37619 - Crashes during load, before page displayed, specific URL

Status: VERIFIED DUPLICATE of bug 36558

(Core :: Layout, defect, P3)

Description

[Marc Loiselle]

From Bugzilla Helper:
User-Agent: Mozilla/4.7 [en] (X11; I; Linux 2.2.5-15 i586)
BuildID:    20000428009

Crashes during load on Linux and Windows 20000428 nightly build

Reproducible: Always
Steps to Reproduce:
1.Start mozilla
2.Type www.city.vancouver.bc.ca in address bar, press enter
3.crashes

Comment 1

[Ronald Tilby]

Above page loads correctly using M15-windows-talkback,
but crashes build 2000-04-28-08-windows-talkback

Comment 2

[Sean Richardson]

Crash confirmed with the 2000-04-28-08-M16 nightly binary on WinNT.
Mozilla displays only the <TITLE> before crashing.
Loads fine with NN 4.72; Page references /global.css, HTML otherwise looks OK
on casual inspection. Talkback Incident ID: TB9616612Z

Comment 3

[Chris Siebenmann]

 Confirmed on a recent Linux CVS pull. The stack backtrace I get under
gdb is:

(gdb) where
#0  0x0 in ?? ()
#1  0x40ae2c5c in nsLineBox::DeleteLineList ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#2  0x40ac18a7 in nsBlockFrame::Destroy ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#3  0x40abf57d in nsAreaFrame::Destroy ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#4  0x40ba7129 in nsComboboxControlFrame::Destroy ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#5  0x40ae2c68 in nsLineBox::DeleteLineList ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#6  0x40ac18a7 in nsBlockFrame::Destroy ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#7  0x40ac6419 in nsBlockFrame::DoRemoveFrame ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#8  0x40ac625e in nsBlockFrame::RemoveFrame ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#9  0x40baee58 in nsFormFrame::RemoveFrame ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#10 0x40ad1ef0 in FrameManager::RemoveFrame ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#11 0x40bef264 in nsCSSFrameConstructor::ContentRemoved ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
---Type <return> to continue, or q <return> to quit---
#12 0x40cc9227 in StyleSetImpl::ContentRemoved ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#13 0x40aeff99 in PresShell::ContentRemoved ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#14 0x40c9702e in nsDocument::ContentRemoved ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#15 0x40b96945 in nsHTMLDocument::ContentRemoved ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#16 0x40b08dbe in nsGenericHTMLContainerElement::RemoveChildAt ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#17 0x40b2ab2b in nsHTMLFormElement::RemoveChildAt ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#18 0x40b8ad07 in SinkContext::DemoteContainer ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#19 0x40b8d315 in HTMLContentSink::CloseForm ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#20 0x40db9dfb in CNavDTD::CloseForm ()
   from /scratch/mozilla/dist/bin/components/libraptorhtmlpars.so
#21 0x40dba49a in CNavDTD::CloseContainer ()
   from /scratch/mozilla/dist/bin/components/libraptorhtmlpars.so
#22 0x40db883d in CNavDTD::HandleEndToken ()
   from /scratch/mozilla/dist/bin/components/libraptorhtmlpars.so
#23 0x40db7282 in CNavDTD::HandleToken ()
---Type <return> to continue, or q <return> to quit---
   from /scratch/mozilla/dist/bin/components/libraptorhtmlpars.so
#24 0x40db6c81 in CNavDTD::BuildModel ()
   from /scratch/mozilla/dist/bin/components/libraptorhtmlpars.so
#25 0x40dc7c87 in nsParser::BuildModel ()
   from /scratch/mozilla/dist/bin/components/libraptorhtmlpars.so
#26 0x40dc7abc in nsParser::ResumeParse ()
   from /scratch/mozilla/dist/bin/components/libraptorhtmlpars.so
#27 0x40dc70c3 in nsParser::EnableParser ()
   from /scratch/mozilla/dist/bin/components/libraptorhtmlpars.so
#28 0x40bf6316 in CSSLoaderImpl::Cleanup ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#29 0x40bf662d in CSSLoaderImpl::SheetComplete ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#30 0x40bf676a in CSSLoaderImpl::ParseSheet ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#31 0x40bf68bf in CSSLoaderImpl::DidLoadStyle ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#32 0x40bf6157 in SheetLoadData::OnStreamComplete ()
   from /scratch/mozilla/dist/bin/components/libraptorhtml.so
#33 0x40847793 in nsStreamLoader::OnStopRequest ()
   from /scratch/mozilla/dist/bin/components/libnecko.so
#34 0x40d77777 in nsHTTPFinalListener::OnStopRequest ()
   from /scratch/mozilla/dist/bin/components/libnecko_http.so
---Type <return> to continue, or q <return> to quit---
#35 0x411ecdc9 in InterceptStreamListener::OnStopRequest ()
   from /scratch/mozilla/dist/bin/components/libnecko_cache.so
#36 0x40d725bc in nsHTTPChannel::ResponseCompleted ()
   from /scratch/mozilla/dist/bin/components/libnecko_http.so
#37 0x40d76c83 in nsHTTPServerListener::OnStopRequest ()
   from /scratch/mozilla/dist/bin/components/libnecko_http.so
#38 0x408364d1 in nsOnStopRequestEvent::HandleEvent ()
   from /scratch/mozilla/dist/bin/components/libnecko.so
#39 0x40835ef8 in nsStreamListenerEvent::HandlePLEvent ()
   from /scratch/mozilla/dist/bin/components/libnecko.so
#40 0x4010fd06 in PL_HandleEvent () from /scratch/mozilla/dist/bin/libxpcom.so
#41 0x4010fc36 in PL_ProcessPendingEvents ()
   from /scratch/mozilla/dist/bin/libxpcom.so
#42 0x401109da in nsEventQueueImpl::ProcessPendingEvents ()
   from /scratch/mozilla/dist/bin/libxpcom.so
#43 0x404d923e in event_processor_callback ()
   from /scratch/mozilla/dist/bin/libwidget_gtk.so
#44 0x404d8fe2 in our_gdk_io_invoke ()
   from /scratch/mozilla/dist/bin/libwidget_gtk.so
#45 0x40671aca in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0
#46 0x40673186 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#47 0x40673751 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#48 0x406738f1 in g_main_run () from /usr/lib/libglib-1.2.so.0
---Type <return> to continue, or q <return> to quit---
#49 0x4059b5b9 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#50 0x404d971d in nsAppShell::Run ()
   from /scratch/mozilla/dist/bin/libwidget_gtk.so
#51 0x403826dd in nsAppShellService::Run ()
   from /scratch/mozilla/dist/bin/components/libnsappshell.so
#52 0x804ae52 in main1 ()
#53 0x804b18e in main ()
#54 0x402449cb in __libc_start_main (main=0x804aff8 <main>, argc=2, 
    argv=0xbfffec34, init=0x8049014 <_init>, fini=0x804bce0 <_fini>, 
    rtld_fini=0x4000ae60 <_dl_fini>, stack_end=0xbfffec2c)
    at ../sysdeps/generic/libc-start.c:92

Comment 4

[Andreas Franke (gone)]

This stack trace is well-known, and the page in question contains select boxes.
See bug 37493 "<SELECT> crashes in nsLineBox::DeleteLineList (e.g. composer or 
www.starwars.com)", a dup of bug 36558 "[FIX]browser crashes when loading deja
search results".

*** This bug has been marked as a duplicate of 36558 ***

Comment 5

[Chris Petersen]

Marking verified dup of 36558.