93657 - mozilla crashes on zvon.org site

Status: VERIFIED WORKSFORME

(Core :: XSLT, defect, P3)

Description

[Markus Hübner]

Must be some kind of regression since this worked fine in 0.9.2
(build 2001072503)
Crashed with build 2001080303

What I discovered is that the page is crashing in about 80% in the first place. 
Just do a "reload" and it will crash then.

Talkback ID - TB33726167G

Comment 1

[Stuart Parmenter]

This looks like some container frame isn't destroying its children properly.. 
probably related to the asserts on the page.

from talkback:

nsStyleContext::GetStyleData 
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleContext.cpp, line 370] 
nsFrame::GetStyleData 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrame.cpp, line 516] 
nsTransform2D::TransformCoord 
[d:\builds\seamonkey\mozilla\gfx\src\nsTransform2D.cpp, line 563] 
nsImageFrame::OnDataAvailable 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 345] 
nsImageListener::OnDataAvailable 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsImageFrame.cpp, line 1738] 
imgRequestProxy::OnDataAvailable 
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequestProxy.cpp, line 316] 
imgRequest::OnDataAvailable 
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequest.cpp, line 457] 
nsGIFDecoder2::FlushImageData 
[d:\builds\seamonkey\mozilla\modules\libpr0n\decoders\gif\nsGIFDecoder2.cpp, 
line 193] 
EndImageFrame 
[d:\builds\seamonkey\mozilla\modules\libpr0n\decoders\gif\nsGIFDecoder2.cpp, 
line 361] 
gif_write [d:\builds\seamonkey\mozilla\modules\libpr0n\decoders\gif\GIF2.cpp, 
line 1502] 
nsGIFDecoder2::ProcessData 
[d:\builds\seamonkey\mozilla\modules\libpr0n\decoders\gif\nsGIFDecoder2.cpp, 
line 208] 
ReadDataOut 
[d:\builds\seamonkey\mozilla\modules\libpr0n\decoders\gif\nsGIFDecoder2.cpp, 
line 156] 
nsInputStreamTee::WriteSegmentFun 
[d:\builds\seamonkey\mozilla\xpcom\io\nsInputStreamTee.cpp, line 82] 
nsInputStreamTee::ReadSegments 
[d:\builds\seamonkey\mozilla\xpcom\io\nsInputStreamTee.cpp, line 138] 
nsGIFDecoder2::WriteFrom 
[d:\builds\seamonkey\mozilla\modules\libpr0n\decoders\gif\nsGIFDecoder2.cpp, 
line 229] 
imgRequest::OnDataAvailable 
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequest.cpp, line 741] 
ProxyListener::OnDataAvailable 
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgLoader.cpp, line 402] 
nsStreamListenerTee::OnDataAvailable 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 57] 
nsHttpChannel::OnDataAvailable 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
2176] 
nsOnDataAvailableEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 
188] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 1072] 
nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 425] 
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1297] 
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1602] 
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1620] 
WinMainCRTStartup() 
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 2

[Stuart Parmenter]

->layout

Comment 3

[Axel Hecht]

WARNING: The zvon pages with xslt view have tons of assertions, I need to file
an evangelism bug. Sorry for that. He's adding xlink attributes to html pages,
content doesn't like that.

We triggered the assertion of previous viewer in bug 93414, but dbaron said
we'd be ok.

Axel

Comment 4

[Axel Hecht]

ok, I can't track the regression. Gagan's slides bus error on me for builds
at least back to 7/23. I can't reproduce the crasher on the zvon page on that
build though. Maybe something got rewired by dbaron's checkin on 7/31 to trigger
the bug.
Here is an easy way to reproduce:
start up a browser with 
http://mozilla.org/projects/netlib/osc2001/slide1.xml
and click on NEXT. Crash, boom, bang. (no namespace assertions, so it aint that)
This is obviously (another?) frame yadda.

