Tested 5-26-20 Linux build. When you try to load this URL, Error loading message shows up. Then, Apprunner will die. http://www.ntt.co.jp/index-j.html also have same problem.

The problem is nsWebShell ReloadDocument and StopLoadingDocument reent libnet and it trash some object on the stack. It seems only have problem if the first block we receive have the whole META tag. (in other word, if we call the ReloadDocument in the first block). I currently work around by don't call StopLoadingDocument in nsMetaCharsetObserver.cpp and use new a implementation of ReloadDocument which use RefreshURL to work aroud the problem so it won't crash now. I will open a new bug against nisheeth about the StopLoadingDocument problem

This still happens in 6-01-12-M7 build. Apprunner does not die everytime, but sometime it still dies.

This also happens--occasionally--on the Mac. I changed the status to Reopened, since it is clearly not fixed yet.

probably a dup of either bug 6937 or bug 5889 (or both)

This is not a [pp] bug

Mac does not crash on http://www.zdnet.co.jp/pcweek but it crash on www.zdnet.co.jp . Same as Linux Here is the stack trace for http://www.zdnet.co.jp The stack trace look like 5889. Mark it dup done. #0 0x8202cda in ?? () (gdb) bt #0 0x8202cda in ?? () #1 0x40e2f61b in nsLineBox::DeleteLineList (aPresContext=@0x81acd30, aLine=0x8464a68) at nsLineBox.cpp:157 #2 0x40e0988f in nsBlockFrame::DeleteFrame (this=0x8439d18, aPresContext=@0x81acd30) at nsBlockFrame.cpp:806 #3 0x40e07992 in nsAreaFrame::DeleteFrame (this=0x8439d18, aPresContext=@0x81acd30) at nsAreaFrame.cpp:105 #4 0x40fbd083 in nsFrameList::DeleteFrames (this=0x843bc38, aPresContext=@0x81acd30) at nsFrameList.cpp:28 #5 0x40e15bad in nsContainerFrame::DeleteFrame (this=0x843bc00, aPresContext=@0x81acd30) at nsContainerFrame.cpp:79 #6 0x40fbd083 in nsFrameList::DeleteFrames (this=0x843dc68, aPresContext=@0x81acd30) at nsFrameList.cpp:28 #7 0x40e15bad in nsContainerFrame::DeleteFrame (this=0x843dc30, aPresContext=@0x81acd30) at nsContainerFrame.cpp:79 #8 0x40fbd083 in nsFrameList::DeleteFrames (this=0x843fa70, aPresContext=@0x81acd30) at nsFrameList.cpp:28 #9 0x40e15bad in nsContainerFrame::DeleteFrame (this=0x843fa38, aPresContext=@0x81acd30) at nsContainerFrame.cpp:79 #10 0x40fbd083 in nsFrameList::DeleteFrames (this=0x842b138, aPresContext=@0x81acd30) at nsFrameList.cpp:28 #11 0x40e15bad in nsContainerFrame::DeleteFrame (this=0x842b100, aPresContext=@0x81acd30) at nsContainerFrame.cpp:79 #12 0x40f76b42 in nsTableFrame::DeleteFrame (this=0x842b100, aPresContext=@0x81acd30) at nsTableFrame.cpp:340 #13 0x40fbd083 in nsFrameList::DeleteFrames (this=0x843f820, aPresContext=@0x81acd30) at nsFrameList.cpp:28 #14 0x40e15bad in nsContainerFrame::DeleteFrame (this=0x843f7e8, aPresContext=@0x81acd30) at nsContainerFrame.cpp:79 #15 0x40fbd083 in nsFrameList::DeleteFrames (this=0x83f0898, aPresContext=@0x81acd30) at nsFrameList.cpp:28 #16 0x40e098af in nsBlockFrame::DeleteFrame (this=0x83f0848, aPresContext=@0x81acd30) at nsBlockFrame.cpp:809 #17 0x40e2f61b in nsLineBox::DeleteLineList (aPresContext=@0x81acd30, aLine=0x83fae50) at nsLineBox.cpp:157 #18 0x40e0988f in nsBlockFrame::DeleteFrame (this=0x83f5760, aPresContext=@0x81acd30) at nsBlockFrame.cpp:806 #19 0x40e07992 in nsAreaFrame::DeleteFrame (this=0x83f5760, aPresContext=@0x81acd30) at nsAreaFrame.cpp:105 #20 0x40fbd3a3 in nsFrameList::DeleteFrame (this=0x83fa320, aPresContext=@0x81acd30, aFrame=0x83f5760) at nsFrameList.cpp:114 #21 0x40e22350 in RootFrame::Reflow (this=0x83fa2e8, aPresContext=@0x81acd30, aDesiredSize=@0xbfffed8c, aReflowState=@0xbfffecb0, aStatus=@0xbfffefac) at nsHTMLFrame.cpp:187 #22 0x40e165bf in nsContainerFrame::ReflowChild (this=0x83bf450, aKidFrame=0x83fa2e8, aPresContext=@0x81acd30, aDesiredSize=@0xbfffed8c, aReflowState=@0xbfffecb0, aStatus=@0xbfffefac) at nsContainerFrame.cpp:392 #23 0x40e422d5 in nsScrollFrame::Reflow (this=0x83bf450, aPresContext=@0x81acd30, aDesiredSize=@0xbfffef2c, aReflowState=@0xbfffee88, aStatus=@0xbfffefac) ---Type <return> to continue, or q <return> to quit--- at nsScrollFrame.cpp:422 #24 0x40e165bf in nsContainerFrame::ReflowChild (this=0x84018e8, aKidFrame=0x83bf450, aPresContext=@0x81acd30, aDesiredSize=@0xbfffef2c, aReflowState=@0xbfffee88, aStatus=@0xbfffefac) at nsContainerFrame.cpp:392 #25 0x40e4e214 in ViewportFrame::Reflow (this=0x84018e8, aPresContext=@0x81acd30, aDesiredSize=@0xbffff0c0, aReflowState=@0xbfffefb0, aStatus=@0xbfffefac) at nsViewportFrame.cpp:436 #26 0x40e239f6 in nsHTMLReflowCommand::Dispatch (this=0x85f9648, aPresContext=@0x81acd30, aDesiredSize=@0xbffff0c0, aMaxSize=@0xbffff0b0, aRendContext=@0x8617130) at nsHTMLReflowCommand.cpp:165 #27 0x40e3c467 in PresShell::ProcessReflowCommands (this=0x83d5088) at nsPresShell.cpp:1235 #28 0x40e3a42f in PresShell::ExitReflowLock (this=0x83d5088) at nsPresShell.cpp:653 #29 0x40e3db43 in PresShell::ReconstructFrames (this=0x83d5088) at nsPresShell.cpp:1698 #30 0x40e3db72 in PresShell::StyleSheetAdded (this=0x83d5088, aDocument=0x8227240, aStyleSheet=0x85f61d8) at nsPresShell.cpp:1707 #31 0x40fb1019 in nsDocument::InsertStyleSheetAt (this=0x8227240, aSheet=0x85f61d8, aIndex=1, aNotify=1) at nsDocument.cpp:1355 #32 0x40f2a6ba in CSSLoaderImpl::InsertSheetInDoc (this=0x81fbbd8, aSheet=0x85f61d8, aDocIndex=1, aElement=0x85f0764, aNotify=1) at nsCSSLoader.cpp:904 #33 0x40f297ff in InsertPendingSheet (aPendingData=0x85f6260, aLoader=0x81fbbd8) at nsCSSLoader.cpp:546 #34 0x4008b34e in nsVoidArray::EnumerateForwards (this=0x81fbc28, aFunc=0x40f297bc <InsertPendingSheet(void *, void *)>, aData=0x81fbbd8) at nsVoidArray.cpp:213 #35 0x40f29a61 in CSSLoaderImpl::Cleanup (this=0x81fbbd8, aKey=@0xbffff2c4, aLoadData=0x83bf620) at nsCSSLoader.cpp:602 #36 0x40f29d05 in CSSLoaderImpl::SheetComplete (this=0x81fbbd8, aSheet=0x0, aLoadData=0x83bf620) at nsCSSLoader.cpp:664 #37 0x40f29e5c in CSSLoaderImpl::ParseSheet (this=0x81fbbd8, aIn=0x85f60a0, aLoadData=0x83bf620, aCompleted=@0xbffff344, aSheet=@0xbffff340) at nsCSSLoader.cpp:695 #38 0x40f29f5a in CSSLoaderImpl::DidLoadStyle (this=0x81fbbd8, aLoader=0x83f5888, aStyleData=@0x83f58a8, aLoadData=0x83bf620, aStatus=0) at nsCSSLoader.cpp:726 #39 0x40f29789 in DoneLoadingStyle (aLoader=0x83f5888, aStyleData=@0x83f58a8, aLoadData=0x83bf620, aStatus=0) at nsCSSLoader.cpp:534 #40 0x402d64d3 in nsUnicharStreamLoader::OnStopBinding (this=0x83f5888, aURL=0x83bf290, aStatus=0, aMsg=0xbffff404) at nsNetStreamLoader.cpp:156 #41 0x402f4394 in nsDocumentBindInfo::OnStopBinding (this=0x83f57f8, aURL=0x83bf290, aStatus=0, aMsg=0xbffff404) at nsDocLoader.cpp:1527 #42 0x402d98ec in stub_complete (stream=0x85f6078) at nsStubContext.cpp:772 #43 0x4027b414 in net_MemCacheComplete (stream=0x85f82a8) at mkmemcac.c:720 #44 0x401d5b07 in net_ProcessHTTP (ce=0x83f87d0) at mkhttp.c:3604 #45 0x402a858e in NET_ProcessNet (ready_fd=0x85b4ec0, fd_type=2) at mkgeturl.c:3355 #46 0x402b0691 in NET_PollSockets () at mkselect.c:320 #47 0x402d2fa2 in nsNetlibService::NetPollSocketsCallback (aTimer=0x82b32f8, aClosure=0x80bc3e0) at nsNetService.cpp:1244 #48 0x40142e75 in TimerImpl::FireTimeout (this=0x82b32f8) at nsTimer.cpp:73 ---Type <return> to continue, or q <return> to quit--- #49 0x401432fa in nsTimerExpired (aCallData=0x82b32f8) at nsTimer.cpp:196 #50 0x406c5fa3 in g_timeout_dispatch () #51 0x406c52c6 in g_main_dispatch () #52 0x406c5801 in g_main_iterate () #53 0x406c5979 in g_main_run () #54 0x405f3f3a in gtk_main () #55 0x400e8d09 in nsAppShell::Run (this=0x807ba70) at nsAppShell.cpp:197 #56 0x4002935d in nsAppShellService::Run (this=0x8079128) at nsAppShellService.cpp:402 #57 0x804aa9c in main (argc=1, argv=0xbffffb34) at nsAppRunner.cpp:573 #58 0x4081ecb3 in __libc_start_main (main=0x8049cb0 <main>, argc=1, argv=0xbffffb34, init=0x8049888 <_init>, fini=0x804ba10 <_fini>, rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffffb2c) at ../sysdeps/generic/libc-start.c:78 *** This bug has been marked as a duplicate of 5889 ***

Verified Dup