<SELECT> crashes in nsLineBox::DeleteLineList (e.g. composer or www.starwars.com)

VERIFIED DUPLICATE of bug 36558

Status

()

P3
critical
VERIFIED DUPLICATE of bug 36558
19 years ago
7 years ago

People

(Reporter: tarkin, Assigned: troy)

Tracking

({crash, testcase})

Trunk
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(5 attachments)

(Reporter)

Description

19 years ago
nightly build of 27 april,

crash when going to http://www.starwars.com

Comment 1

19 years ago
crashes for me as well - here's the strace :)

.//run-mozilla.sh: line 29:  9241 Segmentation fault      $prog ${1+"$@"}
[WIFEXITED(s) && WEXITSTATUS(s) == 0], 0, NULL) = 9236
rt_sigprocmask(SIG_BLOCK, [CHLD TTOU], [CHLD], 8) = 0
rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [CHLD], 8) = 0
rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGCHLD (Child exited) ---
wait4(-1, 0xbffff4e0, WNOHANG, NULL)    = -1 ECHILD (No child processes)
sigreturn()                             = ? (mask now [])
rt_sigaction(SIGINT, {SIG_DFL}, {0x806c2e0, [], 0x4000000}, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, [CHLD TTOU], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
read(3, "", 37)                         = 0
munmap(0x40015000, 4096)                = 0
_exit(0)                                = ?

Comment 2

19 years ago
crash kw
Keywords: crash

Comment 3

19 years ago
I can reproduce that this on PC/Linux with build 2000042809.
Going to attach the stack trace.

Should be a duplicate of a bug I recently touched. Will search for it.

Comment 4

19 years ago
Created attachment 8095 [details]
backtrace PC/Linux, build 2000042809

Comment 5

19 years ago
Using the 2000042809 build, the first 6 entries on the stack are exactly the
same as with http://bugzilla.mozilla.org/showattachment.cgi?attach_id=7998
as a testcase (see bug 36902).

Comment 6

19 years ago
A better stacktrace shows that this crash is in nsLineBox::DeleteLineList.
Changing summary to indicate this.
Summary: crash when going to http://www.starwars.com → http://www.starwars.com crashes in nsLineBox::DeleteLineList

Comment 7

19 years ago
Created attachment 8103 [details]
Better backtrace (including function symbols)

Updated

19 years ago
Assignee: asadotzler → troy
Status: UNCONFIRMED → NEW
Component: Browser-General → Layout
Ever confirmed: true
QA Contact: jelwell → petersen

Comment 8

19 years ago
updating component and owner. changing status to New.

Comment 9

19 years ago
Created attachment 8123 [details]
testcase 1, from www.starwars.com
The test case attached above is
<table>
  <tr>
    <td><form><nobr><select/></form></td>
  </tr>
</table>

Note that the crash goes away if you insert a space character
between <td> and <form>.
Created attachment 8124 [details]
testcase 2, from bug 36902
Testcase 2 looks like this:
Foo
<span><p></span>
<table>
  <tr>
    <td> 
      <form> 
        <select>
          <option>foo
        </select>
      </form>
    </td>
  </tr>
  <img src="nonexisting" alt="">
</table>

The following part of the stack trace is common to both testcases:
#0  0x0 in ?? ()
#1  0x40ae4b9c in nsLineBox::DeleteLineList ()
   from /build/dist/bin/components/libraptorhtml.so
#2  0x40ac4a93 in nsBlockFrame::Destroy ()
   from /build/dist/bin/components/libraptorhtml.so
#3  0x40ac289e in nsAreaFrame::Destroy ()
   from /build/dist/bin/components/libraptorhtml.so
#4  0x40b97017 in nsComboboxControlFrame::Destroy ()
   from /build/dist/bin/components/libraptorhtml.so
*** Bug 36916 has been marked as a duplicate of this bug. ***
Created attachment 8126 [details]
testcase 3, from bug 36916: load this in composer to crash
Changing Platform/OS to All since bug 36916 has been seen on Mac.
Changing summary to include <SELECT>.
Testcase 3 (from there) says that every page containing a <SELECT> element
crashes mozilla when loaded into composer:
<form>
  <select />
</form>

Note:
testcase 1 crashes since 2000041816 (doesn't crash in 2000041609),
testcase 2 crashes since 2000042113 (doesn't crash in 2000041816), 
testcase 3 crashes already in M15.
http://www.starwars.com behaves like testcase 2 in this respect,
although testcase 1 is the one derived from it....
Keywords: testcase
OS: Linux → All
Hardware: PC → All
Summary: http://www.starwars.com crashes in nsLineBox::DeleteLineList → <SELECT> crashes in nsLineBox::DeleteLineList (e.g. composer or www.starwars.com)

*** This bug has been marked as a duplicate of 36558 ***
Status: NEW → RESOLVED
Last Resolved: 19 years ago
Resolution: --- → DUPLICATE

Comment 17

19 years ago
*** Bug 37821 has been marked as a duplicate of this bug. ***

Comment 18

19 years ago
oops; should have dup'ed against #36558 which is assigned to rods

Comment 19

18 years ago
Marking verified dup of 36558.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.