Here is stack, assertions, warnings:

Document http://mozilla.org/projects/netlib/osc2001/slide1.xml loaded
successfully
Disabling Quirk StyleSheet
Block(ListItem)(1)@a687e8: Init: bad caller: width WAS 1073741184(0x3ffffd80)
Block(ListItem)(3)@a68b28: Init: bad caller: width WAS 1073741184(0x3ffffd80)
Block(ListItem)(5)@a68cdc: Init: bad caller: width WAS 1073741184(0x3ffffd80)
Block(ListItem)(7)@a68e90: Init: bad caller: width WAS 1073741184(0x3ffffd80)
Block(ListItem)(9)@76b158: Init: bad caller: width WAS 1073741184(0x3ffffd80)
Block(ListItem)(11)@76b30c: Init: bad caller: width WAS 1073741184(0x3ffffd80)
###!!! ASSERTION: bad math, newAvailWidth is infinite: 'NS_UNCONSTRAINEDSIZE !=
newAvailWidth', file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! Break: at file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
0 /tmp/build/dist/bin/libxpcom.so:nsTraceRefcnt::WalkTheStack(FILE *)+0xbc
1 /tmp/build/dist/bin/libxpcom.so:nsDebug::Break(char const *, int)+0x1d0
2 /tmp/build/dist/bin/libxpcom.so:nsDebug::Assertion(char const *, char const *,
char const *, int)+0xec
3
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::PrepareResizeReflow(nsBlockReflowState
&)+0x34c
4
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::Reflow(nsIPresContext
*, nsHTMLReflowMetrics &, nsHTMLReflowState const &, unsigned int &)+0x7b0
5
/tmp/build/dist/bin/components/libgklayout.so:nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState
&, nsReflowReason, nsIFrame *, nsRect const &, int, int, int, nsMargin &,
unsigned int &)+0x638
6
/tmp/build/dist/bin/components/libgklayout.so:nsBlockReflowContext::ReflowBlock(nsIFrame
*, nsRect const &, int, int, int, nsMargin &, unsigned int &)+0x3dc
7
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::ReflowBlockFrame(nsBlockReflowState
&, nsLineBox *, int *)+0x3bc
8
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::ReflowLine(nsBlockReflowState
&, nsLineBox *, int *, int)+0xec
9
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::ReflowDirtyLines(nsBlockReflowState
&)+0x49c
10
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::Reflow(nsIPresContext
*, nsHTMLReflowMetrics &, nsHTMLReflowState const &, unsigned int &)+0x86c
11
/tmp/build/dist/bin/components/libgklayout.so:nsLineLayout::ReflowFrame(nsIFrame
*, nsIFrame **, unsigned int &, nsHTMLReflowMetrics *, int &)+0x918
12
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::ReflowInlineFrame(nsBlockReflowState
&, nsLineLayout &, nsLineBox *, nsIFrame *, unsigned char *)+0x84
13
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState
&, nsLineLayout &, nsLineBox *, int *, unsigned char *, int, int)+0x274
14
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState
&, nsLineBox *, int *, unsigned char *, int, int)+0xa4
15
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::ReflowInlineFrames(nsBlockReflowState
&, nsLineBox *, int *, int, int)+0xcc
16
/tmp/build/dist/bin/components/libgklayout.so:nsBlockFrame::ReflowLine(nsBlockReflowState
&, nsLineBox *, int *, int)+0x614
17
/tmp/build/dist/bin/components/libgklayout.so:nsContainerFrame::ReflowChild(nsIFrame
*, nsIPresContext *, nsHTMLReflowMetrics &, nsHTMLReflowState const &, int, int,
unsigned int, unsigned int &)+0x1a4
18
/tmp/build/dist/bin/components/libgklayout.so:CanvasFrame::Reflow(nsIPresContext
*, nsHTMLReflowMetrics &, nsHTMLReflowState const &, unsigned int &)+0x3b0
19
/tmp/build/dist/bin/components/libgklayout.so:nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState
&, nsIPresContext *, nsHTMLReflowMetrics &, nsHTMLReflowState const &, unsigned
int &, int, int, int, int, int)+0xa6c
20
/tmp/build/dist/bin/components/libgklayout.so:nsBoxToBlockAdaptor::DoLayout(nsBoxLayoutState
&)+0x1a4
21 /tmp/build/dist/bin/components/libgklayout.so:nsBox::Layout(nsBoxLayoutState
&)+0x5c
22
/tmp/build/dist/bin/components/libgklayout.so:nsScrollBoxFrame::DoLayout(nsBoxLayoutState
&)+0x344
23
/tmp/build/dist/bin/components/libgklayout.so:nsContainerBox::LayoutChildAt(nsBoxLayoutState
&, nsIBox *, nsRect const &)+0x1d0
24
/tmp/build/dist/bin/components/libgklayout.so:nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState
&, nsIBox *, nsRect const &)+0x20
25
/tmp/build/dist/bin/components/libgklayout.so:nsGfxScrollFrameInner::Layout(nsBoxLayoutState
&)+0x84c
26
/tmp/build/dist/bin/components/libgklayout.so:nsGfxScrollFrame::DoLayout(nsBoxLayoutState
&)+0x48

