595 - Clicking on links in a frame with target="_top" crash NGLayout

Status: VERIFIED WORKSFORME

(Core :: DOM: UI Events & Focus Handling, defect, P2)

Description

[Angus Davis]

To reproduce bug:
1. Load http://warp/
2. Click on "client" in left frame
3. Click on "Raptor" in right frame - notice it works - yippee! (no target=_top)
4. Click on "client" again in left frame
5. Click on "Nova" in right frame - crashes - (target=_top) is the only
difference really.

Here's a stack trace:
nsFrame::DisplaySelection(nsIPresContext & {...}) line 487 + 3 bytes
nsFrame::HandleEvent(nsFrame * const 0x010c7430, nsIPresContext & {...},
nsGUIEvent * 0x0012f308, nsEventStatus & nsEventStatus_eIgnore) line 566 + 12
bytes
nsContainerFrame::HandleEvent(nsContainerFrame * const 0x010c73b0,
nsIPresContext & {...}, nsGUIEvent * 0x0012f308, nsEventStatus &
nsEventStatus_eIgnore) line 341
nsView::HandleEvent(nsGUIEvent * 0x0012f308, unsigned int 28) line 666
nsScrollingView::HandleEvent(nsGUIEvent * 0x0012f308, unsigned int 28) line 900
+ 16 bytes
HandleEvent(nsGUIEvent * 0x0012f308) line 151 + 17 bytes
nsWindow::DispatchEvent(nsGUIEvent * 0x0012f308) line 288 + 10 bytes
nsWindow::DispatchStandardEvent(unsigned int 103) line 311 + 12 bytes
nsWindow::DispatchFocus(unsigned int 103) line 1935 + 12 bytes
nsWindow::ProcessMessage(unsigned int 7, unsigned int 5637742, long 0, long *
0x0012f458) line 1511 + 19 bytes
nsWindow::WindowProc(void * 0x0045065c, unsigned int 7, unsigned int 5637742,
long 0) line 337 + 27 bytes
USER32! 77e71ab7()
USER32! 77e71a77()
NTDLL! 77f7624f()
nsWindow::~nsWindow() line 391
ChildWindow::~ChildWindow() + 25 bytes
ChildWindow::`scalar deleting destructor'() + 20 bytes
nsObject::ReleaseObject() line 105 + 65 bytes
nsObject::InnerSupport::Release(nsObject::InnerSupport * const 0x01068ef0) line
71 + 17 bytes
nsView::~nsView() line 231 + 18 bytes
nsView::`scalar deleting destructor'() + 20 bytes
nsView::Destroy() line 368 + 38 bytes
nsView::~nsView() line 186 + 11 bytes
nsView::`scalar deleting destructor'() + 20 bytes
nsView::Release(nsView * const 0x010c74f0) line 286 + 38 bytes
nsFrame::~nsFrame() line 196 + 18 bytes
nsSplittableFrame::~nsSplittableFrame() line 33 + 13 bytes
nsContainerFrame::~nsContainerFrame() line 58 + 13 bytes
RootContentFrame::~RootContentFrame() + 25 bytes
RootContentFrame::`scalar deleting destructor'() + 20 bytes
nsFrame::DeleteFrame(nsFrame * const 0x010c7430) line 254 + 38 bytes
nsContainerFrame::~nsContainerFrame() line 56
RootFrame::~RootFrame() + 25 bytes
RootFrame::`scalar deleting destructor'() + 20 bytes
nsFrame::DeleteFrame(nsFrame * const 0x010c73b0) line 254 + 38 bytes
PresShell::~PresShell() line 315
PresShell::`scalar deleting destructor'() + 20 bytes
PresShell::Release(PresShell * const 0x010bc820) line 279 + 32 bytes
DocumentViewerImpl::~DocumentViewerImpl() line 190 + 18 bytes
DocumentViewerImpl::`scalar deleting destructor'() + 20 bytes
DocumentViewerImpl::Release(DocumentViewerImpl * const 0x010c9cb0) line 143 +
105 bytes
nsWebShell::Embed(nsWebShell * const 0x01031ef0, nsIContentViewer * 0x0110dc00,
char * 0x00000000, nsISupports * 0x00000000) line 378 + 31 bytes
nsDocumentBindInfo::OnStartBinding(nsDocumentBindInfo * const 0x011052f0, nsIURL
* 0x01105670, char * 0x01107320) line 862 + 36 bytes
NET_NGLayoutConverter(int 38, void * 0x00000000, URL_Struct_ * 0x011069a0,
MWContext_ * 0x01106c60) line 660 + 32 bytes
NET_StreamBuilder(int 38, URL_Struct_ * 0x011069a0, MWContext_ * 0x01106c60)
line 239 + 24 bytes
NET_CacheConverter(int 38, void * 0x00000000, URL_Struct_ * 0x011069a0,
MWContext_ * 0x01106c60) line 1558 + 17 bytes
NET_StreamBuilder(int 102, URL_Struct_ * 0x011069a0, MWContext_ * 0x01106c60)
line 239 + 24 bytes
net_setup_http_stream(_ActiveEntry * 0x01106e30) line 2878 + 22 bytes
net_ProcessHTTP(_ActiveEntry * 0x01106e30) line 3536 + 9 bytes
NET_ProcessNet(PRFileDesc * 0x01125320, int 2) line 3272 + 13 bytes
NET_PollSockets() line 180 + 18 bytes
nsNetlibService::NetPollSocketsCallback(nsITimer * 0x011089c0, void *
0x01013e60) line 488
TimerImpl::Fire(unsigned long 437456989) line 319 + 17 bytes
TimerImpl::ProcessTimeouts(unsigned long 437456989) line 197
FireTimeout(void * 0x00000000, unsigned int 275, unsigned int 3046, unsigned
long 437456989) line 101 + 9 bytes
USER32! 77e7128c()
main(int 1, char * * 0x00ff51d0) line 95
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77f1b304()

Comment 1

[James Everingham]

This works ok for me as of 08/07/98

Comment 2

[glynn]

added myself as qa contact, will verify "fix" on Monday

Comment 3

[glynn]

Verified fixed March 14 on windows, March 15 on Mac, Linux is not cooperating due
to other problems...

Comment 4

[Matthias Versen [:Matti]]

mid-air collision ? / bugzilla cleanup
Reopening (current State: verified and no resolution)

Comment 5

[Matthias Versen [:Matti]]

workforme

Comment 6

[Matthias Versen [:Matti]]

verified