145853 - use of <html:fieldset/>, <html:legend/> in XUL document crashes

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[John Morrison]

Follow-on from bug 130251 and duped bug 132823. The use of <html:fieldset/>
and <html:legend/> in XUL still crashes the browser.  However, the use of
<html:*/> is, in general, deprecated, and isn't needed to do any UI in mozilla
1.0. So, futuring this bug is fine by me.

(I've already cvs removed the example file from mozilla.org that was showing an 
obsolete XUL example that also had fieldset/legend in it. It was for demo-ing 
<titledbutton/>, but that element is long ago dead.)

Minimal test case:

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window
    xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
    xmlns:html="http://www.w3.org/1999/xhtml">
  <html:fieldset>
    <html:legend> blah blah blah </html:legend>
  </html:fieldset>
</window>

Crash stack (as before):

nsBlockBandData::Init(nsBlockBandData * const 0x0012eea4, nsSpaceManager * 
0x00000000, const nsSize & {...}) line 72
nsBlockReflowState::nsBlockReflowState(nsBlockReflowState * const 0x0012eea4, 
const nsHTMLReflowState & {...}, nsIPresContext * 0x026445e0, nsBlockFrame * 
0x0264ee84, const nsHTMLReflowMetrics & {...}, int 0x00000000) line 151
nsBlockFrame::Reflow(nsBlockFrame * const 0x0264ee84, nsIPresContext * 
0x026445e0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0x00000000) line 820
nsLegendFrame::Reflow(nsLegendFrame * const 0x0264ee84, nsIPresContext * 
0x026445e0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0x00000000) line 119 + 14 bytes
nsContainerFrame::ReflowChild(nsContainerFrame * const 0x0012eea4, nsIFrame * 
0x0264ee84, nsIPresContext * 0x026445e0, nsHTMLReflowMetrics & {...}, const 
nsHTMLReflowState & {...}, int 0x00000000, int 0x00000000, unsigned int 
0x00000003, unsigned int & 0x00000000) line 807
nsFieldSetFrame::Reflow(nsFieldSetFrame * const 0x0012f23c, nsIPresContext * 
0x026445e0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0x00000000) line 407
nsBoxToBlockAdaptor::Reflow(nsBoxToBlockAdaptor * const 0x0012eea4, 
nsBoxLayoutState & {...}, nsIPresContext * 0x026445e0, nsHTMLReflowMetrics & 
{...}, const nsHTMLReflowState & {...}, unsigned int & 0x00000000, int 
0x00000000, int 0x00000000, int 0x40000000, int 0x40000000, int 0x00000001) 
line 887
nsBoxToBlockAdaptor::RefreshSizeCache(nsBoxToBlockAdaptor * const 0x00000000, 
nsBoxLayoutState & {...}) line 374
nsBoxToBlockAdaptor::GetAscent(nsBoxToBlockAdaptor * const 0x00000000, 
nsBoxLayoutState & {...}, int & 0x00000000) line 581
nsSprocketLayout::GetAscent(nsSprocketLayout * const 0x019f2d10, nsIBox * 
0x0268c258, nsBoxLayoutState & {...}, int &) line 1521
nsContainerBox::GetAscent(nsContainerBox * const 0x0264e488, nsBoxLayoutState & 
{...}, int &) line 591
nsBoxFrame::GetAscent(nsBoxFrame * const 0x0264e488, nsBoxLayoutState & {...}, 
int & 0x00000000) line 1101
nsSprocketLayout::Layout(nsSprocketLayout * const 0x019f2d10, nsIBox * 
0x0264e488, nsBoxLayoutState & {...}) line 245
nsContainerBox::DoLayout(nsContainerBox * const 0x0264e488, nsBoxLayoutState & 
{...}) line 606 + 8 bytes
nsBox::Layout(nsBox * const 0x0264e488, nsBoxLayoutState & {...}) line 1052
nsStackLayout::Layout(nsStackLayout * const 0x019e5ba8, nsIBox * 0x0264e19c, 