27
/tmp/build/dist/bin/components/libgklayout.so:nsBoxFrame::Reflow(nsIPresContext
*, nsHTMLReflowMetrics &, nsHTMLReflowState const &, unsigned int &)+0x474
28
/tmp/build/dist/bin/components/libgklayout.so:nsGfxScrollFrame::Reflow(nsIPresContext
*, nsHTMLReflowMetrics &, nsHTMLReflowState const &, unsigned int &)+0xb4
29
/tmp/build/dist/bin/components/libgklayout.so:ViewportFrame::Reflow(nsIPresContext
*, nsHTMLReflowMetrics &, nsHTMLReflowState const &, unsigned int &)+0x478
30 /tmp/build/dist/bin/components/libgklayout.so:PresShell::InitialReflow(int,
int)+0x940
31
/tmp/build/dist/bin/components/libgkcontent.so:nsXMLContentSink::StartLayout(void)+0x31c
32
/tmp/build/dist/bin/components/libgkcontent.so:nsXMLContentSink::DidBuildModel(int)+0x3b0
33
/tmp/build/dist/bin/components/libhtmlpars.so:CWellFormedDTD::DidBuildModel(unsigned
int, int, nsIParser *, nsIContentSink *)+0xa4
...
###!!! ASSERTION: bad math, newAvailWidth is infinite: 'NS_UNCONSTRAINEDSIZE !=
newAvailWidth', file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! Break: at file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! ASSERTION: bad math, newAvailWidth is infinite: 'NS_UNCONSTRAINEDSIZE !=
newAvailWidth', file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! Break: at file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! ASSERTION: bad math, newAvailWidth is infinite: 'NS_UNCONSTRAINEDSIZE !=
newAvailWidth', file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! Break: at file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! ASSERTION: bad math, newAvailWidth is infinite: 'NS_UNCONSTRAINEDSIZE !=
newAvailWidth', file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! Break: at file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! ASSERTION: bad math, newAvailWidth is infinite: 'NS_UNCONSTRAINEDSIZE !=
newAvailWidth', file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
###!!! Break: at file /tmp/mozilla/layout/html/base/src/nsBlockFrame.cpp, line
1695
Bus Error

Comment 5

[Markus Hübner]

updating keyword

Comment 6

[karnaze (gone)]

Reassigning to attinasi.

