Closed Bug 36982 Opened 25 years ago Closed 25 years ago

(topcrash)(talkback)

Categories

(Core :: Layout, defect, P1)

Product:
Core
Component:
Layout
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED DUPLICATE of bug 36558

People

(Reporter: namachi, Assigned: buster)

References

(
URL
)

Details

(Keywords: crash, topcrash)

Attachments

(2 files)

minimized test case
197 bytes, text/html
Details
even smaller test case, no table involved
216 bytes, text/html
Details 
Accessing this URL crashes Netscape 6.

http://www.elkhart.lib.in.us/webpac-bin/wgbroker?new+-access+top.dynix

Stack Trace :

Incident ID 9212475
0x00000009
nsBlockFrame::QueryInterface 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1194]
nsLineBox::DeleteLineList 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineBox.cpp, line 252]
nsBlockFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1179]
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]
nsTableFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 251]
nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]
nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]
nsTableOuterFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 
63]
nsBlockFrame::DoRemoveFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5241]
nsBlockFrame::RemoveFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5142]
nsFormFrame::RemoveFrame 
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsFormFrame.cpp, line 360]
FrameManager::RemoveFrame 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 633]
nsCSSFrameConstructor::ContentRemoved 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 8799]
StyleSetImpl::ContentRemoved 
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1047]
PresShell::ContentRemoved 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2846]
nsDocument::ContentRemoved 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1721]
nsHTMLDocument::ContentRemoved 
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 
1154]
nsGenericHTMLContainerElement::RemoveChildAt 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 3158]
nsHTMLSelectElement::RemoveChildAt 
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLSelectElement.cpp, 
line 178]
SinkContext::DemoteContainer 
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, 
line 1586]
HTMLContentSink::CloseForm 
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, 
line 2826]
CNavDTD::CloseForm [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 
2692]
CNavDTD::CloseContainer [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, 
line 2956]
CNavDTD::HandleEndToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, 
line 1544]
CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, 
line 709]
CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, 
line 452]
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 1219]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 1104]
nsParser::OnDataAvailable 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1541]
Looks like block code
Assignee: troy → buster
Adding the keyword 'topcrash' and including URL
URL: http://www.elkhart.lib.in.us/webpac-b...
Keywords: topcrash
Severity: normal → critical
Status: NEW → ASSIGNED
Priority: P3 → P1
Target Milestone: --- → M16
Attached file minimized test case — 

    
    

    
  
Adding chofmann to cclist.

    
    

    
  
rod, I think this one might be yours.  Look at the test case I'm about to attach 
(the second test case.)  It's a select followed by a <p>, pretty simple stuff.
cc'd rickg and harish, because it seems wrong that we're calling DemoteContainer 
for this test case.  Could one of you pleaes verify that the parser and content 
sink are doing the right thing with this well-formed test case?

simplified stack:

nsLineBox::DeleteLineList() line 251
nsBlockFrame::Destroy() line 1177 + 16 bytes
nsAreaFrame::Destroy() line 70
nsComboboxControlFrame::Destroy() line 2260
nsBlockFrame::DoRemoveFrame() line 5240
nsBlockFrame::RemoveFrame() line 5138 + 16 bytes
nsFormFrame::RemoveFrame() line 360
FrameManager::RemoveFrame() line 633
nsCSSFrameConstructor::ContentRemoved() line 8793 + 63 bytes
StyleSetImpl::ContentRemoved() line 1047
PresShell::ContentRemoved() line 2746 + 50 bytes
nsDocument::ContentRemoved() line 1720
nsHTMLDocument::ContentRemoved() line 1154
nsGenericHTMLContainerElement::RemoveChildAt() line 3158
nsHTMLFormElement::RemoveChildAt() line 93 + 22 bytes
SinkContext::DemoteContainer() line 1576 + 18 bytes
HTMLContentSink::CloseForm() line 2824 + 18 bytes
CNavDTD::CloseForm() line 2687 + 31 bytes
CNavDTD::CloseContainer() line 2955 + 12 bytes
CNavDTD::HandleEndToken() line 1543 + 21 bytes
CNavDTD::HandleToken() line 712 + 12 bytes
CNavDTD::BuildModel() line 447 + 20 bytes
nsParser::BuildModel() line 1218 + 34 bytes
nsParser::ResumeParse() line 1102 + 11 bytes
nsParser::OnDataAvailable() line 1536 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable() line 269 + 46 bytes
nsFileChannel::OnDataAvailable() line 651 + 49 bytes
nsOnDataAvailableEvent::HandleEvent() line 406 + 47 bytes
nsStreamListenerEvent::HandlePLEvent() line 97 + 12 bytes
PL_HandleEvent() line 575 + 10 bytes
PL_ProcessPendingEvents() line 520 + 9 bytes


    
    

    
  


  

    
    

    
  
Adding crash keyword.
Keywords: crash

    
    

    
  
This is a dup of my bug. I will be checking in a fix tomorrow (hopefully).

*** This bug has been marked as a duplicate of 36558 ***
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → DUPLICATE

    
    

    
  
I guess I should have said I just tested it with my fix and it loaded fine.

    
    

    
  
Marking verified dup of 36558.

Status: RESOLVED → VERIFIED

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: