Last Comment Bug 482578 - top crash [@ nsSubDocumentFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&)]
: top crash [@ nsSubDocumentFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&,...
[sg:critical?] at risk
: crash, fixed1.9.0.12, fixed1.9.1.1, regression, topcrash
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla1.9.2a1
Assigned To: Olli Pettay [:smaug]
: Andrew Overholt [:overholt]
: 469366 491498 (view as bug list)
Depends on: 469366 506349
Blocks: 466057 509132
  Show dependency treegraph
Reported: 2009-03-10 12:12 PDT by john senchak
Modified: 2015-10-16 11:37 PDT (History)
23 users (show)
samuel.sidler+old: blocking1.9.1.1+
samuel.sidler+old: blocking1.9.0.12+
samuel.sidler+old: wanted1.9.0.x+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Stacks for the assertions in comment 4 (29.71 KB, text/plain)
2009-03-11 11:12 PDT, Mats Palmgren (:mats)
no flags Details
Crash stack, 1.9.0 debug on MacOSX (14.96 KB, text/plain)
2009-03-11 18:34 PDT, Mats Palmgren (:mats)
no flags Details
log + stacks (mozilla-central OSX, content/base/ mochitests) (123.65 KB, text/html)
2009-03-17 17:29 PDT, Mats Palmgren (:mats)
no flags Details
WIP, fixes the mochitest problem as described in comment 30 (diff -w) (1.53 KB, patch)
2009-03-18 21:35 PDT, Mats Palmgren (:mats)
no flags Details | Diff | Splinter Review
Trunk stack (same in 1.9.0) for existing frame in ContentAppended with STR in comment 17 ( (11.84 KB, text/plain)
2009-03-18 21:40 PDT, Mats Palmgren (:mats)
no flags Details
possible patch (16.45 KB, patch)
2009-06-25 07:26 PDT, Olli Pettay [:smaug]
no flags Details | Diff | Splinter Review
a stack (16.45 KB, patch)
2009-06-25 07:27 PDT, Olli Pettay [:smaug]
no flags Details | Diff | Splinter Review
a stack (7.83 KB, text/plain)
2009-06-25 07:29 PDT, Olli Pettay [:smaug]
no flags Details
+comments (15.87 KB, patch)
2009-06-25 14:03 PDT, Olli Pettay [:smaug]
bzbarsky: review+
jonas: superreview+
samuel.sidler+old: approval1.9.1.1+
dveditz: approval1.9.0.12+
Details | Diff | Splinter Review
for trunk (15.77 KB, text/plain)
2009-06-25 14:19 PDT, Olli Pettay [:smaug]
no flags Details
1.9.1 (15.69 KB, patch)
2009-07-14 03:20 PDT, Olli Pettay [:smaug]
no flags Details | Diff | Splinter Review

Description john senchak 2009-03-10 12:12:33 PDT
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/2009021910 Firefox/3.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/2009021910 Firefox/3.0.7

(source code of page)

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "">
<html xmlns="">
	         <title>Is IE8 the end of the line for Internet Explorer? |Enterprise Desktop | Randall C. Kennedy | InfoWorld </title>
		<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
		<meta name="date" content="2009-03-10T03:00:00-08:00"/>
<meta name="description" content="Dropping IE in favor of a newer rendering engine may be not be as easy as it seems" />
		<style media="all" type="text/css">@import "/script/css/blog.css";</style>
		<link rel="alternate" type="application/rss+xml" title="RSS" href="" />
		<link rel="EditURI" type="application/rsd+xml" title="RSD" href="" />
		<script language="javascript">
			var dcSite = "weblog";
			var dcZone = "/enterprisedesktop/";
			var section = "weblog";
		<script type="text/javascript" src=""></script>
<script src="" type="text/javascript"></script>
<script src="" type="text/javascript"></script>
<script language="JavaScript" src=""></script>
<script language="JavaScript" src=""></script>

		<script language="javascript">
			//Omniture Config
			var catType = 'individual';
			var date = '2009-03-10';
			var author='By Randall C. Kennedy';
			var blogName = 'Enterprise Desktop | Randall C. Kennedy'; //blogName
			var category = 'MicrosoftMicrosoftMicrosoftMicrosoftMicrosoftMicrosoft'; //this might not be needed
			var title = 'Is IE8 the end of the line for Internet Explorer?';
		<script language="JavaScript" src="/script/omniture/weblog.js"></script>

<script type="text/javascript">
s.pageName = s.pageName.replace(new RegExp("[^\x20-\x7E]",'g')," ");

if(typeof(pkeys) != 'undefined') {
	if(pkeys.length > 0) {
	        if( == 0)"event12";
/************* DO NOT ALTER ANYTHING BELOW THIS LINE ! **************/
var s_code=s.t();if(s_code)document.write(s_code)//--></script>
<script type="text/javascript"><!--
//--></script><!--/DO NOT REMOVE/-->

<script language="JavaScript">
        function omnitureTrackClick(moduleName,title, obj) {
        s.prop27 = "LG article slot one - " + moduleName;
	s.prop30 = s.pageName;
        if(moduleName =='article_leadgen_top') {

		<div id="container">
			<div id="page">
				<div class="header">
	<div style="display:none">	

<script language="JavaScript" type="text/javascript">
var ord=Math.random()*10000000000000000;

<!-- IFW 1x1 TRACKING -->
<img src=";sz=1x1;ord=485711100309?" border="0" height="1" width="1"/>

<!-- PEEL AD (tile=14) -->
<script language="JavaScript" type="text/javascript">
        document.write('<script language="JavaScript" src=";pos=peelback;tile=14;dcopt=ist;sz=1x1;ord=' + ord + '?" type="text/javascript"><\/script>');
        <a href=";pos=peelback;tile=14;sz=1x1;ord=485711100309?" target="_blank">
                <img src=";pos=peelback;tile=14;sz=1x1;ord=485711100309?" width="1" height="1" border="0" alt="">

<!-- PRESTITIAL AD (tile=15) -->
<script language="JavaScript" type="text/javascript">
        document.write('<script language="JavaScript" src=";pos=interstitial;tile=15;dcopt=ist;sz=1x1;ord=' + ord + '?" type="text/javascript"><\/script>');
        <a href=";pos=interstitial;tile=15;sz=1x1;ord=485711100309?" target="_blank">
                <img src=";pos=interstitial;tile=15;sz=1x1;ord=485711100309?" width="1" height="1" border="0" alt="">

	</div><!--end div display:none-->
	<div class="f-left" href="#">	
		<!-- begin ad tag  (728x90) -->
  <A HREF=";pos=leader;tile=1;sz=728x90;ord=123456789?" TARGET="_blank">
  <IMG SRC=";pos=leader;tile=1;sz=728x90;ord=123456789?" WIDTH="728" HEIGHT="90" BORDER="0" ALT=""></A>
<!-- End ad tag -->

	<!-- NL BOX -->
		<div class="news f-right">
		<p>Free Newsletters</p>
		<form action="" method="get" style="padding:0px; margin:0px">
			<div class="news-form">
				<label><input type="checkbox" class="check" value="infoworld_todays_headlines" id="list[]" name="list[]" />Today's Headline</label>
				<span style="float: left;"><input type="text" class="text" name="email[]" value="Enter Email Address" onFocus="this.value=''" />&nbsp;&nbsp;<input type="submit" value="Submit" class="blackVrdMed" valign="top" style="font-size: 11px;" /></span>
<!--<input type="checkbox" class="check" name="freeNLTP" id="freeNLTP" CHECKED /> &nbsp;&nbsp; <label><a href="" target="_blank">Terms of Service</a> and <a href="" target="_blank">Privacy Policy</a></label>-->
			</div><!--end div news-form-->
	</div><!--end div news f-left-->

</div><!--end div header-->

<div class="header_bg">
	<!-- LOGIN/SEARCH -->
		<div class="long-box">
		<a class="mainlogo f-left" href="">Infoworld</a>

		<div class="login">
		</div><!--end div login-->

		<br />
		<form name="ultraseek" action="" accept-charset="iso-8859-1" class="searchbox" size="16" method="GET">
			<div class="search f-right">
				<input type="text"  name="qt" id="search" size="25" value="" maxlength="1991" class="text" />
				<input type="image" src="" title="Search" class="button" />
			</div><!--end div search f-right-->
	</div><!--end div long-box-->

