53150 - Using DOM to add tabs crashes Mozilla.

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Eric Promislow]

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
BuildID:    2000091312

Adding a tab using tabbox.appendChild() causes stack overflow in rdf.dll

Reproducible: Always
Steps to Reproduce:
1. Load the attached xul file as chrome (I use a debug version of
Mozilla, and have it in packages/komodo/komodo/content/editor/tab.xul).
2. Press the button
3. Pick up the pieces.

Actual Results:  I get the OK/Cancel fatal error dialog box.			
				

Expected Results:  	Added a second tab to the right of the first.  It did
this last week before we moved to the post capabilityID version
of Moz.

Comment 1

[Eric Promislow]

Attachment: Standalone XUL to reproduce the error.

Comment 2

[David Hyatt]

I suspect this is the problem danm just fixed today (an infinite recursion 
involving unnecessary <children> insertion points that are placed immediately 
under <content> elements in XBL).  Reassigning to danm and confirming.

Comment 3

[David Hyatt]

Dan, this looks like the bug you and I fixed today.

Comment 4

[David Hyatt]

Nominating for nsbeta3, since I know this bug causes the product to crash on 
some of morse's dialogs.

Comment 5

[Johnny Stenback (:jst)]

*** Bug 53149 has been marked as a duplicate of this bug. ***

Comment 6

[Dan M]

Yes, same root cause as bug 53116. Marking dependent.

Comment 7

[Peter Trudelle]

nsbeta3+, ActiveState needs this, they are partnering with us on tools.

Comment 8

[Dan M]

Fixed along with bug 53116.

Comment 9

[John Morrison]

verified fixed for the original bug, an infinite recursion in classic skin.
20000922nn mac/linux/win32 (both skins tested, although this was classic-only).

The testcase still crashes when you click on one of the generated tabs (in 
either skin, XP) but that is because the testcase does not add content to 
the tabpanel, to match the <tab>s that are added to the <tabbox>. I have 
filed bug #53885 to cover this case.