Comment 7

[Marc Attinasi]

I'm getting a very different stack, looks to me like the imageListener has a
stale frame pointer (already deleted):

nsImageListener::OnStartDecode(nsImageListener * const 0x06ef5610, imgIRequest *
0x06ef8310, nsISupports * 0x0503f5d0) line 1719 + 28 bytes
imgRequestProxy::OnStartDecode(imgRequestProxy * const 0x06ef8314, imgIRequest *
0x00000000, nsISupports * 0x00000000) line 283
imgRequest::OnStartDecode(imgRequest * const 0x06ef6a74, imgIRequest *
0x00000000, nsISupports * 0x00000000) line 394
BeginGIF(void * 0x06e56f80, unsigned int 85, unsigned int 25, unsigned char 0)
line 290
gif_write(gif_struct * 0x06e57940, const unsigned char * 0x02becdc0, unsigned
int 503) line 990 + 42 bytes
nsGIFDecoder2::ProcessData(nsGIFDecoder2 * const 0x06e56f80, unsigned char *
0x02becdc0, unsigned int 503) line 205 + 20 bytes
ReadDataOut(nsIInputStream * 0x06e47580, void * 0x06e56f80, const char *
0x02becdc0, unsigned int 0, unsigned int 503, unsigned int * 0x0012f804) line
155 + 17 bytes
nsPipe::nsPipeInputStream::ReadSegments(nsPipe::nsPipeInputStream * const
0x06e47580, unsigned int (nsIInputStream *, void *, const char *, unsigned int,
unsigned int, unsigned int *)* 0x035d1dd0 ReadDataOut(nsIInputStream *, void *,
const char *, unsigned int, unsigned int, unsigned int *), void * 0x06e56f80,
unsigned int 503, unsigned int * 0x0012fa40) line 411 + 29 bytes
nsGIFDecoder2::WriteFrom(nsGIFDecoder2 * const 0x06e56f80, nsIInputStream *
0x06e47580, unsigned int 503, unsigned int * 0x0012fa40) line 229
imgRequest::OnDataAvailable(imgRequest * const 0x06ef6a78, nsIRequest *
0x06ef5260, nsISupports * 0x00000000, nsIInputStream * 0x06e47580, unsigned int
0, unsigned int 503) line 739 + 47 bytes
ProxyListener::OnDataAvailable(ProxyListener * const 0x06ef5430, nsIRequest *
0x06ef5260, nsISupports * 0x00000000, nsIInputStream * 0x06e47580, unsigned int
0, unsigned int 503) line 402
nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x06ef5264, nsIRequest *
0x06e47804, nsISupports * 0x00000000, nsIInputStream * 0x06e47580, unsigned int
0, unsigned int 503) line 2186 + 57 bytes
nsOnDataAvailableEvent::HandleEvent() line 178 + 70 bytes
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x06e4cf04) line 65
PL_HandleEvent(PLEvent * 0x06e4cf04) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010d88d0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0080015e, unsigned int 49488, unsigned int 0,
long 17664208) line 1071 + 9 bytes
USER32! 77e12e98()
USER32! 77e130e0()
USER32! 77e15824()
nsAppShellService::Run(nsAppShellService * const 0x01138420) line 425
main1(int 1, char * * 0x00485f20, nsISupports * 0x00000000) line 1309 + 32 bytes
main(int 1, char * * 0x00485f20) line 1623 + 37 bytes
mainCRTStartup() line 338 + 17 bytes


I'll try to investigate further and find out why the frame image loader is
outliving the frame it is suppossed to service.

Comment 8

[Marc Attinasi]

Bulk-reassign of some crashers to Waterson - thanks Chris.

Comment 9

[Chris Waterson]

Pulling in.

Comment 10

[Chris Waterson]

Attachment: minimized XSLT style sheet

Comment 11

[Chris Waterson]

Attachment: empty JS script

Comment 12

[Chris Waterson]

Attachment: minimized test case

Comment 13

[Chris Waterson]

Minimized this a bit. Save the above attachments to your hard drive as follows:

- attachment 49691 [details] as 93657-xslt.xml
- attachment 49693 [details] as 93657.js
- attachment 49694 [details] as 93657.xml

Open 93657.xml, hit reload, and you'll crash. I see a stack trace similar to
what marc saw; i.e., crashing on an image loader that's pointing to a dead frame.

