325377 - Crash on reload with evil xul textcase, using menulist and nested tooltips

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes on reload.
Doesn't crash in 2004-07-11 build, crashes in 2004-07-18 build (Ria, you have builds in that area to narrow it down further?)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (crashes on reload)

Comment 2

[Martijn Wargers (dead)]

Attachment: backtrace

This is the backtrace, that I get, first I get an assertion:
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file c:/mozill
a/mozilla/layout/generic/nsPlaceholderFrame.h, line 121
Break: at file c:/mozilla/mozilla/layout/generic/nsPlaceholderFrame.h, line 121

Then the crash itself:
Program received signal SIGSEGV, Segmentation fault.
0x055eb10e in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0,
    aSID=eStyleStruct_Display)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:595
warning: Source file is more recent than executable.

595       #undef STYLE_STRUCT
Current language:  auto; currently c++
(gdb) bt
#0  0x055eb10e in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0,
    aSID=eStyleStruct_Display)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:595
#1  0x055eb31d in nsIFrame::GetStyleDisplay() const (this=0x0)
    at c:/mozilla/mozilla/layout/style/nsStyleStructList.h:90
#2  0x04ea5e38 in DoDeletingFrameSubtree(nsPresContext*, nsIPresShell*, nsFrameM
anager*, nsVoidArray&, nsIFrame*, nsIFrame*) (aPresContext=0x1004e658,
    aPresShell=0x10341688, aFrameManager=0x103416a4, aDestroyQueue=@0x22e588,
    aRemovedFrame=0x103970e4, aFrame=0x103970e4)
    at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:9649
#3  0x04ea5ff4 in DeletingFrameSubtree(nsPresContext*, nsIPresShell*, nsFrameMan
ager*, nsIFrame*) (aPresContext=0x1004e658, aPresShell=0x10341688,
    aFrameManager=0x103416a4, aFrame=0x103970e4)
    at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:9710

Comment 3

[Ria Klaassen (not reading all bugmail)]

(In reply to comment #0)
> Doesn't crash in 2004-07-11 build, crashes in 2004-07-18 build (Ria, you have
> builds in that area to narrow it down further?)
> 
No, I have only the same ones.

Comment 4

[Boris Zbarsky [:bzbarsky]]

I see this crash in 2004-07-18-07 but not in 2004-07-17-08.  Checkin list:

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=SeaMonkeyAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-07-17+08&maxdate=2004-07-18+07&cvsroot=%2Fcvsroot

Comment 5

[Boris Zbarsky [:bzbarsky]]

I bet fixing bug 324721 will help.  Or at least make it clearer what's going on here.

Comment 6

[chris hofmann]

doesn't look like this will make 1.9a1, but may try for a2

Comment 7

[Martijn Wargers (dead)]

This got fixed on trunk between 2007-03-04 and 2007-03-05:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-03-04+04&maxdate=2007-03-05+09&cvsroot=%2Fcvsroot
It also doesn't crash anymore on the latest branch build.
So I think this was fixed by the fix for bug 372576.

Comment 8

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9b3pre) Gecko/2008010104 Minefield/3.0b3pre ID:2008010104 and the testcase. No Crash on testcase - changing bug to verified

Comment 9

[Mats Palmgren (inactive)]

Add crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1b8bb5a15307

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1b8bb5a15307