	<!-- NAV MENU -->
		<ul class="menu" id="navigation">
	<li class="nodrop">
	<a href="" class="home">HOME</a>   
	<a href="">NEWS</a>
	<li><a href="">Today's Headlines</a></li>
	<li><a href="">InfoWorld Daily</a></li>
	<li><a href="">Special Reports</a></li>
	<li><a href="">Newsletters</a></li>
	<a href="">TEST CENTER</a>
	<li><a href="">Latest Reviews</a></li>
	<li><a href="">Review Finder</a></li>
	<li><a href="">Top Rated Products</a></li>
	<li><a href="">Test Center Daily Blog</a></li>
	<a href="">TECHNOLOGIES</a>
	<li><a href="">App Dev</a></li>
	<li><a href="">Applications</a></li>
	<li><a href="">Data Protection</a></li>
	<li><a href="">Green Tech</a></li>
    <li><a href="">Hardware</a></li>
	<li><a href="">Networking</a></li>
    <li><a href="">Mobile</a></li>
	<li><a href="">Open Source</a></li>
    <li><a href="">Security</a></li>
	<li><a href="">SOA</a></li>
	<li><a href="">Storage</a></li>
	<li><a href="">Virtualization</a></li>    
	<a href="">BLOGS</a>
	<li><a href="">Cringely: Notes from the Field</a></li>
	<li><a href="">Grimes: Security Adviser</a></li>
	<li><a href="">Heller: Strategic Developer</a></li>
	<li><a href="">Kennedy: Enterprise Desktop</a></li>
	<li><a href="">Lewis: Advice Line</a></li>
	<li><a href="">McAllister: Fatal Exception</a></li>
	<li><a href="">Rodrigues & Urlocker: Open Sources</a></li>
	<li><a href="">Samson: Sustainable IT</a></li>
	<li><a href="">Schwartz: Reality Check</a></li>
	<li><a href="">Tynan-Wood: Gripe Line</a></li>
	<li><a href="">Venezia: The Deep End</a></li>
        <li><a href="">whurley: Cloud Computing</a></li>
    <li><a href="">Yager: Ahead of the Curve</a></li>
	<li><a href="">All InfoWorld Blogs</a></li>

		<a href="">AUDIO/VIDEO</a>
			<li><a href="">Video</a></li>
		    <li><a href="">Webcasts</a></li>
		    <li><a href="">Slideshows</a></li>
			<li class="third"><a href="">Podcasts</a>
					<li><a href="">InfoWorld Daily</a></li>
					<li><a href="">Real World SOA</a></li>
					<li><a href="">SMB IT</a></li>
					<li><a href="">The Storage Network</a></li>
					<li><a href="">Virtualization Report</a></li>
		<a href="">EVENTS&nbsp;&nbsp;</a>
			<li class="third">
				<a href="">Virtual Conferences</a>
						<a href=";F:QS!10100&ShowKey=1418">Cloud Computing</a>
						<a href="">Enterprise Architecture</a>
						<a href="">Security Directions</a>
						<a href="">Virtualization Directions</a>
			<li class="third">
				<a href="">New Economics of IT</a>
						<a href="">Miami, FL</a>
						<a href="">Dallas, TX</a>
						<a href="">Chicago, IL</a>
						<a href="">Washington, DC</a>
						<a href="">See all events</a>
				<a href="">OSBC&nbsp;&nbsp;</a>
				<a href="">Virtualization Executive Forum</a>
		    	<a href="">Complete Events Calendar</a>
			<!-- <li>
				<a href="">Enterprise Architecture Sep 08</a>
				<a href="">Virtualization Directions Oct 08</a>
				<a href="">Virtualization Exec Forum Nov 08</a>
		    	<a href="">Security Directions Dec 08</a>
		    	<a href="">InfoWorld Technology Summits</a>
		    	<a href="">Complete Events Calendar</a>
		    </li> -->
	<a href="">AWARDS</a>
	<li><a href="">InfoWorld 100</a></li>
	<li><a href="">CTO-25</a></li>
	<li><a href="">Technology of the Year</a></li>
	<li><a href="">Bossies</a></li>
	<li><a href="">Green 15</a></li>
	<li class="nodrop">
	<a href="">NEWSLETTERS</a>
	<li >
	<a href="">RESOURCES</a>
	<li><a href="">IT Resource Guides</a></li>
	<li><a href="">Spotlights</a></li>
	<li><a href="">Webcasts</a></li>
	<li><a href="">White Papers</a></li>
	<li><a href="">Windows Sentinel</a></li>
	<li class="nodrop">
	<a href="">IT JOBS</a>
	<li class="last nodrop">
	<a href="">RSS</a>

</div><!--end div header-bg-->	

<div class="content">
	<!-- LEFT COLUMN -->
	<div class="left-box f-left">
		<div class="lhc_items">MORE ENTRIES</div>
		<div class="bloghed">
									<li><a href="">Is IE8 the end of the line for Internet Explorer?</a></li>
									<li><a href="">App-V 4.6: Too little, too late?</a></li>
									<li><a href="">Windows 7: The compatibility blame game</a></li>
									<li><a href="">Windows 7: Cutting corners in the rush to market?</a></li>
									<li><a href="">Would VDI please just go away?</a></li>
									<li><a href="">Windows 7: Is it so hard to say "we're sorry"?</a></li>
									<li><a href="">Windows 7: Poking holes in Vista's UAC umbrella</a></li>
									<li><a href="">APP-V, MED-V, and missed opportunities</a></li>
									<li><a href="">Whither Windows Vista?</a></li>
									<li><a href="">Windows 7 beta: Unresolved problems</a></li>

		<div class="ad" align="center">
			<!-- begin ad tag  (160x600) -->
  <A HREF=";pos=skyscraper;tile=12;sz=160x600;ord=123456789?" TARGET="_blank">
  <IMG SRC=";pos=skyscraper;tile=12;sz=160x600;ord=123456789?" WIDTH="160" HEIGHT="600" BORDER="0" ALT=""></A>
<!-- End ad tag -->
	</div><!--end div left-box f-left-->

	<div class="right f-right">

		<!-- MIDDLE COLUMN -->
		<div class="sub-left f-left">

			<div id="oneClickTop">

			<!-- HEADER / TOP TOOL KITS -->

			<div><a href=""><img src="/enterprisedesktop/header.jpg" /></a></div>
			<div class="blogoptions">			<ul>
				<li><a href=""><img src="" border="0" alt="RSS subscription" align="absmiddle"></a></li>
				<li><a href="">Subscribe</a></li>
				<li><a href=""><img src="" alt="E-mail" border="0" align="absmiddle" hspace="3"></a></li>
				<li><a href="">Email</a></li>
				<li><a href=""><img src="" alt="Print This" border="0"  align="absmiddle" hspace="3"></a></li>
				<li><a href="">Print</a></li>
				<li><a href="/enterprisedesktop/about.html">Read Randall's Bio
				<li><a href="mailto:randall_kennedy&#64;infoworld&#46;com" class="realsmall">Contact Randall Kennedy</a>
			</div><!--end div blogoptions-->			

			<div class="yellow">
                                <!-- BC Player-->

				<!-- BREADCRUMBS -->
				<a href="" class="breadcrumb">Enterprise Desktop | Randall C. Kennedy&nbsp;&raquo;</a> 
				Is IE8 the end of the line for Internet Explorer?
				<!-- JS KIT -->
					March 10, 2009&nbsp;|&nbsp;<a href="#postAComment">Comments:&nbsp;(<span class="js-kit-comments-count" path="/enterprisedesktop/21160">0</span>)</a>
					<div class="js-kit-rating" view="combo" permalink="" freeze="yes" style="width: 110px; float:right; *margin-top: 10px; padding: 30px 0px 20px 20px; background-image: url(;"></div>

					<!-- BLOG HEADLINE -->
					<h1 class="dek">Is IE8 the end of the line for Internet Explorer?</h1>

                    <!--  Dek  -->
                    <h2 class="dek2">Dropping IE in favor of a newer rendering engine may be not be as easy as it seems</h2>

					<p class="breadcrumb">
						TAGS: <a href=" Computing">Cloud Computing</a>, <a href="">Microsoft</a>, <a href="">Productivity</a>, <a href=" 7">Windows 7</a>, <a href=" Vista">Windows Vista</a>, <a href=" XP">Windows XP</a><br /></p>

