490480 - Firefox crashes when clicking [@ nsBlockInFlowLineIterator::Prev()] [@ gfxTextRun::`vector deleting destructor'(unsigned int) ]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[i]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)

clicking the header of freibrief.net when being in a forum or thread, but not on the start-page, will crash firefox after some tries.

Reproducible: Sometimes

Steps to Reproduce:
1. Goto http://freibrief.net/post16870.html?style=11 or another subpage of freibrief.net
2. click on "Freibrief" in the bottom-left of the header.

Actual Results:  
Firefox will crash in many cases, but only in the newest versions 3.0.9 and 3.0.10 and not on every system. Ubuntu (Linux) and Beta3.1b5 seem not to be effected.

Expected Results:  
Load the home-page.

These crashes where reproduced by me:
http://crash-stats.mozilla.com/report/index/f112f11f-9d04-4e5c-ac02-9e7f92090428
http://crash-stats.mozilla.com/report/index/2032dd71-ddc5-4853-934a-8132b2090428
http://crash-stats.mozilla.com/report/index/937774ba-1d55-45d0-84bc-1ebc82090425

Comment 1

[Steve England [:stevee]]

Is this crash reproducible if you make a new firefox profile?
- http://support.mozilla.com/en-US/kb/Managing+profiles

Comment 2

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b5pre) Gecko/20090428 Shiretoko/3.5b5pre ID:20090428041652

This crashes for me in a new profile, so no need to answer comment 1.

Signature	gfxTextRun::`vector deleting destructor'(unsigned int)
UUID	594a5857-fc31-4a19-b5cb-f73062090428
Time 	2009-04-28 09:21:27.052041
Uptime	24
Last Crash	47 seconds before submission
Product	Firefox
Version	3.5b5pre
Build ID	20090428041652
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x4
User Comments	https://bugzilla.mozilla.org/show_bug.cgi?id=490480
Processor Notes 	

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	gfxTextRun::`vector deleting destructor' 	
1 	xul.dll 	nsTextFrame::ClearTextRun 	layout/generic/nsTextFrameThebes.cpp:3683
2 	xul.dll 	nsContinuingTextFrame::Destroy 	layout/generic/nsTextFrameThebes.cpp:3483
3 	xul.dll 	nsBlockFrame::DoRemoveFrame 	layout/generic/nsBlockFrame.cpp:5456
4 		@0x0 	

So perhaps a dupe of bug 468491

Comment 3

[Tony Chung [:tchung]]

I repro'd the crash from comment 1.   Running on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4

Crash stack: http://crash-stats.mozilla.com/report/index/255509f6-9fcc-4bd7-b24c-ad4562090428

Comment 4

[Tony Chung [:tchung]]

just a sec.  i think we're seeing two different stacks on 3.0.x (comment 1), versus 3.5.x (comment 2 and comment 3).   Though the testcase is the same, The latter may be bug 468491 on 1.9.1 branch. 

Stevee will investigate 3.0.10 more and report back here.

Comment 5

[Steve England [:stevee]]

I have personally been unable to cause this to crash with Firefox 3.0.10 ( Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 )

[e-mail] could you please try crashing Firefox by making a new firefox profile as per comment 1?

We may have two different crashers here caused by the same page. One that effects the trunk and the 1.9.1 branch in the same way, and a second crasher that causes 1.9.0/Firefox3.0.x to crash in a different way, which may or may not be related to your Firefox profile.

I'm having a hard time getting crash-stats to return my search queries for the @ nsBlockInFlowLineIterator::Prev() crash on 1.9.0/Firefox3.0.x but I'll keep trying so we can see how frequent this crash is.

Comment 6

[i]

The problem even appears with a new profile:
http://crash-stats.mozilla.com/report/index/47d2ffb1-aa35-490e-855d-882222090428
http://crash-stats.mozilla.com/report/index/b86e929e-2435-48bf-9ddc-6d6512090428

Using another style of freibrief.net, there are no crashes: http://freibrief.net/?style=20

Comment 7

[fox_mkdnhv]

Adding this code to the userContent.css removes the problem:
@-moz-document domain("freibrief.net") {
  #lastpost #lp_content:first-letter {
    float: none !important;
  }
}
It affects the first letter in the dynamic box which is currently headlined "Daimler hat die Schweinegrippe".

Comment 8

[Marcia Knous [:marcia]]

Adding Martijn to this bug. A bunch of these crashes showed up on as new crashes on the trunk today, http://tinyurl.com/255pala links to the Windows Crashes. There are also crashes on Mac and Linux with a slightly different stack,  [@ nsBlockInFlowLineIterator::Prev ].

A few comments from users that hit this crash today:

scrolled to the bottom and then fast scrolled to the top (probably past) of a page

I was resizing a text box on a forum posting

Comment 9

[alex_mayorga]

Crashed http://crash-stats.mozilla.com/report/index/bp-40d54c0d-c23a-41dc-b097-ca8b82100916 on Mozilla/5.0 (Windows NT 6.0; rv:2.0b7pre) Gecko/20100916 Firefox/4.0b7pre ID:20100916041016

Let me know if anything is needed from my end.

Thanks!

Comment 10

[Mats Palmgren (inactive)]

Is this crash still reproducible in a nightly build?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central/

Comment 11

[alex_mayorga]

I would say this WFM on Mozilla/5.0 (Windows NT 6.0; rv:6.0a1) Gecko/20110413 Firefox/6.0a1 now.

Comment 12

[Martijn Wargers (dead)]

Let's mark it worksforme then. Thanks for testing it, Alex!