Closed Bug 371125 Opened 17 years ago Closed 17 years ago

Crash [@ nsXBLBinding::InstallAnonymousContent] on branch with testcase from bug 371124

Categories

(Core :: XBL, defect)

1.8 Branch
x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 350754

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash)

Crash Data

The unminimised testcase from bug 371124 is crashing branch builds in a different way.

To reproduce the crash:
- Extract the zipped testcase
- Open file 'parentframe.htm'

It should crash fairly quickly with a branch build (within 5 seconds or so, I think).

Talkback ID: TB29506005X
nsXBLBinding::InstallAnonymousContent  [mozilla/content/xbl/src/nsXBLBinding.cpp, line 207]
nsXBLBinding::GenerateAnonymousContent  [mozilla/content/xbl/src/nsXBLBinding.cpp, line 522]
nsXBLService::LoadBindings  [mozilla/content/xbl/src/nsXBLService.cpp, line 630]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7791]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructTableCellFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3978]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6878]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ConstructTableForeignFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4072]
nsCSSFrameConstructor::TableProcessChild  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4252]
nsCSSFrameConstructor::TableProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4126]
nsCSSFrameConstructor::ConstructTableRowGroupFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3716]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6842]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ConstructTableForeignFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4072]
nsCSSFrameConstructor::TableProcessChild  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4252]
nsCSSFrameConstructor::TableProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4126]
nsCSSFrameConstructor::ConstructTableRowFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3827]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6870]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructTableCellFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3978]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6878]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ConstructTableForeignFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4072]
nsCSSFrameConstructor::TableProcessChild  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4252]
nsCSSFrameConstructor::TableProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4126]
nsCSSFrameConstructor::ConstructTableRowGroupFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3716]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6842]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line
Crash due to infinite stack recursion on Linux.
I think this is one of the "recursive binding" bugs we have fixed on trunk,
eg bug 55070, bug 350754, I think Boris also fixed a few similar ones.
(In reply to comment #1)
> Crash due to infinite stack recursion on Linux.
> I think this is one of the "recursive binding" bugs we have fixed on trunk,
> eg bug 55070, bug 350754, I think Boris also fixed a few similar ones.

Ah, right, of course. I guess this should just be marked a duplicate of one of those bugs, not?
This looks like a duplicate of one of those bugs to me.
Whiteboard: [sg:dupe?]
Yeah, I'm marking this a duplicate of bug 350754. No need to keep this security sensitive.
Group: security
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → DUPLICATE
Whiteboard: [sg:dupe?]
Crash Signature: [@ nsXBLBinding::InstallAnonymousContent]
You need to log in before you can comment on or make changes to this bug.