319558 - Crash when clicking on blank area - images blocked - JavaScript disabled [@ GetSelectionClosestFrameForChild]

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[Tom Cathey]

User-Agent:       Mozilla/5.0 (Windows; U; Win95; en-US; rv:1.9a1) Gecko/20051208 Firefox/1.6a1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051208 Firefox/1.6a1



Reproducible: Always

Steps to Reproduce:
Disable JavaScript (Uncheck enable JavaScript)
Go to https://webauth.att.net/auth/webmail/login
(Login NOT required).
Right-click on the large ad image and block images from webauth.att.net

Clear cache, close and then reopen Deer Park
Go to the same URL
Left-click anywhere on the LEFT of the screen in the blue area.

Observe crash.

No crash if images are not blocked and/or JavaScript enabled.

Same results when conducted in Safe Mode.

NO crash with 2005120705
   Crash with 2005120800
   Crash with 2005120805 -- TB12739788K 12/8/2005 10:11 AM EST

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051208 Firefox/1.6a1
Actual Results:  
Crash - TB12739788K 12/8/2005 10:11 AM EST

Comment 1

[Adam Guthrie]

Incident ID: 12739788
Stack Signature	GetSelectionClosestFrameForChild 8a531ae2
Product ID	FirefoxTrunk
Build ID	2005120805
Trigger Time	2005-12-08 07:11:25.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001a13c9)
URL visited	https://webauth.att.net
User Comments	JaveScript disabled. Images blocked. Left-click on left of screen in blue area.
Since Last Crash	567 sec
Total Uptime	567 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1828
Stack Trace 	
GetSelectionClosestFrameForChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1828]
GetSelectionClosestFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 2058]
GetSelectionClosestFrameForChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1830]
GetSelectionClosestFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 2058]
GetSelectionClosestFrameForChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1830]
GetSelectionClosestFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 2058]
GetSelectionClosestFrameForChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1830]
GetSelectionClosestFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 2058]
GetSelectionClosestFrameForChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1830]
GetSelectionClosestFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 2058]
GetSelectionClosestFrameForChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1830]
GetSelectionClosestFrameForLine  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1913]
GetSelectionClosestFrameForBlock  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1984]
GetSelectionClosestFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 2004]
nsFrame::GetContentAndOffsetsFromPoint  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 2113]
nsFrame::HandlePress  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 1297]
nsFrame::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 979]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6052]
PresShell::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5863]
nsViewManager::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2545]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2237]
HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 176]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1162]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6007]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6213]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1351]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 162]
main  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Tom Cathey]

On second thought, is this possibly related to or a duplicate of...
Bug 319503 - Crash when viewing Tinderbox

Comment 3

[Adam Guthrie]

(In reply to comment #2)
> On second thought, is this possibly related to or a duplicate of...
> Bug 319503 - Crash when viewing Tinderbox

Sure does. :(


*** This bug has been marked as a duplicate of 319503 ***

Comment 4

[Brian Polidoro]

Two reliable ways I've noticed to get this crash are:
On http://tinderbox.mozilla.org/Firefox/
Click on any empty table area like the guilty column or a gray area.

On http://talkback-public.mozilla.org/talkback/fastfind.jsp
Start selecting with the word quicksearch and keep selecting more of the page going downward.  

Comment 5

[Mark Mentovai]

layout/generic/nsFrame.cpp:
2057     if (closestFrame);

Oops.

Fixed.

Comment 6

[Boris Zbarsky [:bzbarsky]]

*** Bug 319503 has been marked as a duplicate of this bug. ***

Comment 7

[Adam Guthrie]

*** Bug 319595 has been marked as a duplicate of this bug. ***

Comment 8

[Eli Friedman]

Thanks to everyone who dealt with this; sorry for the inconvenience.

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

*** Bug 319621 has been marked as a duplicate of this bug. ***

Comment 10

[Adam Guthrie]

*** Bug 319721 has been marked as a duplicate of this bug. ***

Comment 11

[Jerry Baker]

*** Bug 319750 has been marked as a duplicate of this bug. ***

Comment 12

[George Jehn]

Can anyone tell me why I get the message "C is not a proper Protocol" and images are not displayed?