				<!-- BLOG BODY -->
				<div class="post">
				<p>IE8 is the last version of the Internet Explorer Web browser. At least, that's what I'm hearing through the grapevine. It seems that Microsoft is preparing to throw in the towel on its Internet Explorer engine once and for all.</p>
<p>And just what will be its replacement? I’m getting conflicting stories on that one. Some are still claiming that <a href="" target="_blank">Microsoft will go with WebKit</a>, which, thanks to the popularity of Apple's Safari browser and also Google's Chrome, is rapidly becoming a de facto standard for all non-IE and non-Firefox implementations.</p>
<p>Others insist that that the whole WebKit story is merely a feint and that Microsoft will in fact be adopting a <a href="" target="_blank">brand-new engine</a> coming out of its Microsoft Research division. Dubbed <a href="">"Gazelle,"</a> this new engine will supposedly be more secure than Firefox or even Chrome, making copious use of sandboxing to keep its myriad plug-ins isolated and the overall browser process model protected.</p>
<p><b>[ Get the <a href="">full scoop on the Gazelle browser technology</a> that may replace Internet Explorer. ]</b></p>
<p>But regardless of which direction Microsoft takes -- WebKit or Gazelle -- it will still have to navigate the treacherous waters of legacy ActiveX support. And as someone who has spent some not-so-quality time developing ActiveX controls in the past, the need to maintain some sort of compatibility layer within any proposed IE replacement is a critical consideration.</p>
<p>For most casual users (i.e., grandma in her den surfing eBay), ActiveX was and is just another annoying <a href="">RIA (rich Internet application) mechanism</a>, one that has increasingly been supplanted by Adobe Flash or various AJAX-based mechanisms. However, for enterprise IT shops with a heavy Microsoft investment, ActiveX has long been an integral part of many in-house applications. </p>
<p>If Microsoft intends to pull the plug on IE after version 8, it will need to articulate a clear legacy migration strategy that allows these shops to preserve their investments in ActiveX controls and resources.</p>
<p>Then there’s the issue of legacy HTML/CSS support. So much of the Web has been tweaked for IE 6.x compatibility that even Microsoft's own attempts to implement a more standards-compliant browser engine in IE8 have met with disastrous results. For me, the situation so bad that when I do find myself using IE 8 (typically, to view a site that causes my copy of the Chrome 2.x beta release to blow up), I end up configuring IE 8's compatibility mode as the default viewing option since the browser's native rendering mode breaks practically every site I visit.</p>
<p>Finally, there's the matter of third-party developers using IE's rendering engine with their own applications. A good example would be a program that includes a help file in HTML format and then uses a custom form to display an embedded Web browser object to host the file. This embedded object is invariably an ActiveX container for the IE engine that's installed with Windows, so any attempt to remove IE from the OS -- or to radically change its core underpinnings -- will need to account for applications that rely on the existence of an accessible, programmable IE object model.</p>
<p>Of course, all of the above is old hat for Microsoft, a company whose status as global software leader too often makes it a victim of its own success. I, for one, look forward to the possibility of a clean break with IE's creaky old rendering engine. But I hope the company pays more care and attention to preserving legacy compatibility than it did with some of its more recent OS efforts.</p>
				<a name="more"></a>

				<p>Posted by Randall C. Kennedy on March 10, 2009 03:00 AM</p>
				<br  />                   
				<!-- END BLOG BODY-->

				<!-- RATING WIDGET -->    
				<strong style="float: left;">RATE THIS ARTICLE:</strong><br /><br />
				<div class="js-kit-rating" view="split" style="float: left; margin-top: 15px; padding-left: 130px;" permalink=""></div>
				<script src=""></script><br  /><br  />   
<!-- begin digg it widget -->
                <span class="f-right" style="margin-top: -65px;">
		<script type="text/javascript">
		digg_url = '';
		digg_title = 'Is IE8 the end of the line for Internet Explorer?';
		digg_bodytext = 'Dropping IE in favor of a newer rendering engine may be not be as easy as it seems';
		digg_topic = 'tech_news';
		digg_media = 'news';
		digg_window = 'new';		
		    <script src="" type="text/javascript"></script>                     
                <!-- end digg it widget -->
                    <br  /><br  />   
				<!-- BOT TOOL KITS -->

				<div class="lowerblogoptions">
						<li><a href=""><img src="" border="0" alt="RSS subscription" align="absmiddle"></a></li>
						<li><a href="">Subscribe</a></li>
						<li><a href=""><img src="" alt="E-mail" border="0" align="absmiddle" hspace="3"></a></li>
						<li><a href="">Email</a></li>
						<li><a href=""><img src="" alt="Print This" border="0"  align="absmiddle" hspace="3"></a></li>
						<li><a href="">Print</a></li>
						<li><a href=""><img src="" align="absmiddle"></a></li>
						<li><a href="">Slashdot</a></li>
						<li><a href=""><img src="" align="absmiddle"></a></li>
						<li><a href="">reddit</a></li>
						<li><a href=""><img src="" align="absmiddle" hspace="3"></a></li>
						<li><a href="">Digg</a></li>
						<li><a href=""><img src="" align="absmiddle" hspace="3"></a></li>
						<li><a href=""></a></li>
						<li><a href=""><img border=0 src="" alt="StumbleUpon Toolbar"></a></li>
						<li><a href="">Stumble It!</a></li>
						<li><a href=""><img src="" align="absmiddle" hspace="3"></a></li>
						<li><a href="">newsvine</a></li>
				</div><!-- end div lowerblogoptions-->

				<!-- comments section -->                  

				<a name="postAComment"></a>
				<div class="commented">
				<ul style="text-align: left;">
				<li>&nbsp;<img src="" align="absmiddle" /></li>
				</div><!--end div commented-->

				<div style="border: 1px solid #CCCCCC; border-top: none; padding: 0px 10px 10px 10px; width: 415px; background: #f8f8f8;">

				<br />

				<!-- js kit comments widget -->

				<div class="js-kit-comments" backwards="yes" path="/enterprisedesktop/21160" permalink="" standalone="yes" label="<img src='' border='0'>" style="display: none">

				<!-- Template for a single comment entry. This template is optional -->
				<div class="js-singleComment" style="padding: 5px 10px 10px 5px; margin-top: 10px; background: #ffffff;">

				<br />

				<!-- Add Avatar -->
				<div class="js-singleCommentAvatar" style="margin-top: -10px; width: 50px; height: 50px;"></div>

				<ul class="js-singleCommentINFO" style="float: left; margin: 0px; padding: 0px; list-style-type: none; list-style-image: none; background: #FFFFFF; font-family: helvetica, arial, times new roman; font-size: 12px; color: #000000;">
				<li class="js-singleCommentName" style="display: inline; padding-left: 10px; padding-bottom: 10px; font-weight: bold;">{Name}</li>
				<li class="js-singleCommentDate" style="display: inline; padding-left: 10px; padding-bottom: 10px; font-family: helvetica, arial, times new roman; font-size: 12px; color: #000000;">{Date}</li>
				<li class="js-singleCommentDate" style="display: inline; padding-left: 10px; padding-bottom: 10px; font-family: helvetica, arial, times new roman; font-size: 12px; color: #000000;">{Time}</li>

				<!-- end comment information -->

				<div class="js-singleCommentBg" style="padding: 5px 10px; line-height: 1.4em; font-family: helvetica, arial, times new roman; font-size: 12px; clear: left;">

				<br />

				<div class="js-singleCommentText" style="float: left;">{Text}</div>
				<div style="clear: both"></div>

				<br />

				<ul class="js-singleCommentControls" style="float: right; margin: 0px; padding: 0px; list-style-type: none; list-style-image: none;">

				<li class="js-singleCommentReplyable" style="display: inline; padding: 5px 2.5px; border: 1px solid #CCCCCC; background: #f8f8f8;">
				<a class="js-singleCommentReply">{Label:reply}</a>

				<li class="js-singleCommentDeletable" style="display: inline; padding: 5px 2.5px; border: 1px solid #CCCCCC; background: #f8f8f8;">
				<a class="js-singleCommentDelete">{Label:delete}</a>


				<br />

				<!-- end comment controls -->


				<!-- end single comment background -->


				<!-- end single comment -->

				<!-- Template for a "Create a comment" dialog. This template is optional -->
				<div class="js-CreateComment">
				<div class="js-CreateCommentBg" style="padding: 5px 10px 10px 5px; margin-top: 10px; background: #ffffff; width: 380px; line-height: 1.4em;">

				<div class="js-commentFieldSubject">{Label:leaveComment}</div>
				<div class="js-commentFieldLabel">{Label:nameLabel}</div>
				<div style="padding-bottom: 5px;"><input name="js-CmtName" /></div>

				<div class="js-commentFieldLabel">{Label:emailLabel}
				<div class="js-commentFieldNote">{Label:emailNote}</div>
				<div style="padding-bottom: 5px;"><input name="js-CmtEmail" type="email" /></div>
				<div class="js-commentFieldLabel">{Label:commentLabel}</div>
				<div style="padding-bottom: 10px; width: 370px;"><textarea name="js-CmtText" rows="10"></textarea></div>
				<div class="js-commentAvatarArea"></div>

