77630 - Mozilla crashes when opening this page

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Bas van Duijnhoven]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.8.1+)
Gecko/20010425
BuildID:    2001042504

Every time i try to open this page it will load partially but then Mozilla is
stopped by windows. (mozilla has generated errors etc.)
I havent got a clue what is going on here.

Reproducible: Always
Steps to Reproduce:
1.start mozilla
2.type url http://www.schaapskudde.nl
3.

Actual Results:  Mozilla is ended by windows

Expected Results:  Load and display the page

Comment 1

[timeless]

GKLAYOUT! 603311f8()
GKLAYOUT! 6033801d()
GKCONTENT! 60213bc7()
GKCONTENT! 60214cf9()
GKCONTENT! 60214ca1()
GKCONTENT! 60218571()
GKCONTENT! 6021a099()
GKCONTENT! 6020ed0a()
GKCONTENT! 6020ef7c()
GKCONTENT! 60215db2()
JSDOM! 60ca137c()
JSDOM! 60cb3b52()
JS3250! 60c56051()
JS3250! 60c5cc30()
JS3250! 60c62752()
JS3250! 60c62e2f()
JSDOM! 60ca4811()
GKCONTENT! 60222db4()
GKCONTENT! 602228b3()
GKCONTENT! 601e9e20()
GKPARSER! 603e319b()
GKPARSER! 603f189a()
GKPARSER! 603e2538()
GKPARSER! 603e1d55()
GKPARSER! 603e6c18()
GKPARSER! 603e62b7()
GKPARSER! 603e6edc()
GKPARSER! 603eb459()
GKCONTENT! 6024ca60()
NECKO! 607747c3()
NECKO! 607897a7()
NECKO! 60776345()
NECKO! 607893fa()
NECKO! 607759cb()
XPCOM! 60e95722()
SETUPAPI! 778b0c24()

TB29625181H

Comment 2

[Asa Dotzler [:asa]]

from timeless' talkback 

nsCSSFrameConstructor::GetAbsoluteContainingBlock  
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7420]         nsCSSFrameConstructor::ContentAppended  
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 8012]         StyleSetImpl::ContentAppended  
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1215]       
 PresShell::ContentAppended  
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4536]  
      nsDocument::ContentAppended  
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1537]       
 nsHTMLDocument::ContentAppended  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line
1282]         HTMLContentSink::NotifyAppend  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 4574]         SinkContext::FlushTags  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 2046]         HTMLContentSink::FlushPendingNotifications  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 5300]         nsHTMLDocument::FlushPendingNotifications  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line
1422]
nsHTMLDocument::ResolveName  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line
3410]
nsHTMLDocument::NamedItem  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line
3546]
nsHTMLDocument::Resolve  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line
3645]
nsJSUtils::nsGenericResolve  
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSUtils.cpp, line 622]
ResolveLocation   [d:\builds\seamonkey\mozilla\dom\src\base\nsJSLocation.cpp,
line 338]
js_LookupProperty   [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2044]
js_GetProperty   [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2179]
js_Interpret   [d:\builds\se
amonkey\mozilla\js\src\jsinterp.c, line 2546]
js_Execute   [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 994]
JS_EvaluateUCScriptForPrincipals   [d:\builds\seamonkey\mozilla\js\src\jsapi.c,
line 3289]
nsJSContext::EvaluateString  
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 610]
HTMLContentSink::EvaluateScript  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 4744]
HTMLContentSink::ProcessSCRIPTTag  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 5110]
HTMLContentSink::AddLeaf  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3234]
CNavDTD::AddLeaf   [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line
3808]
CNavDTD::HandleScriptToken  
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 2235]
CNavDTD::OpenContainer  
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3472]
CNavDTD::HandleDefaultStartToken  
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1300]
CNavDTD::HandleStartToken  
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1710]
CNavDTD::HandleToken   [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 878]
CNavDTD::BuildModel   [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 521]
nsParser::BuildModel   [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2031]
nsParser::ResumeParse  
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1910]
nsParser::ContinueParsing  
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1522]
HTMLContentSink::OnStreamComplete  
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 4897]
nsStreamLoader::OnStopRequest  
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 122]
nsHTTPFinalListener::OnStopRequest   [d:\builds\s
eamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cpp, line 1130]
nsStreamListenerTee::OnStopRequest  
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 25]
nsHTTPChannel::ResponseCompleted  
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPChannel.cpp, line 2439]
nsHTTPServerListener::OnStopRequest  
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cpp,
line 702]
nsOnStopRequestEvent::HandleEvent  
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 159]
PL_HandleEvent   [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 589]
PL_ProcessPendingEvents   [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 522]
_md_EventReceiverProc   [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 1070]
nsAppShellService::Run  
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 422]
main1   [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1012]
main   [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1303]
WinMain   [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1321]
WinMainCRTStartup()
    KERNEL32.DLL + 0x192a6 (0x77e992a6)

Comment 3

[Blake Ross]

