Closed Bug 2789 Opened 26 years ago Closed 26 years ago

viewer core dumps immediately

Categories

(Core :: Layout, defect, P2)

Product:
Core
Component:
Layout
Platform:
Sun
Solaris
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: brad, Assigned: rickg)

References

(
URL
)

Details

(gdb) bt #0 0xef257280 in SinkContext::OpenContainer (this=0x1f29c8, aNode=@0xefffe3b0) at ../../../../../mozilla/layout/html/document/src/nsHTMLContentSink.cpp:992 #1 0xef25abbc in HTMLContentSink::OpenBody (this=0x1c3a68, aNode=@0xefffe3b0) at ../../../../../mozilla/layout/html/document/src/nsHTMLContentSink.cpp:1701 #2 0xeef3b334 in CNavDTD::OpenBody (this=0x1d4b48, aNode=@0xefffe3b0) at ../../../mozilla/htmlparser/src/CNavDTD.cpp:2049 #3 0xeef3bc44 in CNavDTD::OpenContainer (this=0x1d4b48, aNode=@0xefffe3b0, aUpdateStyleStack=1) at ../../../mozilla/htmlparser/src/CNavDTD.cpp:2202 #4 0xeef378e4 in CNavDTD::HandleDefaultStartToken (this=0x1d4b48, aToken=0x1d5ef8, aChildTag=eHTMLTag_body, aNode=@0xefffe3b0) at ../../../mozilla/htmlparser/src/CNavDTD.cpp:856 #5 0xeef37e80 in CNavDTD::HandleStartToken (this=0x1d4b48, aToken=0x1d5ef8) at ../../../mozilla/htmlparser/src/CNavDTD.cpp:964 #6 0xeef35bb4 in NavDispatchTokenHandler (aToken=0x1d5ef8, aDTD=0x1d4b48) at ../../../mozilla/htmlparser/src/CNavDTD.cpp:250 #7 0xeef4e3dc in CTokenHandler::operator() (this=0x1c8fb8, aToken=0x1d5ef8, aDTD=0x1d4b48) at ../../../mozilla/htmlparser/src/nsTokenHandler.cpp:80 #8 0xeef36e70 in CNavDTD::HandleToken (this=0x1d4b48, aToken=0x1d5ef8, aParser=0x1c3a20) at ../../../mozilla/htmlparser/src/CNavDTD.cpp:577 #9 0xeef36b04 in CNavDTD::BuildModel (this=0x1d4b48, aParser=0x1c3a20, aTokenizer=0x1d12c8, anObserver=0x0, aSink=0x1c3a68) at ../../../mozilla/htmlparser/src/CNavDTD.cpp:507 #10 0xeef4a68c in nsParser::BuildModel (this=0x1c3a20) at ../../../mozilla/htmlparser/src/nsParser.cpp:727 #11 0xeef4a4bc in nsParser::ResumeParse (this=0x1c3a20, aDefaultDTD=0x0) at ../../../mozilla/htmlparser/src/nsParser.cpp:681 #12 0xeef4acb8 in nsParser::OnDataAvailable (this=0x1c3a20, aURL=0x1a4300, pIStream=0x19b308, aLength=1020) at ../../../mozilla/htmlparser/src/nsParser.cpp:891 #13 0xee8ff0c8 in nsDocumentBindInfo::OnDataAvailable (this=0x1a42b0, aURL=0x1a4300, aStream=0x19b308, aLength=1020) at ../../../mozilla/webshell/src/nsDocLoader.cpp:1716 #14 0xeeabaa04 in stub_put_block (stream=0x1bc5a0, buffer=0x1d8d28 "-- recoded, changed, twiddled, etc by todd@cybersight.com -->\n\n<BODY onLoad=\"\" TEXT=\"#000000\" LINK=\"#000099\" VLINK=\"#000099\" ALINK=\"#FF0000\" BGCOLOR=\"#000066\">\n\n<SCRIPT LANGUAGE=\"JavaScript\">\n\nif (nav"..., length=1020) at ../../../mozilla/network/module/nsStubContext.cpp:647 #15 0xeeb261e4 in net_MemCacheWrite (stream=0x1d12a0, buffer=0x1d8d28 "-- recoded, changed, twiddled, etc by todd@cybersight.com -->\n\n<BODY onLoad=\"\" TEXT=\"#000000\" LINK=\"#000099\" VLINK=\"#000099\" ALINK=\"#FF0000\" BGCOLOR=\"#000066\">\n\n<SCRIPT LANGUAGE=\"JavaScript\">\n\nif (nav"..., len=1020) at ../../../mozilla/network/cache/mkmemcac.c:664 #16 0xeeaf3d04 in net_ChunkedWrite (stream=0x1bc578, s=0xb9e70 "-- recoded, changed, twiddled, etc by todd@cybersight.com -->\n\n<BODY onLoad=\"\" TEXT=\"#000000\" LINK=\"#000099\" VLINK=\"#000099\" ALINK=\"#FF0000\" BGCOLOR=\"#000066\">\n\n<SCRIPT LANGUAGE=\"JavaScript\">\n\nif (nav"..., l=1027) at ../../../mozilla/network/cnvts/cvchunk.c:124 #17 0xeee0d9f4 in net_pull_http_data (ce=0x1a5538) at ../../../../mozilla/network/protocol/http/mkhttp.c:3097 #18 0xeee0e730 in net_ProcessHTTP (ce=0x1a5538) at ../../../../mozilla/network/protocol/http/mkhttp.c:3489 #19 0xeea2e3f8 in NET_ProcessNet (ready_fd=0x194018, fd_type=2) at ../../../mozilla/network/main/mkgeturl.c:3368 #20 0xeea3a7b0 in NET_PollSockets () at ../../../mozilla/network/main/mkselect.c:320 #21 0xeeaac278 in nsNetlibService::NetPollSocketsCallback (aTimer=0x1bc410, aClosure=0xb83a8) at ../../../mozilla/network/module/nsNetService.cpp:1194 #22 0xeefe5254 in TimerImpl::FireTimeout (this=0x1bc410) at ../../../../mozilla/base/src/gtk/nsTimer.cpp:73 #23 0xeefe5a10 in nsTimerExpired (aCallData=0x1bc410) at ../../../../mozilla/base/src/gtk/nsTimer.cpp:188 #24 0xee458044 in g_timeout_dispatch (source_data=0x1a5270, current_time=0xeffff5a0, user_data=0x1bc410) at gmain.c:1122 #25 0xee456f24 in g_main_dispatch (current_time=0xeffff5a0) at gmain.c:640 #26 0xee45755c in g_main_iterate (block=1224, dispatch=1) at gmain.c:829 #27 0xee45776c in g_main_run (loop=0x1a4768) at gmain.c:887 #28 0xee5411c0 in gtk_main () at gtkmain.c:457 #29 0xef6ba080 in nsAppShell::Run (this=0xd35a0) at ../../../../mozilla/widget/src/gtk/nsAppShell.cpp:145 ---Type <return> to continue, or q <return> to quit--- #30 0x296bc in nsNativeViewerApp::Run (this=0xd1390) at ../../../../mozilla/webshell/tests/viewer/nsGTKMain.cpp:47 #31 0x29a48 in main (argc=2, argv=0xeffff864) at ../../../../mozilla/webshell/tests/viewer/nsGTKMain.cpp:102 (gdb) quit
There is a mix of javascript, <EMBED>, <MAP> etc. in the original page, but I am able to duplicate the crash with this reduced case: <HTML><HEAD></HEAD> <CENTER> <!-- CENTER before BODY --> <BODY> </BODY> </HTML> Crashes : nightly build Jan 29 win95 optimized Crashes : nightly build Jan 25 win95 optimized Does not Crash : nightly build Jan 15 win95 optimized Note that the HTML that forces the crash is very similar to the test case for #2766 Bugzilla #2766 Bugzilla #2789 (this bug) ------------------- ------------------------- <HTML><HEAD></HEAD> <HTML><HEAD></HEAD> <DIV ALIGN=CENTER> <CENTER> <BODY> <BODY> </DIV> </BODY> </HTML> </HTML>
Setting all current Open Critical and Major to M3
Status: NEW → ASSIGNED
Unable to reproduce on NT. I'll ask someone on Solaris to look.
The crash went away with the parser chechins ~Jan 30. It crashes the win95 Jan 29 non-debug build, but not the Feb 3 win95 non-debug build. However, it does not layout correctly for the Feb3 or Feb6 builds on win95. Could be closed, or left open for the current problems (1) no background colour, and (2) (Feb6) doesn't load the OBJECT.
Product: MozillaClassic → Browser
per leger, assigning QA contacts to all open bugs without QA contacts according to list at http://bugzilla.mozilla.org/describecomponents.cgi?product=Browser
Target Milestone: M3 → M7
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Jan -- can you have someone verify this. I believe it may be fixed.
Status: RESOLVED → VERIFIED
brad@cybersight will be helping us verify this one...I don't see any core dumps anymore on recent builds. Brad, please re-open this one if you're still seeing this...
Verified that it no longer crashes. Leaving verified/fixed.
You need to log in before you can comment on or make changes to this bug.