Closed
Bug 73407
Opened 24 years ago
Closed 24 years ago
Browser crashes
Categories
(Core :: Layout, defect, P1)
Core
Layout
Tracking
()
mozilla1.0
People
(Reporter: mike_jk, Assigned: attinasi)
References
()
Details
(Keywords: crash, helpwanted)
Attachments
(1 file)
(deleted),
text/html
|
Details |
The browser crashes using Build ID: 2001032304
MOZILLA caused an invalid page fault in
module <unknown> at 0000:00000009.
Registers:
EAX=02997580 CS=0177 EIP=00000009 EFLGS=00010203
EBX=00000001 SS=017f ESP=0068fb5c EBP=0068fb88
ECX=02997090 DS=017f ESI=02c59d40 FS=8bbf
EDX=32dd8a5f ES=017f EDI=00000000 GS=0000
Bytes at CS:EIP:
00 88 05 65 04 70 00 65 04 70 00 54 ff 00 f0 08
Stack dump:
603a017f 60314412 02997580 02c59610 0240c1d0 02cecfc0 0068fbf0 02c59d00
60df9458 0240c1d0 00000000 0068fbc8 6046343d 0240c1d0 02c59610 0240c1d0
Comment 1•24 years ago
|
||
WORKSFORME
Platform: PC
OS: Linux 2.2.17
Mozilla Build: 2001032505
Reporter are you able to reproduce the crash?
Keywords: crash
Reporter | ||
Comment 2•24 years ago
|
||
Yes, I'm using Build ID: 2001032804 on win32 and I'm able to reproduce this
crash.
MOZILLA caused an invalid page fault in
module GKLAYOUT.DLL at 0177:602fedac.
Registers:
EAX=0250b6c4 CS=0177 EIP=602fedac EFLGS=00010202
EBX=00000004 SS=017f ESP=0068f960 EBP=0068f97c
ECX=00000000 DS=017f ESI=0068f9c4 FS=a51f
EDX=0068f984 ES=017f EDI=0068f9dc GS=0000
Bytes at CS:EIP:
ff 91 dc 00 00 00 8b 45 08 85 c0 74 05 83 3f 00
Stack dump:
0250b6c4 023853b0 0068f9dc 0068f9c0 0068f9b0 00000000 00000000 0068f9d0
602fef3c 0250b6c4 023853b0 0068f9c4 0068f9dc 0068fa00 0250b790 023853b0
layout
Assignee: asa → karnaze
Component: Browser-General → Layout
QA Contact: doronr → petersen
Comment 4•24 years ago
|
||
Marking works for me in the April 3 build. Reporter, please try with a newer build.
Status: UNCONFIRMED → RESOLVED
Closed: 24 years ago
Resolution: --- → WORKSFORME
Reporter | ||
Comment 5•24 years ago
|
||
I'm using 2001040304 and it crashed.
Status: RESOLVED → UNCONFIRMED
Resolution: WORKSFORME → ---
Comment 6•24 years ago
|
||
I can confirm this bug.
Each time I load the page (by highlighting the link and then middle clicking on
a blank piece of page) the page loads seemingly without problems.
However, when I try to go to another page, the browser crashes. So far the
following things will consitently crash my browser.
1. Clicking the back button.
2. Selecting a link from the personal toolbar
3. Selecting a link from the location drop down list.
All of this links go to pages mozilla handles without problems.
I'm using 2001040105 (althought I downloaded 2001-04-03-12-72923) and I'm
running Linux RH 7.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Comment 7•24 years ago
|
||
Attinasi, please decide if this is yours or pavlov's.
nsImageListener::FrameChanged(nsImageListener * const 0x02ef2ad0, imgIContainer
* 0x02ef22a0, nsISupports * 0x034a11d0, gfxIImageFrame * 0x03505150, nsRect *
0x0012feb8 {x=105 y=37 width=94 height=16}) line 1777 + 36 bytes
imgRequestProxy::FrameChanged(imgRequestProxy * const 0x02ef2124, imgIContainer
* 0x02ef22a0, nsISupports * 0x00000000, gfxIImageFrame * 0x03505150, nsRect *
0x0012feb8 {x=105 y=37 width=94 height=16}) line 206
imgRequest::FrameChanged(imgRequest * const 0x02ef24f4, imgIContainer *
0x02ef22a0, nsISupports * 0x00000000, gfxIImageFrame * 0x03505150, nsRect *
0x0012feb8 {x=105 y=37 width=94 height=16}) line 300
imgContainer::Notify(imgContainer * const 0x02ef22a4, nsITimer * 0x03506fc0)
line 399
nsTimer::Fire() line 200
nsTimerManager::FireNextReadyTimer(nsTimerManager * const 0x0125afd0, unsigned
int 0) line 117
nsNativeViewerApp::Run() line 90
main(int 1, char * * 0x00b95c80) line 157 + 11 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL
Assignee: karnaze → attinasi
Target Milestone: --- → mozilla0.9
Assignee | ||
Comment 8•24 years ago
|
||
I get two nasty assertions loading this URL - I think the problem starts there
actually.
The assertion (happens twice) is in nsFrame::AppendFrames - "not a container"
From the stack it looks like the ContentSink is trying to add a textFrame node
to an HTMLFrameOuterFrame and that is not good. Then, later, when leaving the
page it crashes in nsImageListener::FrameChanged because the frame data member
is no longer valid (and not null).
So, I'm guessing that this is not really a problem for pavlov, but rather a
problem due to invalid content structure being allowed to come into the layout
system where we assume a certain level of well-formedness.
Accepting to investigate further and see if there are some straightforward ways
to make this all safer (but moving milestone out since this is not a very
critical site).
Status: NEW → ASSIGNED
Target Milestone: mozilla0.9 → mozilla1.0
Assignee | ||
Comment 9•24 years ago
|
||
Comment 11•24 years ago
|
||
The assertion is bug 73547.
Comment 12•24 years ago
|
||
Mac crashes at the same URL. http://japan.cnet.com is another site which crashes
Mozilla with the same stacktrace.
All/All
OS: Windows 98 → All
Hardware: PC → All
Assignee | ||
Comment 13•24 years ago
|
||
*** Bug 73337 has been marked as a duplicate of this bug. ***
Assignee | ||
Comment 14•24 years ago
|
||
Good testcase from duplicate bug:
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=30291
Assignee | ||
Comment 15•24 years ago
|
||
*** Bug 75109 has been marked as a duplicate of this bug. ***
Assignee | ||
Comment 16•24 years ago
|
||
Making P1 and adding mostfreq kwd - lots of dups showing up on this.
Keywords: mostfreq
Priority: -- → P1
Comment 17•24 years ago
|
||
Fix checked in, marking dup.
*** This bug has been marked as a duplicate of 73547 ***
Status: ASSIGNED → RESOLVED
Closed: 24 years ago → 24 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•