55880 - Browser crashes on this page, all platforms

Status: VERIFIED DUPLICATE of bug 56335

(Core :: Layout, defect, P1)

Description

[Terri Preston]

Build 2000100909mn6
Platform: all

Expected result: Page to load

Actual results: the browser crashes, this occurs on all platforms
Steps to reproduce: copy this url into brower and press enter

Comment 1

[Terri Preston]

Attachment: HTML page that is causing the error

Comment 2

[Terri Preston]

This is the call stack information reported on a Win2k machine:

  
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
169]
     
   nsBlockFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6408]
     
   nsBlockFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6286]
     
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
211]
     
   nsBlockFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6408]
     
   nsBlockFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6286]
     
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
211]
     
   nsBlockFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6408]
     
   nsBlockFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6286]
     
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
211]
     
   nsContainerFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
155]
     
   nsTableCellFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line 
366]
     
   nsTableRowFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 
604]
     
   nsTableRowFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line 
552]
     
   nsTableRowGroupFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, 
line 278]
     
   nsTableRowGroupFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp, 
line 227]
     
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
211]
     
   nsContainerFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
155]
     
   nsTableFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1370]
     
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
211]
     
   nsTableOuterFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 
352]
     
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
211]
     
   nsBlockFrame::PaintFloaters 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6356]
     
   nsBlockFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6284]
     
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
211]
     
   nsBlockFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6408]
     
   nsBlockFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 6286]
     
   nsContainerFrame::PaintChild 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
211]
     
   nsContainerFrame::PaintChildren 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
155]
     
   nsHTMLContainerFrame::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line 
108]
     
   PresShell::Paint 
                                           
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4001]
     
   nsView::Paint 
                                           
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 284]
     
   nsViewManager2::RenderDisplayListElement
                                           
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 859]
     
   nsViewManager2::RenderViews 
                                           
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 806]
     
   nsViewManager2::Refresh 
                                           
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 686]
     
   nsViewManager2::DispatchEvent 
                                           
[d:\builds\seamonkey\mozilla\view\src\nsViewManager2.cpp, line 1352]
     
   HandleEvent 
                                           
[d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68]
     
   nsWindow::DispatchEvent 
                                           
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 685]
     
   nsWindow::DispatchWindowEvent 
                                           
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 707]
     
   nsWindow::OnPaint 
                                           
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3699]
     
   nsWindow::ProcessMessage 
                                           
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 2806]
     
   nsWindow::WindowProc 
                                           
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 951]
     
   USER32.DLL + 0x3eb0 (0x77e13eb0) 
                                            
     
   USER32.DLL + 0x591b (0x77e1591b) 
                                            
     
   USER32.DLL + 0x595d (0x77e1595d) 
                                            
     
   ntdll.dll + 0x1fb83 (0x77f9fb83) 
                                            
     
   USER32.DLL + 0x92da (0x77e192da) 
                                            
     
   nsAppShellService::Run 
                                           
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 408]
     
   netscp6.exe + 0x1711 (0x00401711) 
                                            
     
   netscp6.exe + 0x1230 (0x00401230) 
                                            
     
   netscp6.exe + 0x2aae (0x00402aae) 
                                            
     
   KERNEL32.DLL + 0x7903 (0x77e87903) 
                                            

Comment 3

[Chris Petersen]

I can reproduce this crash on the Oct 9 builds.

Comment 4

[Chris Petersen]

Attachment: Macsbug crash log file

Comment 5

[harishd]

Taking 5 of clayton's for triaging.

Comment 6

[harishd]

Triaging Claton's bug list:
---------------------------

Looks like buster's area. Reassinging to him and ccing waterson.

Comment 7

[buster]

Attachment: somewhat reduced test case. very touchy, change anything and the crash either changes, or goes away

Comment 8

[buster]

if I add in a null check in nsBlockFrame::PaintChildren, then the attached test
case crashes with the same stack as 56335.

try
  while ( kid && (--n >= 0)) {
at line
http://lxr.mozilla.org/seamonkey/source/layout/html/base/src/nsBlockFrame.cpp#6400

Comment 9

[buster]

*** This bug has been marked as a duplicate of 56335 ***

Comment 10

[Terri Preston]

Verified Duplicate