491498 - Crash in xul.dll in method nsSubDocumentFrame::Reflow

Status: RESOLVED DUPLICATE of bug 482578

(Core :: XUL, defect)

Description

[Timo Witte]

User-Agent:       Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)
Build Identifier: Firefox 3.0.10

crash if i login on a specific website but i think it´s a problem with xul not with the website ;-)

crash @698D8917 in xul.dll it trys to access the adress 0x4

698D8917  mov         esi,dword ptr [eax+4] 

Reproducible: Always

Steps to Reproduce:
1. browse to website
2. login
3. firefox crashes with bug reporter (visual studio starts debugging)
Actual Results:  
Crash because of access to a protected memmory area

Expected Results:  
Correct function ;-)

698D8902  mov         eax,dword ptr [esi+20h] 
698D8905  add         eax,dword ptr [esi+18h] 
698D8908  sub         dword ptr [esp+14h],eax 
698D890C  push        dword ptr [esp+1Ch] 
698D8910  mov         eax,dword ptr [edi+34h] 
698D8913  push        dword ptr [esp+1Ch] 
-> 698D8917  mov         esi,dword ptr [eax+4]  // crashes here
698D891A  mov         ecx,dword ptr [esi] 
698D891C  push        eax  
698D891D  push        esi  
698D891E  call        dword ptr [ecx+4Ch] 
698D8921  mov         eax,dword ptr [esp+10h] 
698D8925  and         dword ptr [esp+18h],0

Comment 1

[Timo Witte]

maybe related to 469366 (don´t know)

Comment 2

[Timo Witte]

http://crash-stats.mozilla.com/report/index/df974640-ee2c-4272-ac25-9be0a2090505 <- adress of crashreport

Comment 4

[Arie Paap [:wildmyron]]

Based on the stack here and the stack in bug 469366 this is a duplicate of bug 482578 (security sensitive).

Comment 5

[Timo Witte]

You are not authorized to access bug #482578.  <- damn... :-(

Comment 6

[Dave Garrett]

bp-df974640-ee2c-4272-ac25-9be0a2090505
0  	xul.dll  	nsSubDocumentFrame::Reflow  	 mozilla/layout/generic/nsFrameFrame.cpp:544
1 	xul.dll 	nsLineLayout::ReflowFrame 	mozilla/layout/generic/nsLineLayout.cpp:859
2 	xul.dll 	nsBlockFrame::ReflowInlineFrame 	mozilla/layout/generic/nsBlockFrame.cpp:3570
3 	xul.dll 	nsBlockFrame::DoReflowInlineFrames 	mozilla/layout/generic/nsBlockFrame.cpp:3392
4 	xul.dll 	nsBlockFrame::ReflowInlineFrames 	mozilla/layout/generic/nsBlockFrame.cpp:3241
5 	xul.dll 	nsBlockFrame::ReflowLine 	mozilla/layout/generic/nsBlockFrame.cpp:2308
6 	xul.dll 	nsBlockFrame::ReflowDirtyLines 	mozilla/layout/generic/nsBlockFrame.cpp:1888
7 	xul.dll 	nsBlockFrame::Reflow 	mozilla/layout/generic/nsBlockFrame.cpp:955
8 	xul.dll 	nsContainerFrame::ReflowChild 	mozilla/layout/generic/nsContainerFrame.cpp:775
9 	xul.dll 	nsTableCellFrame::Reflow 	mozilla/layout/tables/nsTableCellFrame.cpp:895
10 	xul.dll 	nsContainerFrame::ReflowChild 	mozilla/layout/generic/nsContainerFrame.cpp:775
11 	xul.dll 	nsTableRowFrame::ReflowChildren 	mozilla/layout/tables/nsTableRowFrame.cpp:901
12 	xul.dll 	nsTableRowFrame::Reflow 	mozilla/layout/tables/nsTableRowFrame.cpp:1059
13 	xul.dll 	nsContainerFrame::ReflowChild 	mozilla/layout/generic/nsContainerFrame.cpp:775
...
...


Yep, dupe of bug 469366, bug 482578.