The default bug view has changed. See this FAQ.

Crash [@ nsXBLBinding::InstallAnonymousContent] on branch with testcase from bug 371124

RESOLVED DUPLICATE of bug 350754

Status

()

Core
XBL
--
critical
RESOLVED DUPLICATE of bug 350754
10 years ago
10 years ago

People

(Reporter: Martijn Wargers (dead), Unassigned)

Tracking

(Blocks: 1 bug, {crash})

1.8 Branch
x86
Windows XP
crash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

10 years ago
The unminimised testcase from bug 371124 is crashing branch builds in a different way.

To reproduce the crash:
- Extract the zipped testcase
- Open file 'parentframe.htm'

It should crash fairly quickly with a branch build (within 5 seconds or so, I think).

Talkback ID: TB29506005X
nsXBLBinding::InstallAnonymousContent  [mozilla/content/xbl/src/nsXBLBinding.cpp, line 207]
nsXBLBinding::GenerateAnonymousContent  [mozilla/content/xbl/src/nsXBLBinding.cpp, line 522]
nsXBLService::LoadBindings  [mozilla/content/xbl/src/nsXBLService.cpp, line 630]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7791]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructTableCellFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3978]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6878]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ConstructTableForeignFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4072]
nsCSSFrameConstructor::TableProcessChild  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4252]
nsCSSFrameConstructor::TableProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4126]
nsCSSFrameConstructor::ConstructTableRowGroupFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3716]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6842]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ConstructTableForeignFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4072]
nsCSSFrameConstructor::TableProcessChild  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4252]
nsCSSFrameConstructor::TableProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4126]
nsCSSFrameConstructor::ConstructTableRowFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3827]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6870]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructTableCellFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3978]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6878]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6891]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ConstructTableForeignFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4072]
nsCSSFrameConstructor::TableProcessChild  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4252]
nsCSSFrameConstructor::TableProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4126]
nsCSSFrameConstructor::ConstructTableRowGroupFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3716]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6842]
nsCSSFrameConstructor::ConstructFrameInternal  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7748]
nsCSSFrameConstructor::ProcessChildren  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12186]
nsCSSFrameConstructor::ConstructBlock  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13246]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line

Comment 1

10 years ago
Crash due to infinite stack recursion on Linux.
I think this is one of the "recursive binding" bugs we have fixed on trunk,
eg bug 55070, bug 350754, I think Boris also fixed a few similar ones.
(Reporter)

Comment 2

10 years ago
(In reply to comment #1)
> Crash due to infinite stack recursion on Linux.
> I think this is one of the "recursive binding" bugs we have fixed on trunk,
> eg bug 55070, bug 350754, I think Boris also fixed a few similar ones.

Ah, right, of course. I guess this should just be marked a duplicate of one of those bugs, not?
This looks like a duplicate of one of those bugs to me.
Whiteboard: [sg:dupe?]
(Reporter)

Comment 4

10 years ago
Yeah, I'm marking this a duplicate of bug 350754. No need to keep this security sensitive.
Group: security
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → DUPLICATE
Whiteboard: [sg:dupe?]
Duplicate of bug: 350754
Crash Signature: [@ nsXBLBinding::InstallAnonymousContent]
You need to log in before you can comment on or make changes to this bug.