Comment 14

[Chris Waterson]

The first time we do an InitialReflow() appears to be when the
XSLTProcessor is done transforming the document (see frame #6). The
XSLT processor appears to be responding to the evaluation of the JS
script (frame #15):


#0  nsCSSFrameConstructor::ContentInserted (this=0x82b8d38, 
    aPresContext=0x828e5c8, aContainer=0x0, aChild=0x82bf388, 
    aIndexInContainer=0, aFrameState=0x0)
    at ../../../../../mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp:8299
#1  0x41816095 in StyleSetImpl::ContentInserted (this=0x82b8cb8, 
    aPresContext=0x828e5c8, aContainer=0x0, aChild=0x82bf388, 
    aIndexInContainer=0)
    at ../../../../mozilla/content/base/src/nsStyleSet.cpp:1186
#2  0x4220b9ce in PresShell::InitialReflow (this=0x82b1008, aWidth=11780, 
    aHeight=6080)
    at ../../../../../mozilla/layout/html/base/src/nsPresShell.cpp:2624
#3  0x416eb5b2 in nsXMLContentSink::StartLayout (this=0x8271df0)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:1643
#4  0x416e5978 in nsXMLContentSink::Observe (this=0x8271df0, 
    aSubject=0x82bf3b0, aTopic=0xbfffec78, someData=0x0)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:387
#5  0x40153c37 in nsObserverService::Notify (this=0x80f3170, 
    aSubject=0x82bf3b0, aTopic=0xbfffec78, someData=0x0)
    at ../../../mozilla/xpcom/ds/nsObserverService.cpp:236
#6  0x424a9e45 in XSLTProcessor::TransformDocument (this=0x82b5240, 
    aSourceDOM=0x827035c, aStyleDOM=0x82b73ac, aOutputDoc=0x82bd854, 
    aObserver=0x8271df4)
    at
../../../../../mozilla/extensions/transformiix/source/xslt/XSLTProcessor.cpp:2060
#7  0x416f1f09 in nsTransformMediator::TryToTransform (this=0x82a1120)
    at ../../../../../mozilla/content/xsl/document/src/nsTransformMediator.cpp:105
#8  0x416f2087 in nsTransformMediator::SetTransformObserver (this=0x82a1120, 
    aObserver=0x8271df4)
    at ../../../../../mozilla/content/xsl/document/src/nsTransformMediator.cpp:154
#9  0x416e60fb in nsXMLContentSink::SetupTransformMediator (this=0x8271df0)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:456
#10 0x416e5573 in nsXMLContentSink::DidBuildModel (this=0x8271df0, 
    aQualityLevel=1)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:329
#11 0x412ed665 in CWellFormedDTD::DidBuildModel (this=0x824e268, 
    anErrorCode=0, aNotifySink=1, aParser=0x82708f0, aSink=0x8271df0)
    at ../../../mozilla/htmlparser/src/nsWellFormedDTD.cpp:291
#12 0x412e4870 in nsParser::DidBuildModel (this=0x82708f0, anErrorCode=0)
    at ../../../mozilla/htmlparser/src/nsParser.cpp:1405
#13 0x412e580b in nsParser::ResumeParse (this=0x82708f0, allowIteration=1, 
    aIsFinalChunk=1) at ../../../mozilla/htmlparser/src/nsParser.cpp:1922
#14 0x412e4a96 in nsParser::ContinueParsing (this=0x82708f0)
    at ../../../mozilla/htmlparser/src/nsParser.cpp:1507
