Grand Moff Tarkin Reporter
	Description • 25 years ago

nightly build of 27 april,

crash when going to http://www.starwars.com

	Jae Gangemi
	Comment 1 • 25 years ago

crashes for me as well - here's the strace :)

.//run-mozilla.sh: line 29:  9241 Segmentation fault      $prog ${1+"$@"}
[WIFEXITED(s) && WEXITSTATUS(s) == 0], 0, NULL) = 9236
rt_sigprocmask(SIG_BLOCK, [CHLD TTOU], [CHLD], 8) = 0
rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [CHLD], 8) = 0
rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGCHLD (Child exited) ---
wait4(-1, 0xbffff4e0, WNOHANG, NULL)    = -1 ECHILD (No child processes)
sigreturn()                             = ? (mask now [])
rt_sigaction(SIGINT, {SIG_DFL}, {0x806c2e0, [], 0x4000000}, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
rt_sigprocmask(SIG_BLOCK, [CHLD TTOU], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
read(3, "", 37)                         = 0
munmap(0x40015000, 4096)                = 0
_exit(0)                                = ?

	Blake Ross
	Comment 2 • 25 years ago

crash kw

	Andreas Franke (gone)
	Comment 3 • 25 years ago

I can reproduce that this on PC/Linux with build 2000042809.
Going to attach the stack trace.

Should be a duplicate of a bug I recently touched. Will search for it.

	Andreas Franke (gone)
	Comment 5 • 25 years ago

Using the 2000042809 build, the first 6 entries on the stack are exactly the
same as with http://bugzilla.mozilla.org/showattachment.cgi?attach_id=7998
as a testcase (see bug 36902).

	Andreas Franke (gone)
	Comment 6 • 25 years ago

A better stacktrace shows that this crash is in nsLineBox::DeleteLineList.
Changing summary to indicate this.

	Asa Dotzler [:asa]
	Comment 8 • 25 years ago

updating component and owner. changing status to New.

	Andreas Franke (gone)
	Comment 10 • 25 years ago

The test case attached above is
<table>
  <tr>
    <td><form><nobr><select/></form></td>
  </tr>
</table>

Note that the crash goes away if you insert a space character
between <td> and <form>.

	Andreas Franke (gone)
	Comment 12 • 25 years ago

Testcase 2 looks like this:
Foo
<span><p></span>
<table>
  <tr>
    <td> 
      <form> 
        <select>
          <option>foo
        </select>
      </form>
    </td>
  </tr>
  <img src="nonexisting" alt="">
</table>

The following part of the stack trace is common to both testcases:
#0  0x0 in ?? ()
#1  0x40ae4b9c in nsLineBox::DeleteLineList ()
   from /build/dist/bin/components/libraptorhtml.so
#2  0x40ac4a93 in nsBlockFrame::Destroy ()
   from /build/dist/bin/components/libraptorhtml.so
#3  0x40ac289e in nsAreaFrame::Destroy ()
   from /build/dist/bin/components/libraptorhtml.so
#4  0x40b97017 in nsComboboxControlFrame::Destroy ()
   from /build/dist/bin/components/libraptorhtml.so

	Andreas Franke (gone)
	Comment 13 • 25 years ago

*** Bug 36916 has been marked as a duplicate of this bug. ***

	Andreas Franke (gone)
	Comment 15 • 25 years ago

Changing Platform/OS to All since bug 36916 has been seen on Mac.
Changing summary to include <SELECT>.
Testcase 3 (from there) says that every page containing a <SELECT> element
crashes mozilla when loaded into composer:
<form>
  <select />
</form>

Note:
testcase 1 crashes since 2000041816 (doesn't crash in 2000041609),
testcase 2 crashes since 2000042113 (doesn't crash in 2000041816), 
testcase 3 crashes already in M15.
http://www.starwars.com behaves like testcase 2 in this respect,
although testcase 1 is the one derived from it....

	Andreas Franke (gone)
	Comment 16 • 25 years ago

*** This bug has been marked as a duplicate of 36558 ***

	Kathleen :Brade
	Comment 17 • 25 years ago

*** Bug 37821 has been marked as a duplicate of this bug. ***

	Kathleen :Brade
	Comment 18 • 25 years ago

oops; should have dup'ed against #36558 which is assigned to rods

	Chris Petersen
	Comment 19 • 24 years ago

Marking verified dup of 36558.