				<div><input type="image" src="" name="js-Cmtsubmit">
				<input type="image" name="js-Cmtcancel" src=""></div>
				</div><br clear="all" /></div>


				<script src=""></script>
				<br /><hr><br />				



				<!-- end border -->

			</div><!--end div yellow-->

		</div><!--end div sub-left f-left-->

		<!-- RIGHT COLUMN -->	
		<div class="sub-right f-right">
			<!-- Place code here to show up at the top of the right column -->
<!-- Drop player code below -->


<table valign="top" style="border: 1px solid #999999; background: #FFFFFF; width: 328px; height: 280px; margin-top: 2px;">
<td align="center">

<img src=";sz=1x1;ord=200301151450?"/>

<script language="javascript" type="text/javascript" src=""></script>
<div id="flvplayer" style="background:; float:left;">
<p style="visibility: visible;" id="player957"></p>
<script type="text/javascript">

var sponsorDCZone = "?clickTAG=videoType=InfoClipz;videoId=663;videoTitle=InfoClipz: Service-Oriented Architecture;videoTag=SOA;";
var FU = {      movie:"" + sponsorDCZone,width:"320",height:"260",majorversion:"7",build:"0",bgcolor:"#000000",flashvars:"file=" };
UFO.create(     FU, "player957");


<br />


						<!--include virtual="/SSI/article/rhc_editor_pick.html"-->
                        <div class="sign">
                                <div class="sign-top">&nbsp;</div>
                                <div class="sign-cnt">
                                        <p class="black">TOP STORIES</p>
                                                <li><a href="">Jive refines corporate social networking tools</a></li>
<li><a href="">Sun's Rock processor on track for this year</a></li>
<li><a href="">MS cuts software leasing costs to retain companies</a></li>
<li><a href="'s_free_unless_it_delivers_value_1.html">A SaaS app that's free unless it delivers value</a></li>
<li><a href="">Report: Apple to launch Snow Leopard June 8</a></li>

                                <div class="sign-btm">&nbsp;</div>
			<!-- TOP IMU -->
			<div align="center">
				<!-- begin 336x280,336x600 ad tag -->
<script language="JavaScript" type="text/javascript">
<a href=";pos=imu;tile=6;sz=336x280,336x600;ord=123456789?" target="_blank">
<img src=";pos=imu;tile=6;sz=336x280,336x600;ord=123456789?" width="336" border="0" alt="">
<!-- End ad tag -->

<br clear="all">


						<!-- RESOURCES BOX -->
			<br />
			<div class="resources">
				<div class="resources-top">&nbsp;</div>
				<div class="resources-cnt">
					<p class="black">ADDITIONAL RESOURCES</p>

					<!-- Webcasts -->
<li><img src="" align="absmiddle" /><br /></li>
<li><a href="">Virtual Machines: Sun's xVM Virtualization Portfolio</a></li>
<li><a href="">Migrating to Vista</a></li>
<li><a href="">Turning Information Into A Competitive Advantage</a></li>
<li><br /></li>
<!-- White Papers -->
<li><img src="" align="absmiddle" /><br /></li>
<li><a href="">Moving to Windows Vista: The Promise, The Reality</a></li>
<li><a href="">Accelerating Virtualized Environments</a></li>
<li><a href="">Speeding Business Innovation with Data Center Transformation</a></li>
<li><br /></li>
<!-- InfoWorld Reports -->
<li><img src="" align="absmiddle" /><br /></li>
<li><a href="">Protection for Remote Sites and Branch Offices</a></li>
<li><a href="">WAN Emulation Sponsored Solutions Guide</a></li>
<li><a href="">Planning For A Disaster</a></li>
<li><br /></li>


					<!-- Resource Alerts -->

					<p class="black">&nbsp;</p>

					<ul style="padding: 0px 10px;">
					<li><br /></li>
					<li class="alerts">RESOURCE ALERTS<br /></li>
					<li><a href=" ">Receive instant email notification when resources like these become available</a>.</li>
					<li><br /></li>
					<li><a href=" "><input type="image" BORDER=0 title="Resource Alert" alt="Resource Alert" src="" name="resource_alert" align="absmiddle" /></a></li>
				</div><!--end div resources-cnt-->
				<div class="resources-btm">&nbsp;</div><!--end div resources-btm-->
			</div><!--end div resources-->

			<!-- BOT IMU -->
			<br />
			<div align="center">
				<!-- begin 336x280,336x600 ad tag -->
<script language="JavaScript" type="text/javascript">
<a href=";pos=imubottom;tile=14;sz=336x280,336x600;ord=123456789?" target="_blank">
<img src=";pos=imubottom;tile=14;sz=336x280,336x600;ord=123456789?" width="336" border="0" alt="">
<!-- End ad tag -->

            <div align="center">
            	<!--include virtual="/SSI/blogTemplate/ifw_podcast.html"-->
            <br />
            <!--end div imu ad-->
            <div class="sign">
	<div class="sign-top">&nbsp;</div>
		<div class="sign-cnt">
			<p class="black">IT JOBS</p>
			<!--<li><a href="">Get Job Alerts</a></li>-->
			<script type="text/javascript" src=""></script>
			<!--<div><span style="color: rgb(156, 0, 5);">»</span> <b><a href="">Search Jobs</a></b></div>-->
			<div id="jobs-search-field">
				<form action="" method="get">
					<input name="search_string" size="15" maxlength="255" class="input_text" type="text">
					<input name="country_code" value="us" type="hidden">
					<input name="distance" value="20" type="hidden">
					<input name="search" value="1" type="hidden">
					<input name="go" value="Find Jobs" class="input_button" type="submit">
	<div class="sign-btm">&nbsp;</div>
		</div><!--end div sub-right f-right-->

	</div><!--end div right f-right-->

</div><!--end div content-->

				<!-- BOT BANNER -->
<div class="bot-ban f-left">
	<!-- begin ad tag  (728x90) -->
  <A HREF=";pos=leaderbottom;tile=7;sz=728x90;ord=123456789?" TARGET="_blank">
  <IMG SRC=";pos=leaderbottom;tile=7;sz=728x90;ord=123456789?" WIDTH="728" HEIGHT="90" BORDER="0" ALT=""></A>
<!-- End ad tag -->


<div class="bottom f-left">
	<div class="bottom-l f-left">
		<style type="text/css">
.topic_alert {width: 50px; background: transparent;}
.topic_alert ul {float: left; margin: 0px; padding: 0px; list-style-type: none;}
.topic_alert ul li {margin-left: 30px; margin-right: 8px; font: 10px;}

<table style="border: 1px solid rgb(204, 204, 204);" align="center" bgcolor="#f5f5f5" border="0" cellpadding="8" cellspacing="0" width="1000">
<tbody><tr><td valign="top" width="48%"><h2 class="artText">Technology White Papers</h2></td><td>&nbsp;</td><td valign="top" width="50%"><h2 class="artText">InfoWorld Technology Marketplace</h2></td></tr>
<tr><td valign="top">
<ul style="padding-left: 20px; font-size: 11px;">

<li><a target="_new" href="" rel="nofollow">
Increasing ROI and Reducing the Risks of Your Application Portfolio</a> - Application Portfolio Management (APM) is all about minimizing risks and maximizing rewards of an organization&#226;&#128;&#8482;s...

<li><a target="_new" href="" rel="nofollow">
A New Breed of Data Warehouse</a> - Because enterprise data warehouses are evolving along different dimensions, organizations need to effectively manage metadata...

<li><a target="_new" href="" rel="nofollow">
The Critical Role of Content Management in Delivering Business Services</a> - Business runs on content and that content must be managed holistically, across the entire business. However, managing content...

<li><a target="_new" href="" rel="nofollow">
The Social Enterprise: Using Social Enterprise Applications to Enable the Next Wave of Knowledge Worker Productivity</a> - (Source: Oracle)  The next generation of collaborative work will be defined by the shift from information handling to interaction...

<li><a target="_new" href="" rel="nofollow">
Forrester Wave - Actional Ranked W1</a> - To assess the state of the standalone SOA management solutions market and see how the vendors stack up against each other...

<li><a target="_new" href="" rel="nofollow">
Actional Assessment Guide</a> - Use this guide to assess risk factors and gauge your applications' effectiveness in supporting revenue growth, customer ...


