289967 - [FIXr]Crash when using display:-moz-bulletinboard [@ nsFrameItems::AddChild ]

Status: VERIFIED FIXED

(Core :: Layout, defect, P1)

Description

[Martijn Wargers (dead)]

See upcoming testcase. 
It seems like a regression. 
This did not crash with Mozilla build 2004102604.
It crashes with Mozilla build 2004102705.
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-10-26+04%3A00%3A00&maxdate=2004-10-27+05%3A00%3A00&cvsroot=%2Fcvsroot

What does -moz-bulletinboard do? I expected to see a bulletinboard ;-)

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase (beware, crashes on load)

Comment 2

[Martijn Wargers (dead)]

Attachment: Backtrace from debug build.

Well, it doesn't crash now, it causes a hang. 
This is a backtrace from my debug build.

Comment 3

[Boris Zbarsky [:bzbarsky]]

> What does -moz-bulletinboard do? 

Absolutely nothing, looks like, other than crashing. ;)  "bulletinboard"
elements have -moz-stack display per xul.css.

Neil, do you see any reason I shouldn't just rip out all the (already-broken!)
support for -moz-bulletinboard in the style system?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Like so

Comment 5

[Martijn Wargers (dead)]

Attachment: Testcase2 (also hangs/crashes onload)

This testcase uses display:-moz-page-break;
It also hangs/crashes for me and has the same regression range which I
mentioned earlier in this bug. 
I can file a new bug on this, if asked, but maybe it also just needs to be
ripped out?

Comment 6

[[e-mail]]

Comment on attachment 180419 [details] [diff] [review]
Like so

It looks as if attachment 47402 [details] [diff] [review] was responsible for removing support for
-moz-bulletinboard but not the keyword itself :-( Also do we need the XUL atom?

Comment 7

[Boris Zbarsky [:bzbarsky]]

Separate bug on page-break, please?  It _is_ used, but I'm not sure it should
be... In any case, that one's not nearly as clear-cut as this.

Comment 8

[Martijn Wargers (dead)]

(In reply to comment #7)
> Separate bug on page-break, please? 
Ok, I filed bug 289975 on that.

Comment 9

[Boris Zbarsky [:bzbarsky]]

As for the atom, if the tag itself is used we should keep it so it doesn't have
to be allocated on-demand.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 180419 [details] [diff] [review]
Like so

Requesting approval for this simple crash fix.

Comment 11

[[e-mail]]

(In reply to comment #9)
>As for the atom, if the tag itself is used we should keep it so it doesn't have
>to be allocated on-demand.
Does xul.css count as a use? I didn't spot anything obvious in LXR.

Comment 12

[Boris Zbarsky [:bzbarsky]]

> Does xul.css count as a use?

Yes, since we'll atomize that selector.

Comment 13

[Asa Dotzler [:asa]]

Comment on attachment 180419 [details] [diff] [review]
Like so

a=asa

Comment 14

[Boris Zbarsky [:bzbarsky]]

Fixed at 2005-04-12 08:27.

Comment 15

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using the testcase at
https://bugzilla.mozilla.org/attachment.cgi?id=180416 with Seamonkey trunk build
2005-04-14-11 on Windows XP.