36608 - Crash if I type http://www.justin.org into navbar.

Status: VERIFIED DUPLICATE of bug 36558

(Core :: Layout, defect, P3)

Description

[Will Sargent]

From Bugzilla Helper:
User-Agent: Mozilla/4.7 [en] (WinNT; U)
BuildID:    2000030708

If I type www.justin.org into the browser, browser will crash.  It appears to be 
a layout bug, but I'm not sure what happened with the 00000()... could be a 
stack smash.

Reproducible: Always
Steps to Reproduce:
1. Type in http://www.justin.org.
2. Hit the enter key.
3.

Actual Results:  crash.

Expected Results:  not crash.

00000000()
nsLineBox::DeleteLineList(nsIPresContext * 0x03f656c0, nsLineBox * 0x02137880) 
line 251
nsBlockFrame::Destroy(nsBlockFrame * const 0x020d0b8c, nsIPresContext * 
0x03f656c0) line 1177 + 16 bytes
nsAreaFrame::Destroy(nsAreaFrame * const 0x020d0b8c, nsIPresContext * 
0x03f656c0) line 70
nsComboboxControlFrame::Destroy(nsComboboxControlFrame * const 0x020d0b8c, 
nsIPresContext * 0x03f656c0) line 2260
nsFrameList::DestroyFrames(nsIPresContext * 0x03f656c0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x020d0968, nsIPresContext * 
0x03f656c0) line 98
nsBlockFrame::DoRemoveFrame(nsIPresContext * 0x03f656c0, nsIFrame * 0x020d0968) 
line 5240
nsBlockFrame::RemoveFrame(nsBlockFrame * const 0x020d08f4, nsIPresContext * 
0x03f656c0, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x020d0968) 
line 5138 + 16 bytes
nsFormFrame::RemoveFrame(nsFormFrame * const 0x020d08f4, nsIPresContext * 
0x03f656c0, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x020d0968) 
line 360
FrameManager::RemoveFrame(FrameManager * const 0x03fede70, nsIPresContext * 
0x03f656c0, nsIPresShell & {...}, nsIFrame * 0x020d08f4, nsIAtom * 0x00000000, 
nsIFrame * 0x020d0968) line 633
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x03fe29c0, 
nsIPresContext * 0x03f656c0, nsIContent * 0x0418d6ac, nsIContent * 0x0418d3b8, 
int 0) line 8793 + 63 bytes
StyleSetImpl::ContentRemoved(StyleSetImpl * const 0x03fe2a80, nsIPresContext * 
0x03f656c0, nsIContent * 0x0418d6ac, nsIContent * 0x0418d3b8, int 0) line 1047
PresShell::ContentRemoved(PresShell * const 0x03fead98, nsIDocument * 
0x03f5ba20, nsIContent * 0x0418d6ac, nsIContent * 0x0418d3b8, int 0) line 2746 + 
50 bytes
nsDocument::ContentRemoved(nsDocument * const 0x03f5ba20, nsIContent * 
0x0418d6ac, nsIContent * 0x0418d3b8, int 0) line 1720
nsHTMLDocument::ContentRemoved(nsHTMLDocument * const 0x03f5ba20, nsIContent * 
0x0418d6ac, nsIContent * 0x0418d3b8, int 0) line 1154
nsGenericHTMLContainerElement::RemoveChildAt(int 0, int 1) line 3158
nsHTMLFormElement::RemoveChildAt(nsHTMLFormElement * const 0x0418d6ac, int 0, 
int 1) line 93 + 22 bytes
SinkContext::DemoteContainer(const nsIParserNode & {...}) line 1583 + 18 bytes
HTMLContentSink::CloseForm(HTMLContentSink * const 0x03f4c790, const 
nsIParserNode & {...}) line 2824 + 18 bytes
CNavDTD::CloseForm(const nsIParserNode * 0x0012f7e4) line 2687 + 31 bytes
CNavDTD::CloseContainer(const nsIParserNode * 0x0012f7e4, nsHTMLTag 
eHTMLTag_form, int 0) line 2955 + 12 bytes
CNavDTD::HandleEndToken(CToken * 0x02b5bdb0) line 1543 + 21 bytes
CNavDTD::HandleToken(CNavDTD * const 0x03fecd10, CToken * 0x02b5bdb0, nsIParser 
* 0x03f5e8f0) line 712 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x03fecd10, nsIParser * 0x03f5e8f0, 
nsITokenizer * 0x03fe91c0, nsITokenObserver * 0x00000000, nsIContentSink * 
0x03f4c790) line 447 + 20 bytes
nsParser::BuildModel() line 1218 + 34 bytes
nsParser::ResumeParse(int 1, int 0) line 1102 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x03f5e8f4, nsIChannel * 0x03f62510, 
nsISupports * 0x00000000, nsIInputStream * 0x03f6d234, unsigned int 0, unsigned 
int 4096) line 1536 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x03f62840, 
nsIChannel * 0x03f62510, nsISupports * 0x00000000, nsIInputStream * 0x03f6d234, 
unsigned int 0, unsigned int 4096) line 269 + 46 bytes
InterceptStreamListener::OnDataAvailable(InterceptStreamListener * const 
0x03f6d230, nsIChannel * 0x03f62510, nsISupports * 0x00000000, nsIInputStream * 
0x03feb130, unsigned int 0, unsigned int 4096) line 1164
nsHTTPChunkConv::OnDataAvailable(nsHTTPChunkConv * const 0x03fecfb0, nsIChannel 
* 0x03f62510, nsISupports * 0x00000000, nsIInputStream * 0x03f71dbc, unsigned 
int 0, unsigned int 1266) line 195 + 46 bytes
nsHTTPServerListener::OnDataAvailable(nsHTTPServerListener * const 0x03f700d0, 
nsIChannel * 0x03f693b4, nsISupports * 0x03f62510, nsIInputStream * 0x03f71dbc, 
unsigned int 0, unsigned int 1266) line 477 + 67 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x03f67b70) 
line 406 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x03f655f0) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x03f655f0) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010779d0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x006d02b2, unsigned int 49489, unsigned int 0, 
long 17267152) line 1030 + 9 bytes
USER32! 77e71820()
010779d0()

Comment 1

[Andreas Franke (gone)]

Doesn't crash for me on PC/Linux with M15. M14 doesn't seem to finish loading,
but it doesn't crash. However, the page takes a long time to load, and during
that time the UI freezes (at least for very long intervals). In this respect,
the behaviour is similar to bug 35762.

[e-mail]: Can you test if it still crashes with a newer build?

Comment 2

[Kevin Hecht]

Even on today's 2000042008 build on NT, this site crashes me. Confirming bug; 
interesting that it didn't crash the very recent M15.

Comment 3

[troy]

This is the same problem as bug 36558. Same call stack

*** This bug has been marked as a duplicate of 36558 ***

Comment 4

[Chris Petersen]

Marking verified dup of 36558.