<h2 class="blackVrdMed">
<font color="#9c0005">&#187;</font> <a href="">Technology White Papers Library</a><br><br>

<table border="0" cellpadding="0" cellspacing="0">
<td valign="top"><h2 class="artText">Technology White Papers by Topic</h2></td>
<td style="width: 30px;"></td>
<td><h2 class="artText">Technology White Papers E-mail Alert</h2></td>

<table style="width: 440px; margin-left: -20px;">
<td style="width: 70px;" valign="top" class="topic_alert">
<ul><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=1">Application development</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=2">Applications</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=3">Business</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=21">Data Protection</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=4">Data management</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=5">Hardware</a></li></ul>

<td align="left" valign="top" class="topic_alert">

<ul><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=25">Mobile</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=6">Networking</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=9">Security</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=11">Storage</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=12">Telecom</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=31">Virtualization</a></li><li><span style="color: #ce181f;">&#x00bb;</span>&nbsp;&nbsp;<a href="/archives/t.jsp?N=w&V=14">Wireless</a></li></ul>


<td valign="top" width="280">

<a href="">Receive instant email notification when resources on this topic become available.</a>
<a href="">
<input title="Resource Alert" alt="Resource Alert" src="" name="resource_alert" align="absmiddle" border="0" type="image">



<td valign="top" width="49%">

<ul style="padding-left: 20px; font-size: 11px;">

<script type="text/javascript" src=""></script>

</ul><font color="#9c0005">&#187;</font> <a target="_new" href="">BUY A LINK NOW</a><br></td>

	</div><!--end div bottom-l f-left-->
</div><!--end div bottom f-left-->

<div class="sponsorship">
	<p class="alerts"><strong>Sponsored Technology Links</strong></p>

	<span class="f-left">
			<li><!--impression:--><a target="_new" href=";212632942;7406810;a?" rel="nofollow">Simplify your IT. Migrate to JBoss on Dell. - </a></li><li><!--impression:--><a target="_new" href=";211471579;7406810;g?;211424300;32978577;e?" rel="nofollow">Optimize your SAP applications with Novell and VMware solutions - </a></li><li><!--impression:--><a target="_new" href=";212530864;7406810;a?" rel="nofollow">Harmonize your mixed Computing Environments with MKS Toolkit - </a></li><li><!--impression:--><a target="_new" href="" rel="nofollow">From Data Center to Desktop, Microsoft Virtualization delivers - </a></li><li><!--impression:--><a target="_new" href=";212042872;7406810;x?;h=v2|3AAB|0|0|%2a|l;212050129;0-0;0;33453867;31-1|1;30304738|30322615|1;;%3f" rel="nofollow">The Sun Unified Storage Systems.  Storage made simple, just when you need it most.  Get a 60-day free trial then buy at 20% off.  Try It Now. - </a></li><li><!--impression:--><a target="_new" href=";211234718;7859937;u?;212240455;33635926;b?" rel="nofollow">VISIT TODAY FOR ALL YOUR TECHNOLOGY NEEDS. - </a></li>
	</span><!--end span f-left-->

	<span class="f-right">
			<li><!--impression:--><a target="_new" href=";211354482;7406810;z?;211360177;32900686;b" rel="nofollow"><img src=";sz=1x1;ord=%n?" width="1" height="1" />Real-time, reporting:  Try Free 60 day trial now - </a></li><li><!--impression:--><a target="_new" href=";210922035;7406810;t?" rel="nofollow">File Integrity Monitoring: Prove compliance and secure your IT environments - </a></li><li><!--impression:--><a target="_new" href="" rel="nofollow">Oracle - Top 3 Ways to Cut Costs in 2009 with Oracle Content Management</a></li><li><!--impression:--><a target="_new" href="" rel="nofollow">Oracle - Performance Monitor: ERP at the Speed of Light</a></li><li><!--impression:--><a target="_new" href=";206044675;17422667;i?" rel="nofollow">Microsoft - Learn about the software-based VoIP solution from Microsoft.</a></li><li><!--impression:--><a target="_new" href="" rel="nofollow">Oracle - Nucleus Report: Who's ready for SMB?</a></li>
	</span><!--end span f-right-->
</div><!--end div sponsorship -->

<!-- BOT NAVBAR -->
<div class="footer f-left">
	<!-- BOT NAV -->
	<div class="menu-box">
			<li><a href="">HOME</a></li>
			<li><a href="">NEWS</a></li>
			<li><a href="">BLOGS</a></li>
			<li><a href="">PODCASTS</a></li>
			<li><a href="">VIDEOS</a></li>
			<li><a href="">TECHNOLOGIES</a></li>
			<li><a href="">TEST CENTER</a></li>
			<li><a href="">EVENTS</a></li>
		<ul class="list-r">
			<li><a href="">About</a></li>
			<li><a href="">Advertise</a></li>
			<li><a href="">Awards</a></li>
			<li><a href="">RSS</a></li>
			<li class="last"><a href="">Contact Us</a></li>
	</div><!--end div menu-box-->

	<div class="corporate">
			&copy; 1994 - 2009, InfoWorld  Inc., <a href="">Reprints, Permissions, Licensing,</a>
			<a href="">IDG Network,</a>
			<a href="">Privacy Policy,</a>
			<a href="">Terms of Service</a>.<br />
			All Rights reserved. InfoWorld is a leading publisher of technology information and product reviews on topics including viruses,<br />phishing, worms, firewalls, security, servers, storage, networking, wireless, databases, and web services.
		<ul class="bot-menu">
			<li><a href="">CIO</a>&nbsp;&nbsp;::</li>
			<li><a href="">ComputerWorld</a>&nbsp;&nbsp;::</li>
			<li><a href="">CSO</a>&nbsp;&nbsp;::</li>
			<li><a href="">DEMO</a>&nbsp;&nbsp;::</li>
			<li><a href="">GamePro</a>&nbsp;&nbsp;::</li>
			<li><a href=""></a>&nbsp;&nbsp;::</li>
			<li><a href="">IDC </a>&nbsp;&nbsp;</li>
			<br />
			<li><a href="">IDG</a>&nbsp;&nbsp;::</li>
			<li><a href="">IDG Connect</a>&nbsp;&nbsp;::</li>
			<li><a href="">IDG Knowledge Hub</a>&nbsp;&nbsp;::</li>
			<li><a href="">IDG TechNetwork</a>&nbsp;&nbsp;::</li>
			<li><a href="">IDG Ventures</a>&nbsp;&nbsp;</li>
			<br />
			<li><a href=""></a>&nbsp;&nbsp;::</li>
			<li><a href="">InfoWorld</a>&nbsp;&nbsp;::</li>
			<li><a href="">IT World</a>&nbsp;&nbsp;::</li>
			<li><a href="">JavaWorld</a>&nbsp;&nbsp;::</li>
			<li><a href="">LinuxWorld</a>&nbsp;&nbsp;</li>
			<br />
			<li><a href="">Macworld</a>&nbsp;&nbsp;::</li>
			<li><a href="">Network World</a>&nbsp;&nbsp;::</li>
			<li><a href="">PC World</a>&nbsp;&nbsp;::</li>
			<li><a href="">Industry Standard</a>&nbsp;&nbsp;</li> 
	</div><!--end div corporate-->
</div><!--end div footer f-left-->

<!-- Start Quantcast tag -->
<script type="text/javascript" src=""></script>
<script type="text/javascript">
<a href="" target="_blank"><img src="" style="display: none" border="0" height="1" width="1" alt="Quantcast"/></a>
<!-- End Quantcast tag -->

<!-- Start Google Analytics -->
<script src="" type="text/javascript">
<script type="text/javascript">
_uacct = "UA-503159-6";
<!-- End Google Analytics -->

			</div><!--end div page-->
		</div><!--end div container-->
<!-- PRESTITIAL AD (tile=18) -->
<script language="JavaScript" type="text/javascript">
document.write('<script language="JavaScript" src=";pos=survey;tile=18;dcopt=ist;sz=1x1;ord=' + ord + '?" type="text/javascript"><\/script>');
<a href=";pos=survey;tile=18;sz=1x1;ord=485711100309?" target="_blank">
<img src=";pos=survey;tile=18;sz=1x1;ord=485711100309?" width="1" height="1" border="0" alt="">

<script src=""></script>


Reproducible: Always

Steps to Reproduce:
1.clicked on link from newsletter <>
2.long delay after new tab is opened
3.browser crashes, "session manager extension" restarts browser session without
site in tab
Actual Results:  
browser  is taken  down completely

Expected Results:  
opened  site in new browser tab

none, minor inconvenience
Comment 1 Dave Garrett 2009-03-10 12:28:03 PDT
Don't paste giant blobs like this into bugs. Attach them, if need be. (and you didn't need to do anything but link to it, in this case) Also, crashes are never minor; crashes are all critical.

I see no problems. (tested with 3.0.7 on WinXP/Linux & 3.1b4pre on Linux)

Please post your crash ID:
Comment 2 Mats Palmgren (:mats) 2009-03-10 20:39:37 PDT
I can reproduce it reliably: bp-a9c6b9b7-d67a-4146-8ace-ad4322090310
If it doesn't happen at once, try clearing cookies and reload, the
crash seems to be caused by a popup window that only opens occasionally.
Maybe dupe of bug 469366?
Comment 3 Samuel Sidler (old account; do not CC) 2009-03-11 08:16:59 PDT
Might be a dupe, but if we have good STR here, we should keep it open for now. I just hijacked that one based on the stack.

Mats, can you reduce the testcase at all?
Comment 4 Mats Palmgren (:mats) 2009-03-11 10:48:33 PDT
Making a testcase by reducing the content from the URL looks hard.
I grabbed the content involved and it has 14000 lines of JS,
I looked briefly at some of it and it's hairy...

I think what happens is that during page load a new window (a survey)
is opened (in the absence of a cookie), while this happens the main
window content is replaced with an ad that has a timer, after a few
seconds the normal main window content is presented again.
It looks like the crash occurs when the main window transitions from
normal content to ad content.

I can't reproduce the crash in current Firefox trunk or 1.9.1 builds
(on Linux i686), nor in a trunk debug build (Linux x86_64).
What's more surprising is that I can't reproduce the crash in a
1.9.0 Firefox debug build (Linux x86_64), but nightly builds (i686)
crashes reliably.  I think that's because the bug is timing dependent
rather than being 32-bit only.  All of the above with the same profile,
which has Firebug installed and enabled.  If I disable Firebug in this
profile I can't reproduce the crash.  I can't reproduce the crash in
a clean profile either (after allowing the popup window to open).
Bug 469366 also mentions Firebug... again, this could be that Firebug
affects the timing somehow rather then being the direct culprit.

So, the profile requirements for crashing: Firebug + allow popup windows.

BTW, I see the following assertions in all debug builds tested above
(also on trunk) when the popup window opens:

###!!! ASSERTION: Already have an undisplayed context entry for aContent: '!GetUndisplayedContent(aContent)', file layout/base/nsFrameManager.cpp, line 588
###!!! ASSERTION: Shouldn't happen: 'aPresContext->GetPresShell()->GetPrimaryFrameFor(mContent) == this', file layout/generic/nsFrameFrame.cpp, line 501
###!!! ASSERTION: Already have an undisplayed context entry for aContent: '!GetUndisplayedContent(aContent)', file layout/base/nsFrameManager.cpp, line 588

the middle one in nsFrameFrame.cpp could be related...
Comment 5 Mats Palmgren (:mats) 2009-03-11 10:49:07 PDT
John Senchak, please tell us which Firefox add-ons you have.
(Tools-> Add-ons -> Extensions)
Comment 6 Mats Palmgren (:mats) 2009-03-11 10:59:14 PDT
Actually, the reason trunk/1.9.1 doesn't crash could be that Firebug was
automatically disabled since it's "incompatible"... I'll try with Firebug
1.4 alpha...
Comment 7 john senchak 2009-03-11 11:09:11 PDT
My Fire Fox  3.07  extensions:

Session Manger
Gmail Ad Blocker
Header Spy
Location Bar two
Router Status
Simple Mail
Status Bar Ex
Tweak Network
FEBU (extension backup)
Data Analytics 
Better Privacy <---could be blocking cookie in site
ShockWave Flash
Comment 8 Mats Palmgren (:mats) 2009-03-11 11:12:12 PDT
Created attachment 366851 [details]
Stacks for the assertions in comment 4

Note that the stack for the middle assertion is the same as the crash stack!
Comment 9 john senchak 2009-03-11 11:17:12 PDT
[Calcification on Firefox 3.07 take down] 

This occurred  when a link in  a email newsletter from InfoWorld Daily was
opened in Gmail. When opening the below link in Gmail,  a new tab is opened
when first link link is opened:

Is IE8 the end of the line for Internet Explorer?

Then redirects to:

It seems that when the direct happens your  are shown a advertisement page
first before you are brought to the second link.  I tried this using Internet
Explorer and was shown the advertisement before the main page was loaded. I
just  tried opening the first link in in Gmail and once again Firefox 3.07 was
taken down. I believe that the actual advertisement page or pop up ad may have
some malice code which is what took down the browser.

I looked at the email newsletter source code and didn't find anything that
looked out of the normal

I tried looking at the source code of the advertisement page but couldn't
because after a certain amount of time (less then a minute), your are
redirected to the second link.

Kind of odd that the news story is about Explorer  8 and it takes down Firefox?
Comment 10 Mats Palmgren (:mats) 2009-03-11 11:23:04 PDT
firebug-1.4.0a12.xpi does not work in Firefox 1.9.1 or trunk, so it's still
unknown if the crash would occur there...  the error is:
JavaScript error: chrome://browser/content/browser.xul, line 1: Firebug is null
Comment 11 Mats Palmgren (:mats) 2009-03-11 11:27:29 PDT
John, if you can try Firefox 3.1b4pre that would help us:
just unzip it into an empty directory and start it from there.
If you do then please list the add-ons again -- some of them might
have been disabled for compatibility reasons when running in 3.1b4.
Comment 12 Mats Palmgren (:mats) 2009-03-11 11:47:36 PDT
... or if can run with Firefox 3.0.7 and disable your add-ons one by one
and then restart Firefox and try to crash it, that would help to determine
which add-on is causing the crash in your case.
I'll try to install the add-ons you have too...
Comment 13 Mats Palmgren (:mats) 2009-03-11 13:19:40 PDT
The add-on "Header Spy 1.3.3" is sufficient to trigger the crash in 1.9.0,
it's incompatible with 1.9.1 and trunk though.
Comment 14 Mats Palmgren (:mats) 2009-03-11 13:26:26 PDT
... but still can't crash a 1.9.0 debug build
Comment 15 Mats Palmgren (:mats) 2009-03-11 18:34:26 PDT
Created attachment 366962 [details]
Crash stack, 1.9.0 debug on MacOSX

Finally got it to crash in a debug build, 1.9.0 on MacOSX with Firebug 1.3.3.

There's an additional assertion (to the ones in comment 4):
###!!! ASSERTION: What's going on?: 'mInnerView', nsFrameFrame.cpp, line 855
Comment 16 john senchak 2009-03-12 09:59:00 PDT
I installed Firefox build # "3.1b4pre" and tried about 10 times and could not crash the browser. I even tried deleting the cookies and the crash didn't occur.  I did not install any extensions, and Fire-Bug can't be installed on that version which was already stated here.  Disabling each extension and retrying  to recreate the crash will take some time. Might try do this on Monday 03/16.
Comment 17 Taral 2009-03-12 15:34:38 PDT
Copying from bug 469366 comment 9 to here:

Repeatable crash on Firefox 3.0.7 with Firebug 1.3.3:

Repro steps:
1. Enable Firebug
2. Visit any product page on target:
3. Make sure you are not signed in
4. Click Add to Club Wedd
Comment 18 Samuel Sidler (old account; do not CC) 2009-03-16 14:14:02 PDT
*** Bug 469366 has been marked as a duplicate of this bug. ***
Comment 19 Samuel Sidler (old account; do not CC) 2009-03-16 14:14:58 PDT
Not blocking since code freeze is tomorrow, but this is currently our #1 topcrash.

Mats, can you work on this?
Comment 20 Samuel Sidler (old account; do not CC) 2009-03-16 14:15:38 PDT
And we're going to block on this for
Comment 21 Mats Palmgren (:mats) 2009-03-16 21:03:36 PDT
Yes, I think I see what the problem is now...
Comment 22 john senchak 2009-03-17 12:13:18 PDT
experimenting  with FireBug 1.3.3 ,very Nice extension
Comment 23 Mats Palmgren (:mats) 2009-03-17 17:29:21 PDT
Created attachment 367928 [details]
log + stacks (mozilla-central OSX, content/base/ mochitests)

The bug also occur on trunk.  It's the content sink that notifies
content that has already been notified on, leading to
nsCSSFrameConstructor::ContentAppended for content that already has
a frame in the frame tree.  It seems that trunk is quite resilient to
this and doesn't crash (never?), but 1.9.0 crashes reliably when the
content node is an <iframe> (as in the STR in this bug).
On trunk, the problem occurs for example when running (all) mochitests
under content/base/ -- it leads to double frame creation for the <div>
in test_bug338679.html, but loading this test directly doesn't trigger it.

