128849 - Changing style settings of cloned node with absolute position causes mozilla to crash.

Status: RESOLVED WORKSFORME

(Core :: DOM: CSS Object Model, defect)

Description

[Geraint]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8) Gecko/20020204
BuildID:    2002020415

Take a look at http://www.copyn.plus.com/mozTest35.html

If you click the first blue box an absolutely positioned clone will be created
within a "3D-frame" appearing alongside the blue box.

If you click the second blue box mozilla will crash.

In each case the blue box is an absolutely positioned DIV within the larger box.
 When you click the blue box I create the "3D-frame" (another absolutely
positioned DIV), append it as a child of the larger box, clone the blue box and
append the clone as a child of the "3D-frame".

The difference is that in the first scenario I force the "3D-frame" to be
absolutely positioned by setting the style setting before appending it as a
child of the larger box, in the second I do not.  Since the absolute positioning
is part of the style settings of the classname assigned to the "3D-frame" this
step should be redundant.  It appears to be critical :-(.

I have more complex examples that do not cause a crash but where the absolute
position of the cloned node is ignored (I cannot recreate this in a more concise
example).

This behaviour is not exhibited in Mozilla 0.9.6 or earlier.

Reproducible: Always

Comment 1

[Boris Zbarsky [:bzbarsky]]

Could you possibly crash in a talkback build and list the incident ID here?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Oh, as a note this is not reproducible in my Linux build from 2002-03-03.  I bet
this was fixed by Marc's changes to placeholder frame stuff....

Comment 3

[Geraint]

Talkback id of crash is TB3634588H

Comment 4

[Boris Zbarsky [:bzbarsky]]

stephend, could you get the stack?  TB3634588H

Geraint, what was the build ID of that talkback build?

Comment 5

[Geraint]

I used the installer from the latest nightlies directory (as per link on
www.mozilla.org) and installed into a new directory.  Strangely, what it
installed was still Build ID 2002020415.  Is that a bug in the installer I ask
myself?

I am downloading the latest targz now and hope to get a true nightly build from
that.  ISDN at 7.4KB/sec means that takes longer than I would like :-(.  Will
check and repost with the results from that download.

Comment 6

[Andrew Schultz]

worksforme with Linux builds back to 20020222.  crashes with 20020220 and earlier

Comment 7

[Geraint]

In Linux build 2002030406 the crash problem, together with the related but more
difficult to distill formating problem, are fixed.

Comment 8

[[e-mail] (gone - use [e-mail] instead)]

nsLineLayout::ReflowFrame()
nsBlockFrame::ReflowInlineFrame()
nsBlockFrame::DoReflowInlineFrames()
nsBlockFrame::DoReflowInlineFramesAuto()
nsBlockFrame::ReflowInlineFrames()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsAbsoluteContainingBlock::ReflowAbsoluteFrame()
nsAbsoluteContainingBlock::IncrementalReflow()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
CanvasFrame::Reflow()
nsBoxToBlockAdaptor::Reflow()
nsBoxToBlockAdaptor::DoLayout()
nsBox::Layout()
nsScrollBoxFrame::DoLayout()
nsBox::Layout()
nsContainerBox::LayoutChildAt()
nsGfxScrollFrameInner::LayoutBox()
nsGfxScrollFrameInner::Layout()
nsGfxScrollFrame::DoLayout()
nsBox::Layout()
nsBoxFrame::Reflow()
nsGfxScrollFrame::Reflow()
nsContainerFrame::ReflowChild()
ViewportFrame::Reflow()
nsHTMLReflowCommand::Dispatch()
PresShell::ProcessReflowCommand()
PresShell::ProcessReflowCommands()
PresShell::FlushPendingNotifications()
nsDocument::FlushPendingNotifications()
nsHTMLDocument::FlushPendingNotifications()
GlobalWindowImpl::FlushPendingNotifications()
GlobalWindowImpl::GetFrames()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_GetterSetter()
js_Invoke()
js_InternalInvoke()
js_GetProperty()
js_Interpret()
js_Invoke()
nsXPCWrappedJSClass::CallMethod()
nsXPCWrappedJS::CallMethod()
PrepareAndDispatch()
nsXPTCStubBase::Stub3()
nsEventListenerManager::HandleEventSubType()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleChromeEvent()
GlobalWindowImpl::HandleDOMEvent()
nsDocument::HandleDOMEvent()
nsEventStateManager::SendFocusBlur()
nsEventStateManager::SetContentState()
nsEventStateManager::PostHandleEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWidget::OnButtonPressSignal()
nsWindow::HandleGDKEvent()
dispatch_superwin_event()
handle_gdk_event()
libgdk-1.2.so.0 + 0x175e0 (0x403465e0)
libglib-1.2.so.0 + 0x10796 (0x40375796)
libglib-1.2.so.0 + 0x10da3 (0x40375da3)
libglib-1.2.so.0 + 0x10f4c (0x40375f4c)
libgtk-1.2.so.0 + 0x91b59 (0x40292b59)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x189ee (0x404879ee)