nsBoxLayoutState & {...}) line 331
nsContainerBox::DoLayout(nsContainerBox * const 0x0264e19c, nsBoxLayoutState & 
{...}) line 606 + 8 bytes
nsBox::Layout(nsBox * const 0x0264e19c, nsBoxLayoutState & {...}) line 1052
nsBoxFrame::Reflow(nsBoxFrame * const 0x0264e168, nsIPresContext * 0x026445e0, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 
0x00000000) line 1001
nsRootBoxFrame::Reflow(nsRootBoxFrame * const 0x0264e168, nsIPresContext * 
0x026445e0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0x00000000) line 243
nsContainerFrame::ReflowChild(nsContainerFrame * const 0x0012eea4, nsIFrame * 
0x0264e168, nsIPresContext * 0x026445e0, nsHTMLReflowMetrics & {...}, const 
nsHTMLReflowState & {...}, int 0x00000000, int 0x00000000, unsigned int 
0x00000000, unsigned int & 0x00000000) line 807
ViewportFrame::Reflow(ViewportFrame * const 0x0264e130, nsIPresContext * 
0x026445e0, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0x00000000) line 578
PresShell::InitialReflow(PresShell * const 0x0264e130, int 0x0268d278, int 
0x00002454) line 2834
nsXULDocument::StartLayout(nsXULDocument * const 0x0012eea4) line 4576
nsXULDocument::ResumeWalk(nsXULDocument * const 0x0012eea4) line 5704
nsXULDocument::EndLoad(nsXULDocument * const 0x02432640) line 1800 + 7 bytes
XULContentSinkImpl::DidBuildModel(XULContentSinkImpl * const 0x02432640, int 
0x00000000) line 532
nsExpatDriver::DidBuildModel(nsExpatDriver * const 0x0238cd08, unsigned int 
0x00000000, int 0x00000001, nsIParser * 0x00f66d30, nsIContentSink * 
0x00f66a18) line 881 + 22 bytes
nsParser::DidBuildModel(nsParser * const 0x0012eea4, unsigned int 0x00000000) 
line 1251 + 13 bytes
nsParser::ResumeParse(nsParser * const 0x0012eea4, int 0x00000001, int 
0x00000001, int 0x00000001) line 1796
nsParser::OnStopRequest(nsParser * const 0x00f66d34, nsIRequest * 0x02354438, 
nsISupports * 0x00000000, unsigned int 0x00000000) line 2425
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x00f66d34, 
nsIRequest * 0x02354438, nsISupports * 0x00000000, unsigned int 0x00000000) 
line 256
nsFileChannel::OnStopRequest(nsFileChannel * const 0x02354440, nsIRequest * 
0x0235456c, nsISupports * 0x00000000, unsigned int 0x00000000) line 519 + 14 
bytes
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x0012eea4) line 
213
PL_HandleEvent(PLEvent * 0x0238dc44) line 597
PL_ProcessPendingEvents(PLEventQueue * 0x10031ad1) line 526 + 6 bytes
_md_EventReceiverProc(HWND__ * 0x019246a0, unsigned int 0x00402037, unsigned 
int 0x00f1d778, long 0x7803ce38) line 1078
nsAppShellService::Run(nsAppShellService * const 0x00f1d778) line 451
main1(int 0x00000001, char * * 0x00252e48, nsISupports * 0x00252e90) line 1472
main(int 0x00000001, char * * 0x00252e48) line 1809 + 26 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x001330b9, 
HINSTANCE__ * 0x00400000) line 1829 + 23 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e87903()

Comment 1

[John Morrison]

Attachment: simple testcase with just <html:fieldset> <html:legend> in a XUL document.

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is the same issue as bug 200347

Comment 3

[NetVicious]

I think this bug it's a duplicated of #200347

I could change it's status.

Comment 4

[Frank Wein [:mcsmurf]]

has been fixed so