(do we have bugs open on "content doubling"?)

The attached trace is from such a mochitest run on trunk.
The first content and frame dump is from the shell InitialReflow.
After that the sink is what I call "clean" (mNumFlushed == childCount on
all stack levels, ie. FlushTags() wouldn't notify anything if called).
Then we run some script, leading to ContentRemoved/Appended/Inserted...
at some point the child count grows beyond what the sink's mNumFlushed
(I log this as "dirty").  The problem seems to be that we never reach
any UpdateChildCounts()...  I'm guessing this should occur in
nsContentSink::EndUpdate on the outermost level?
but we reach FlushTags() before that, which notifies... see the stack
at the end.
Comment 24 Mats Palmgren (:mats) 2009-03-17 17:42:18 PDT
For the record I noted that in nsContentSink::ContinueInterruptedParsingAsync()
we don't check if there is a pending event...
... (because there are consecutive WillInterrupt() calls without a 
WillResume() call) not sure how much a problem that is... fixing it
did not help with notification problem described above.
Comment 25 Jordan Gutterman 2009-03-17 23:39:43 PDT
Perhaps a regression from bug 448564 could be causing this to be a new topcrash on branch, since that landed there not too long ago and was also about double-notifying in the content sink. Actually, looking closer, one of the assertion in comment 4 here is also in comment 1 of that bug in the same function we're crashing in.
Comment 26 Boris Zbarsky [:bz] (still a bit busy) 2009-03-18 06:58:31 PDT
> It seems that trunk is quite resilient to this and doesn't crash (never?)

It can be made to if one tries hard enough.  If not on page load, then on page unload.

> it leads to double frame creation for the <div> in test_bug338679.html

Right.  That makes sense given your stacks.  That said, is that what the original page was seeing?  Your debug log is pretty specific to having a mutation listener that modifies the DOM (and I was sure we had a bug on this already, fwiw... I certainly remember talking to sicking about this), and I doubt that the site this was filed on is doing that.

> I'm guessing this should occur in nsContentSink::EndUpdate on the outermost
> level?

I think we should be updating child counts from all updates started from inside a mutation listener.  Perhaps what we should really be doing is UpdateChildCounts any time we get an EndUpdate and there are no script blockers about?  Except of course EndUpdate happens before we remove script blockers, on trunk...
Comment 27 john senchak 2009-03-18 12:01:27 PDT
When  Better Privacy Extension 1.24 is disabled using Firefox 3.07 the browser
does not crash. :--)  Ten attempts to create crash with above extension 
disabled.  Sorry for the delay, I had to learn how to us FireBug.

Bugzilla reports these errors: (console)

PopAd is null;pos=peelback;tile=14;dcopt=ist;sz=1x1;ord=2335188695488163?
Line 4

PopAd is null
;pos=peelback;tile=14;dcopt=ist;sz=1x1;ord=6342682879327702?()();pos=pee...79327702? (line 4)
[Break on this error] PopAd.blur();


Permission denied to call method Location.toString
Line 474

Permission denied to call method Location.toString
m()()K9mPiejf...fYA%3D%3D (line 1)
eval()()1bHtly8N...Gaw%3D%3D (line 1)
m()()K9mPiejf...fYA%3D%3D (line 1)
m()()K9mPiejf...fYA%3D%3D (line 1)
m()()K9mPiejf...fYA%3D%3D (line 1)


Permission denied to call method Location.toString
Line 0

Comment 28 Boris Zbarsky [:bz] (still a bit busy) 2009-03-18 12:25:30 PDT
Huh, weird.  I see nothing obvious in BetterPrivacy that would cause crashes....
Comment 29 Mats Palmgren (:mats) 2009-03-18 21:30:07 PDT
(In reply to comment #25)
> Perhaps a regression from bug 448564 could be causing this...

That bug touches the relevant code, but didn't directly cause the
regression AFAICT.  For the STR in comment 17 with Firefox 3.0.7pre
MacOSX and Linux i686 nightly builds, I get the regression range
2009-02-03-04 -- 2009-02-04-04:
None of the checkins in that range looks suspicious to me though,
so maybe a combination of bug 448564 and something in this range?

(Linux builds are less crashy at the Infoworld URL today, so no reliable
range there yet, only data point so far is that 2009022204 crashes).
Comment 30 Mats Palmgren (:mats) 2009-03-18 21:32:37 PDT
(In reply to comment #26)
> That said, is that what the original page was seeing?

Yes, the STR in comment 17 leads to FC::ContentAppended with an existing
frame too, on both trunk and 1.9.0, with the same stack, but this stack
is different from the one in attachment 367928 [details] (for the mochitest run).

For the mochitest stack, it looks like the problem is at this point:

#51 0x120f6ccb in nsEventDispatcher::Dispatch
#52 0x120548f7 in nsGenericElement::SetAttrAndNotify

Dispatch() is called in the same scope as the mozAutoDocUpdate:
which is the cause for the "missing" UpdateChildCounts().
Adding a scope around the first part of the method so that firing the
mutation event is outside seems to fix that problem... I can now run
a full mochitest run without any existing frames in FC::ContentAppended.
Comment 31 Mats Palmgren (:mats) 2009-03-18 21:35:30 PDT
Created attachment 368195 [details] [diff] [review]
WIP, fixes the mochitest problem as described in comment 30 (diff -w)
Comment 32 Mats Palmgren (:mats) 2009-03-18 21:40:01 PDT
Created attachment 368196 [details]
Trunk stack (same in 1.9.0) for existing frame in ContentAppended with STR in comment 17 (
Comment 33 Boris Zbarsky [:bz] (still a bit busy) 2009-03-18 21:47:11 PDT
Hmm.  We aren't in an update in that last stack, are we?  At least not that I can see...

As for mutation events, they generally fire inside updates as I recall.  That patch fixes the attr modification case, but the ones for content insertion, etc, fire inside updates too...
Comment 34 Daniel Veditz [:dveditz] 2009-04-10 10:18:31 PDT
This has been getting a lot of reports on SUMO -- any news? Looks kinda dead in here. Should we unhide the bug so the people who were adding their stacks/info to bug 469366 can add them here?
Comment 35 Boris Zbarsky [:bz] (still a bit busy) 2009-04-14 06:59:52 PDT
So maybe the right thing to do is:

1) When removing removable script blockers, set a flag.
2) If a mutation happens in a document while the flag is set, add the document to
   a list.
3) When restoring removable script blockers, update child counts on content sinks
   for all documents in the list.

Jonas, Olli, what do you think of that approach?
Comment 36 Olli Pettay [:smaug] 2009-04-19 05:55:42 PDT
Sounds pretty ugly, but worth to try.

Does it help with:
> Hmm.  We aren't in an update in that last stack, are we?  At least not that I
> can see...
Comment 37 Boris Zbarsky [:bz] (still a bit busy) 2009-04-19 07:06:23 PDT
I think so; that stack was to the point where we create the frame the second time; the goal is to have child counts updated sometime before that.
Comment 38 Olli Pettay [:smaug] 2009-04-19 07:27:48 PDT
I wonder how to detect "If a mutation happens in a document while the flag is set". I guess you want to add something to Begin/EndUpdate?
Comment 39 Boris Zbarsky [:bz] (still a bit busy) 2009-04-19 07:45:21 PDT
Or to our existing mutation-tracker.
Comment 40 Dave Garrett 2009-05-05 07:40:42 PDT
*** Bug 490187 has been marked as a duplicate of this bug. ***
Comment 41 Dave Garrett 2009-05-08 08:01:57 PDT
*** Bug 491498 has been marked as a duplicate of this bug. ***
Comment 42 [:Cww] 2009-06-03 11:39:04 PDT
What's the best workaround (for users for now)?  (We're putting together crash KB articles)

Safemode/disable extensions?  Use noscript/adblock to disable javascript on bad sites?  Nothing?
Comment 43 Boris Zbarsky [:bz] (still a bit busy) 2009-06-03 12:38:06 PDT
Disabling js is the way to avoid this crash.
Comment 44 Matthew Middleton (:zzxc) 2009-06-03 14:29:36 PDT
A user on SUMO live chat was able to reproduce this by:
1. Go to
2. Search for a used Ford Fusion in zip code 46032
3. Click on a specific car to view details
4. Press the Back button
5. Repeat steps 3-4 several times, going between cars

These steps were able to crash Firefox with this stack during the chat session.