#15 0x416ebfd7 in nsXMLContentSink::ScriptEvaluated (this=0x8271df0, 
    aResult=0, aElement=0x82b8578, aIsInline=0, aWasPending=1)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:1792
#16 0x41828fae in nsScriptLoader::FireScriptEvaluated (this=0x8271f40, 
    aResult=0, aRequest=0x82705b8)
    at ../../../../mozilla/content/base/src/nsScriptLoader.cpp:525
#17 0x41828d08 in nsScriptLoader::ProcessRequest (this=0x8271f40, 
    aRequest=0x82705b8)
    at ../../../../mozilla/content/base/src/nsScriptLoader.cpp:484
#18 0x4182a4e9 in nsScriptLoader::OnStreamComplete (this=0x8271f40, 
    aLoader=0x82b8730, aContext=0x82705b8, aStatus=0, stringLen=3, 
    string=0x81808b8 "\n\n\n")
    at ../../../../mozilla/content/base/src/nsScriptLoader.cpp:759
#19 0x4098d5bd in nsStreamLoader::OnStopRequest (this=0x82b8730, 
    request=0x82b8a10, ctxt=0x0, aStatus=0)
    at ../../../../mozilla/netwerk/base/src/nsStreamLoader.cpp:121
#20 0x409c9e93 in nsFileChannel::OnStopRequest (this=0x82b8a10, 
    request=0x82b8b0c, context=0x0, aStatus=0)
    at ../../../../../mozilla/netwerk/protocol/file/src/nsFileChannel.cpp:465
#21 0x409ebeb8 in nsOnStopRequestEvent::HandleEvent (this=0x82bc698)
    at ../../../../mozilla/netwerk/base/src/nsRequestObserverProxy.cpp:161
#22 0x40977f8c in nsARequestObserverEvent::HandlePLEvent (plev=0x82bc698)
    at ../../../../mozilla/netwerk/base/src/nsRequestObserverProxy.cpp:64
#23 0x4019ffe4 in PL_HandleEvent (self=0x82bc698)
    at ../../../mozilla/xpcom/threads/plevent.c:590
#24 0x4019fdf9 in PL_ProcessPendingEvents (self=0x812daf0)
    at ../../../mozilla/xpcom/threads/plevent.c:520
#25 0x401a20b2 in nsEventQueueImpl::ProcessPendingEvents (this=0x812da70)
    at ../../../mozilla/xpcom/threads/nsEventQueue.cpp:374
#26 0x40a73b44 in ?? ()
   from /usr/src/seamonkey/debug/dist/bin/components/libwidget_gtk.so
#27 0x40a73723 in ?? ()
   from /usr/src/seamonkey/debug/dist/bin/components/libwidget_gtk.so
#28 0x4046d01e in ?? () from /usr/lib/libglib-1.2.so.0
#29 0x4046e7f3 in ?? () from /usr/lib/libglib-1.2.so.0
#30 0x4046edd9 in ?? () from /usr/lib/libglib-1.2.so.0
#31 0x4046ef8c in ?? () from /usr/lib/libglib-1.2.so.0
#32 0x40382803 in ?? () from /usr/lib/libgtk-1.2.so.0
#33 0x40a741b9 in ?? ()
   from /usr/src/seamonkey/debug/dist/bin/components/libwidget_gtk.so
#34 0x0807d50f in nsNativeViewerApp::Run (this=0x80f2fd8)
    at ../../../../../../mozilla/webshell/tests/viewer/unix/gtk/nsGtkMain.cpp:58
#35 0x0807d7a8 in main (argc=2, argv=0xbffff984)
    at ../../../../../../mozilla/webshell/tests/viewer/unix/gtk/nsGtkMain.cpp:180
#36 0x405b8177 in ?? () from /lib/i686/libc.so.6


But later, when we re-load the document, the old document still has
some kick left to it. Specifically, it looks like we're trying to
re-evaluate the script in the old document (note the pointers to the
PresShell, etc. are the same as above).


