001b032c, unsigned int 49414, unsigned int 0, 
long 19063320) line 1030 + 9 bytes
USER32! 77e13eb0()
USER32! 77e1401a()
USER32! 77e192da()
nsAppShellService::Run(nsAppShellService * const 0x011ceb28) line 366
main1(int 2, char * * 0x00b083c0, nsISplashScreen * 0x00000000) line 758 + 32 
bytes
main(int 2, char * * 0x00b083c0) line 968 + 17 bytes
mainCRTStartup() line 338 + 17 bytes

Comment 4

[leger]

Adding crash keyword.

Comment 5

[rogerl (gone)]

Tried debug build from 5/1, not seeing anything happen - at what point does the 
crash occur - after translating or before you even get to the GIST site?

Comment 6

[Phil Schwartau]

I cannot reproduce this bug, and am marking it "WorksForMe". I go to the given 
URL, click on View/Translate, and do not get a crash either on Linux or WinNT. 
Furthermore, I am able to use the translator to translate the page into German, 
Spanish, etc. 

Builds I am using: Mozilla debug Linux and Windows builds made on 05/30/00.
OS: Linux Red Hat 2.2.12-20smp   XTerm = XFree86 3.3.3.1b(88b)
OS: WinNT 4.0 (SP5)

Comment 7

[Andreas Franke (gone)]

When I try this with PC/Linux build 2000071108 (classic skin), the progress
meter goes to 50%, stays there, and after some time I get an Alert saying
"cgi.netscape.com could not be found. Please check the name and try again."
nslookup cgi.netscape.com works fine, however.

Comment 8

[Phil Schwartau]

Using  Mozilla tip builds 2000-07-14 1PM Pacific Time on WinNT, Linux.

Not sure what to do with this one. I tried View|Translate at the given site
several times on WinNT and Linux. Most of the time, I had no problems at 
all. The progress bar went all the way to 100%. Only occasionally did it get
"stuck", but this may have to do with network traffic more than anything else.

At any rate, the original bug: "Crash at selecting menu View|Translate menu in 
this page", is not occurring.

Changing component to Browser-General because these issues are not problems 
with the JS Engine. Andreas, what do you think? Should we verify this bug,
reopen it, or open a new bug ...? 

Comment 9

[Eric Hodel]

No crash selecting View | Translate for me
Verified WinNT 2000081704

Comment 10

[Eric Hodel]

*SPAM*
Forgot to mark verified

Comment 11

[Phil Schwartau]

Using Mozilla tip builds 2000-08-21  8PM Pacific Time on WinNT  
                         2000-08-21  1PM Pacific Time on Linux

Bug is now occurring again on WinNT, exactly as the reporter described ...
When I visit the given URL, do View |Translate, choose Japanese, and
click "Gist", I crash.

On Linux, I do not crash, but no translation takes place. Furthermore, the 
Translate page itself (where the "Gist" button is) is not rendering properly.

Comment 12

[Phil Schwartau]

Attachment: WinNT stack trace of crash -

Comment 13

[Phil Schwartau]

Do not see any JS Engine issues apparent in the stack trace. 
Reassigning to XP Apps: GUI Features for further triage -

Comment 14

[sairuh (rarely reading bugmail)]

i'm guessing that this either belongs in i18n/l10n, or the editor group (because
of the crash in nsHTMLInputElement)... over to mjudge for triage...

Comment 15

[Phil Schwartau]

Working for me OK now with Moz binaries BuildID 2000082313 on WinNT and Linux.
No crash with them; working perfectly. I have no idea what might have changed!

As a control, I kept the Mozilla debug build 2000-08-21 8PM PacificTime on WinNT. 
That build crashes when I click "Gist" -

Can someone else give it a try? Thanks -

Comment 16

[Teruko Kobayashi]

Rob, could you try this?

Comment 17

[Rob Spain]

tested on Mac with build 2000082320 works fine

Comment 18

[Phil Schwartau]

Resolving WorksForMe -

Comment 19

[Teruko Kobayashi]

Verified.

Comment 20

[Rob Spain]

close

Comment 21

[Rob Spain]

didn't take now closing

Comment 22

[sairuh (rarely reading bugmail)]

bugs should be left verified, not closed. we should only close when we've
shipped. i know this sounds confusing --see bug 31738 for details.

Comment 23

[sairuh (rarely reading bugmail)]

...re-resolving...

Comment 24

[sairuh (rarely reading bugmail)]

...and vrfy.

Comment 25

[Rob Spain]

changing QA to teruko