This user's crash reports: bp-c4d1301c-88d3-41f6-8cde-ff5352090603 bp-fa431e08-4ec8-4d65-beeb-3d0062090602 bp-44539fc2-351d-45fc-9bf6-50aa62090602
Comment 45 Samuel Sidler (old account; do not CC) 2009-06-16 07:59:01 PDT
Mats: Any work on this bug? It's still the #1 topcrash for Firefox 3.0.x...
Comment 46 Samuel Sidler (old account; do not CC) 2009-06-23 08:08:48 PDT
roc: Please find someone to work on this 1.9.0 blocker. We clearly can't take it for now, but this is a topcrash, a security issue, and a commonly seen issue by our users and it needs attention from (right now) someone on the layout team.
Comment 47 Robert O'Callahan (:roc) (email my personal email if necessary) 2009-06-23 12:17:25 PDT
From the comments, sounds like this is a content sink problem.

Olli is probably the best person to take it.
Comment 48 Samuel Sidler (old account; do not CC) 2009-06-23 13:14:45 PDT
Olli, can you spend some time on this for
Comment 49 Olli Pettay [:smaug] 2009-06-24 15:11:24 PDT
(In reply to comment #29)
> For the STR in comment 17 with Firefox 3.0.7pre
> MacOSX and Linux i686 nightly builds, I get the regression range
> 2009-02-03-04 -- 2009-02-04-04:

I don't get this. FF3 isn't in hg.
Comment 51 Olli Pettay [:smaug] 2009-06-25 07:26:07 PDT
Created attachment 385101 [details] [diff] [review]
possible patch
Comment 52 Olli Pettay [:smaug] 2009-06-25 07:27:43 PDT
Created attachment 385102 [details] [diff] [review]
a stack
Comment 53 Olli Pettay [:smaug] 2009-06-25 07:29:37 PDT
Created attachment 385104 [details]
a stack
Comment 54 Olli Pettay [:smaug] 2009-06-25 09:12:12 PDT
Comment on attachment 385101 [details] [diff] [review]
possible patch

Boris, Jonas, any comments to this.
Allow sink (but not layout) to be flushed, even though there are script blockers. This brings back the old behavior.
Other option would be to postpone iframe initialization, but that might be a bit more riskier change.
Comment 55 Boris Zbarsky [:bz] (still a bit busy) 2009-06-25 09:13:53 PDT
So would that patch be 1.9.0 branch only, since we do have delayed init on trunk, iirc?
Comment 56 Olli Pettay [:smaug] 2009-06-25 09:18:10 PDT
We do the same thing on trunk too.
FrameLoader init is delayed, but not the nsSubDocumentFrame init :(
Comment 57 Olli Pettay [:smaug] 2009-06-25 09:19:33 PDT
Test 1.9.0 builds are here
Comment 58 Boris Zbarsky [:bz] (still a bit busy) 2009-06-25 09:27:43 PDT
Hmm.  So looking at that last stack, that just shows where we end up flushing during scriptblocker, right?  And the key is that we're flushing content on the subframe and need to get that right per the document viewer comments, but there is a script blocker in the parent document, right?

It does seem like the right way to do this is to move the ShowDocShell() off on a script runner, but I can understand not wanting to do this for 1.9.0 or 1.9.1 at this point....  I assume we can still do that in a followup on trunk?  Or just get rid of sink flushing altogether, better yet.
Comment 59 Olli Pettay [:smaug] 2009-06-25 09:35:06 PDT
(In reply to comment #58)
> Hmm.  So looking at that last stack, that just shows where we end up flushing
> during scriptblocker, right?

> And the key is that we're flushing content on the
> subframe and need to get that right per the document viewer comments, but there
> is a script blocker in the parent document, right?

> I assume we can still do that in a followup on trunk?  Or
> just get rid of sink flushing altogether, better yet.
Either way, but yes.
Comment 60 Boris Zbarsky [:bz] (still a bit busy) 2009-06-25 13:45:49 PDT
OK.  Patch looks ok with the following caveats:

1)  Don't do the PostReflowEvent in DidCauseReflow.  That'd actually break things
    on trunk, I think.
2)  Use the nsAutoCauseReflowNotifier in VerifyIncrementalReflow.  
3)  File a bug on removing this stuff once we no longer have sink flushes (and
    mark dependent on the bug on removing those; check with Henri for the bug#
    and whether we have one).
Comment 61 Olli Pettay [:smaug] 2009-06-25 14:03:21 PDT
Created attachment 385216 [details] [diff] [review]
Comment 62 Olli Pettay [:smaug] 2009-06-25 14:19:11 PDT
Created attachment 385221 [details]
for trunk
Comment 63 Olli Pettay [:smaug] 2009-06-28 12:50:05 PDT
Comment on attachment 385216 [details] [diff] [review]

Either .12 or .13
Comment 64 Olli Pettay [:smaug] 2009-06-28 15:20:06 PDT

Marking fixed, since I landed the patch (which fixed the case) on trunk.
Comment 65 Daniel Veditz [:dveditz] 2009-07-03 21:03:54 PDT
Comment on attachment 385216 [details] [diff] [review]

Approved for, a=dveditz for release-drivers
Comment 66 Samuel Sidler (old account; do not CC) 2009-07-03 21:06:06 PDT
Olli: Thanks for your work on this. We've decided to take it for (as Dan showed above with approval). Please land ASAP as this will make us truly code-complete (and we need to hand off to build in ~2 days).
Comment 67 Olli Pettay [:smaug] 2009-07-04 08:41:49 PDT
Checking in layout/base/nsPresShell.cpp;
/cvsroot/mozilla/layout/base/nsPresShell.cpp,v  <--  nsPresShell.cpp
new revision: 3.1126; previous revision: 3.1125
Comment 68 Samuel Sidler (old account; do not CC) 2009-07-06 20:06:16 PDT
Fixed this in, so we should fix it in
Comment 69 Samuel Sidler (old account; do not CC) 2009-07-09 17:28:58 PDT
Comment on attachment 385216 [details] [diff] [review]

Approved for a=ss for release-drivers.
Comment 70 Olli Pettay [:smaug] 2009-07-14 03:20:37 PDT
Created attachment 388443 [details] [diff] [review]
Comment 72 Henrik Skupin (:whimboo) 2009-07-15 06:36:53 PDT
Olli, I cannot get Firefox 3.5 to crash on any of the given web pages. Can you give me a good example which you have used to reproduce the crash?
Comment 73 Olli Pettay [:smaug] 2009-07-15 06:58:02 PDT
Comment 44 has the steps-to-reproduce which I used when writing the patch.
Comment 74 Olli Pettay [:smaug] 2009-07-15 06:59:10 PDT
Ah, I used 1.9.0.x.
The crash may not happen so easily on 1.9.x
Comment 75 juan becerra [:juanb] 2009-07-15 16:21:53 PDT
If anyone is able to reproduce this crash in Fx3.5, and verify that it doesn't happen in the release candidate for 3.5.1, we would really appreciate it.
Comment 76 Mike Beltzner [:beltzner, not reading bugmail] 2009-07-15 22:25:50 PDT
I tried the steps in comment 44 and wasn't able to reproduce with the 07/15 build of 3.5.1pre - Olli, can you?
Comment 77 Henrik Skupin (:whimboo) 2009-07-16 04:11:37 PDT
(In reply to comment #76)
> I tried the steps in comment 44 and wasn't able to reproduce with the 07/15
> build of 3.5.1pre - Olli, can you?

I tried those steps more then 20 times with Firefox 3.5 but was never able to crash the application. That way I cannot imply that doing the same in means it is fixed for me. :/
Comment 78 Olli Pettay [:smaug] 2009-07-16 05:12:45 PDT
I can't reproduce the crash on but the problem is there.
That I can confirm if I put a printf to the right place which
shows that overstrict PresShell::IsSafeToFlush doesn't allow 
DocumentViewerImpl::InitPresentationStuff to flush.
Comment 79 Samuel Sidler (old account; do not CC) 2009-07-27 18:12:34 PDT
Olli: So this looks mostly fixed (it's no longer #1), but the topcrash is still appearing for some number of users. This stack signature is #16 overall for Firefox 3.0.12 (with far, far fewer crashes than 3.0.11 had). Should I spin a new bug for this or is there something obvious that was missed?
Comment 80 Olli Pettay [:smaug] 2009-07-27 21:33:18 PDT
I think it is better to file a new bug, hopefully with new testcases etc.
Comment 81 Samuel Sidler (old account; do not CC) 2009-08-07 15:40:50 PDT
That new bug would be bug 509132.

Note You need to log in before you can comment on or make changes to this bug.