#0  nsCSSFrameConstructor::ContentInserted (this=0x82b8d38, 
    aPresContext=0x828e5c8, aContainer=0x0, aChild=0x82cf690, 
    aIndexInContainer=0, aFrameState=0x0)
    at ../../../../../mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp:8299
#1  0x41816095 in StyleSetImpl::ContentInserted (this=0x82b8cb8, 
    aPresContext=0x828e5c8, aContainer=0x0, aChild=0x82cf690, 
    aIndexInContainer=0)
    at ../../../../mozilla/content/base/src/nsStyleSet.cpp:1186
#2  0x4220b9ce in PresShell::InitialReflow (this=0x82b1008, aWidth=11780, 
    aHeight=6080)
    at ../../../../../mozilla/layout/html/base/src/nsPresShell.cpp:2624
#3  0x416eb5b2 in nsXMLContentSink::StartLayout (this=0x8271df0)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:1643
#4  0x416e5978 in nsXMLContentSink::Observe (this=0x8271df0, 
    aSubject=0x82cf6b8, aTopic=0xbfffec78, someData=0x0)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:387
#5  0x40153c37 in nsObserverService::Notify (this=0x80f3170, 
    aSubject=0x82cf6b8, aTopic=0xbfffec78, someData=0x0)
    at ../../../mozilla/xpcom/ds/nsObserverService.cpp:236
#6  0x424a9e45 in XSLTProcessor::TransformDocument (this=0x82b8010, 
    aSourceDOM=0x8214754, aStyleDOM=0x8301074, aOutputDoc=0x83016a4, 
    aObserver=0x82c41c4)
    at
../../../../../mozilla/extensions/transformiix/source/xslt/XSLTProcessor.cpp:2060
#7  0x416f1f09 in nsTransformMediator::TryToTransform (this=0x8306930)
    at ../../../../../mozilla/content/xsl/document/src/nsTransformMediator.cpp:105
#8  0x416f2087 in nsTransformMediator::SetTransformObserver (this=0x8306930, 
    aObserver=0x82c41c4)
    at ../../../../../mozilla/content/xsl/document/src/nsTransformMediator.cpp:154
#9  0x416e60fb in nsXMLContentSink::SetupTransformMediator (this=0x82c41c0)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:456
#10 0x416e5573 in nsXMLContentSink::DidBuildModel (this=0x82c41c0, 
    aQualityLevel=1)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:329
#11 0x412ed665 in CWellFormedDTD::DidBuildModel (this=0x82b9320, 
    anErrorCode=0, aNotifySink=1, aParser=0x8215268, aSink=0x82c41c0)
    at ../../../mozilla/htmlparser/src/nsWellFormedDTD.cpp:291
#12 0x412e4870 in nsParser::DidBuildModel (this=0x8215268, anErrorCode=0)
    at ../../../mozilla/htmlparser/src/nsParser.cpp:1405
#13 0x412e580b in nsParser::ResumeParse (this=0x8215268, allowIteration=1, 
    aIsFinalChunk=1) at ../../../mozilla/htmlparser/src/nsParser.cpp:1922
#14 0x412e4a96 in nsParser::ContinueParsing (this=0x8215268)
    at ../../../mozilla/htmlparser/src/nsParser.cpp:1507
#15 0x416ebfd7 in nsXMLContentSink::ScriptEvaluated (this=0x82c41c0, 
    aResult=0, aElement=0x83020a0, aIsInline=0, aWasPending=1)
    at ../../../../../mozilla/content/xml/document/src/nsXMLContentSink.cpp:1792
#16 0x41828fae in nsScriptLoader::FireScriptEvaluated (this=0x8271c80, 
    aResult=0, aRequest=0x83021c8)
    at ../../../../mozilla/content/base/src/nsScriptLoader.cpp:525