-> style system

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

#4  <signal handler called>
#5  0x41d9bd8c in
nsCSSFrameConstructor::GetAbsoluteContainingBlock(nsIPresContext*, nsIFrame*)
(this=0x42f67aa0, aPresContext=0x428b5518, aFrame=0x42d834ac)
    at
/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp:7520
#6  0x41d9dd0f in nsCSSFrameConstructor::ContentAppended(nsIPresContext*,
nsIContent*, int) (this=0x42f67aa0, aPresContext=0x428b5518,
aContainer=0x42d8c9c0,
    aNewIndexInContainer=1)
    at
/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp:8108
#7  0x41745971 in StyleSetImpl::ContentAppended(nsIPresContext*, nsIContent*,
int) (this=0x42abe158, aPresContext=0x428b5518, aContainer=0x42d8c9c0,
    aNewIndexInContainer=1)
    at /builds/seamonkey/mozilla/content/base/src/nsStyleSet.cpp:1239


(gdb) frame 5
#5  0x41d9bd8c in
nsCSSFrameConstructor::GetAbsoluteContainingBlock(nsIPresContext*, nsIFrame*)
(this=0x42f67aa0, aPresContext=0x428b5518, aFrame=0x42d834ac)
    at
/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp:7520
7520            NS_RELEASE(frameType);
Current language:  auto; currently c++
(gdb) p frameType
$1 = (class nsIAtom *) 0x0


Considering that nsIFrame.h says:

1000   /**
1001    * Get the "type" of the frame. May return a NULL atom pointer
1002    *
1003    * @see nsLayoutAtoms
1004    */
1005   NS_IMETHOD  GetFrameType(nsIAtom** aType) const = 0;

I think this should be NS_IF_RELEASE instead of NS_RELEASE.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: fix for crash

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I still see some assertions loading the page, but this fixes the crash.

Comment 7

[Pierre Saslawsky]

r=pierre. Thanks David.

Comment 8

[tor]

sr=tor

Comment 9

[Bas van Duijnhoven]

Same problem in Win98 here is the error from windows:

MOZILLA heeft een fout met betrekking tot een ongeldige pagina veroorzaakt in
module GKLAYOUT.DLL op015f:6033167a.
Registers:
EAX=00000000 CS=015f EIP=6033167a EFLGS=00010206
EBX=0234de90 SS=0167 ESP=0068e990 EBP=0068e9a8
ECX=603b886c DS=0167 ESI=00000000 FS=22b7
EDX=0068e9b4 ES=0167 EDI=0238ab00 GS=0000
Bytes in CS:EIP:
8b 08 50 ff 51 08 83 65 0c 00 85 f6 75 1b 8b 45 
Stackdump:
00fc3354 00000000 021a3534 021a34b4 021a3534 00fc3354 0068eb18 60338603 
0234de90 00000000 00fc3354 00000000 0238a800 0238a808 00000001 01176160 

I hope you all can read dutch because it is in dutch (dutch version) its a 
invalid page fault. I dont know the exact translation in english, but the rest 
should be readable.

greets Bas

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to trunk, 2001-04-27 19:19 PDT.

Comment 11

[Bas van Duijnhoven]

Im seeing this again in the 2002030604 build, there should be at least two
talkback error on this one. Pleas fix asap its regressions like this one that
make me loose faith in the mozilla product being released for V1.0 some time
anytime.

this is todays windows error:

MOZILLA heeft een fout met betrekking tot een ongeldige pagina veroorzaakt in
module GKLAYOUT.DLL op015f:603bd6fc.
Registers:
EAX=00000000 CS=015f EIP=603bd6fc EFLGS=00010206
EBX=00000000 SS=0167 ESP=0064e3b0 EBP=0064e3c8
ECX=0064e524 DS=0167 ESI=0064e49c FS=3edf
EDX=40000000 ES=0167 EDI=0064e738 GS=0000
Bytes in CS:EIP:
8b 50 04 89 51 10 8b 40 08 89 41 14 8b 44 24 08 
Stackdump:
603bb552 00000000 0064e4bc 0064e6f8 01e971f4 00000000 0064e674 603b5196 0064e6f8
02385010 01e971f4 0064e7a4 00000000 02385010 01e971f4 0064e6f8 

I'm not seeing this in build nr 2001112009 (indeed an old one) but the page
looks garbled

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: stack

The new crash is a totally different bug.  We're crashing because we have a
null space manager because nothing bother to initialize it in the sequence of
reflowing an absolutely positioned fieldset.

Marc -- any ideas what in this stack should be responsible for initializing the
space manager on the reflow state.  I'm thinking perhaps the absolute
containing block (and then the block frame that's normally inside it would no
longer need NS_BLOCK_SPACE_MGR set, perhaps)?

Comment 13

[karnaze (gone)]

The new crash looks like bug 130251. Marking this one fixed.

Comment 14

[Hixie (not reading bugmail)]

dbaron: was the issue you raised above ever resolved? (comment 12)

Comment 15

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

It seems to be adequately covered by bug 130251.

Comment 16

[Arnoud Berendsen]

Verified with 20020722.