292311 - crash/hang on espn.go.com - Trunk [@ nsGfxScrollFrameInner::GetIntegerAttribute]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050428
Firefox/1.0+ 16:58PDT build

repro:
1. open espn
2. goodbye

there's unfortunately no talkback in the current builds

this regressed between  

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050428
Firefox/1.0+ 12:30PDT build (WFM)
and 
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050428
Firefox/1.0+ 16:58PDT build (crash)

Comment 1

[Peter van der Woude [:Peter6]]

checkins between the 2 builds 
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-04-28+12%3A31%3A00&maxdate=2005-04-28+16%3A01%3A00&cvsroot=%2Fcvsroot

Comment 2

[Darin Grimm]

Serious crasher bug, requesting blocking

Comment 3

[Martijn Wargers (dead)]

Attachment: Testcase

It seems to be happening because of the use of overflow-y:hidden.

Comment 4

[Martijn Wargers (dead)]

I guess this could be a fall-out from bug 240276.

Comment 5

[Peter van der Woude [:Peter6]]

talkback TB5449829E

Comment 6

[Peter van der Woude [:Peter6]]

Attachment: talkback TB5449829E

Comment 7

[John Johnston]

I am getting a crash on Fox Sports as well: http://msn.foxsports.com/

Comment 8

[Peter van der Woude [:Peter6]]

Attachment: Talkback TB5450368

nsGfxScrollFrameInner::GetIntegerAttribute 10f55cab
,the crash on ESPN

Comment 9

[Hermann Schwab]

Bug 246126 	Crash in nsGfxScrollFrameInner::GetIntegerAttribute

has a suggested fix attached

Comment 10

[Chris]

Bug should be changed to RESOLVED FIXED, does not crash on newest beast builds.

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

fixed by the checkin for bug 292286

Comment 12

[Jay Patel [:jay]]

verified per Talkback data.