259764 - Crashes when switching style on http://ln.hixie.ch/

Status: RESOLVED DUPLICATE of bug 231776

(Core :: Layout, defect)

Description

[Wladimir Palant]

This is a reproducible crash. Go to ln.hixie.ch and try to switch the style to
Orange - it results in a crash in Mozilla 1.7.3, Mozilla trunk nightly
2004091512 and Firefox 1.0PR. The crash occurs in
nsHTMLContainerFrame::CreateViewForFrame() - GetAncestorWithView() fails causing
an assertion and parent->GetView() one line below crashes then. Talkback ID is
TB834574W. Detailed stack trace:

nsIFrame::GetView()
nsHTMLContainerFrame::CreateViewForFrame()
nsCSSFrameConstructor::ConstructFrameByDisplayType()
nsCSSFrameConstructor::ConstructFrameInternal()
nsCSSFrameConstructor::ConstructFrame()
nsCSSFrameConstructor::ProcessChildren()
nsCSSFrameConstructor::ConstructTableCellFrame()
nsCSSFrameConstructor::TableProcessChild()
nsCSSFrameConstructor::TableProcessChildren()
nsCSSFrameConstructor::ConstructTableFrame()
nsCSSFrameConstructor::ConstructFrameByDisplayType()
nsCSSFrameConstructor::ConstructFrameInternal()
nsCSSFrameConstructor::ConstructFrame()
nsCSSFrameConstructor::ConstructDocElementTableFrame()
nsCSSFrameConstructor::ConstructDocElementFrame()
nsCSSFrameConstructor::ReconstructDocElementHierarchy()
nsCSSFrameConstructor::RecreateFramesForContent()
nsCSSFrameConstructor::ProcessRestyledFrames()
nsIPresShell::ReconstructStyleDataInternal()
PresShell::EndUpdate()
nsDocument::EndUpdate()
nsCSSStyleSheet::SetDisabled()

Bug 256108 describes a similar problem, the stack trace is different though.

Comment 1

[Wladimir Palant]

Attachment: Minimized testcase

Comment 2

[Wladimir Palant]

If this is a regression, then it is not a recent one - build 2004031809 crashes
as well.

Comment 3

[Wladimir Palant]

Attachment: Add missing checks

This adds two additional checks to nsHTMLContainerFrame::CreateViewForFrame()
and prevents the crash. However, there might be more work to do - with this
patch the element with absolute positioning isn't displayed at all. I don't
know what behavior would be correct here and even if I knew - I don't know
enough about CSS processing to fix this.

Comment 4

[Wladimir Palant]

It seems that this is a regression from bug 113083.

Comment 5

[GavinS]

Just noting that there are 4 talkbacks about this - I'm assuming they are all
the same..

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=hixie&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=

Comment 6

[Wladimir Palant]

*** This bug has been marked as a duplicate of 231776 ***