#17 0x41828d08 in nsScriptLoader::ProcessRequest (this=0x8271c80, 
    aRequest=0x83021c8)
    at ../../../../mozilla/content/base/src/nsScriptLoader.cpp:484
#18 0x4182a4e9 in nsScriptLoader::OnStreamComplete (this=0x8271c80, 
    aLoader=0x8301b10, aContext=0x83021c8, aStatus=0, stringLen=3, 
    string=0x82b7ec8 "\n\n\n")
    at ../../../../mozilla/content/base/src/nsScriptLoader.cpp:759
#19 0x4098d5bd in nsStreamLoader::OnStopRequest (this=0x8301b10, 
    request=0x82f5098, ctxt=0x0, aStatus=0)
    at ../../../../mozilla/netwerk/base/src/nsStreamLoader.cpp:121
#20 0x409c9e93 in nsFileChannel::OnStopRequest (this=0x82f5098, 
    request=0x830232c, context=0x0, aStatus=0)
    at ../../../../../mozilla/netwerk/protocol/file/src/nsFileChannel.cpp:465
#21 0x409ebeb8 in nsOnStopRequestEvent::HandleEvent (this=0x8249ba0)
    at ../../../../mozilla/netwerk/base/src/nsRequestObserverProxy.cpp:161
#22 0x40977f8c in nsARequestObserverEvent::HandlePLEvent (plev=0x8249ba0)
    at ../../../../mozilla/netwerk/base/src/nsRequestObserverProxy.cpp:64
#23 0x4019ffe4 in PL_HandleEvent (self=0x8249ba0)
    at ../../../mozilla/xpcom/threads/plevent.c:590
#24 0x4019fdf9 in PL_ProcessPendingEvents (self=0x812daf0)
    at ../../../mozilla/xpcom/threads/plevent.c:520
#25 0x401a20b2 in nsEventQueueImpl::ProcessPendingEvents (this=0x812da70)
    at ../../../mozilla/xpcom/threads/nsEventQueue.cpp:374
#26 0x40a73b44 in ?? ()
   from /usr/src/seamonkey/debug/dist/bin/components/libwidget_gtk.so
#27 0x40a73723 in ?? ()
   from /usr/src/seamonkey/debug/dist/bin/components/libwidget_gtk.so
#28 0x4046d01e in ?? () from /usr/lib/libglib-1.2.so.0
#29 0x4046e7f3 in ?? () from /usr/lib/libglib-1.2.so.0
#30 0x4046edd9 in ?? () from /usr/lib/libglib-1.2.so.0
#31 0x4046ef8c in ?? () from /usr/lib/libglib-1.2.so.0
#32 0x40382803 in ?? () from /usr/lib/libgtk-1.2.so.0
#33 0x40a741b9 in ?? ()
   from /usr/src/seamonkey/debug/dist/bin/components/libwidget_gtk.so
#34 0x0807d50f in nsNativeViewerApp::Run (this=0x80f2fd8)
    at ../../../../../../mozilla/webshell/tests/viewer/unix/gtk/nsGtkMain.cpp:58
#35 0x0807d7a8 in main (argc=2, argv=0xbffff984)
    at ../../../../../../mozilla/webshell/tests/viewer/unix/gtk/nsGtkMain.cpp:180
#36 0x405b8177 in ?? () from /lib/i686/libc.so.6


This second ``load'' of the script in the first context is the bug. It
causes us to reconstruct a duplicate frame hierarchy, which is then
immediately torn down to make way for the ``real'' second load. This
is a bug in the way that XSLT is handling scripts, IMO. We certainly
should not be doing two initial reflows on the same PresShell!

Comment 15

[Peter Van der Beken [:peterv]]

Quieting the nagging.

Comment 16

[José Jeria]

WFM build 20020120 Win2000

Comment 17

[Axel Hecht]

tried both the testcase by waterson and the zvon site, can't reproduce on
solaris as well.
resolving worksforme.

Comment 18

[Markus Hübner]

Also verifying on win-xp / build 2002012203 :)

Comment 19

[Chris Waterson]

yep.