123231 - crash with script 30 on dhtmlcentral.com

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P2)

Description

[Adam Hauner]

Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:0.9.8+) Gecko/20020202

Repro:
1. open new tab
2. go to URL in opened tab
3. move mouse over links on page
4. close tab

Actual:
Crash. TB2452411Y, TB2452389W, TB2452348H

Expected:
=)

Related:
bug 109754, bug 109666, bug 91900

Comment 1

[Henrik Gemal]

sure do crash and burn!

Comment 2

[Boris Zbarsky [:bzbarsky]]

Seeing this on a 2002-02-02 morning debug build.

During load:

###!!! ASSERTION: can't find deleted frame in lines: 'line != line_end', file
nsBlockFrame.cpp, line 4921
###!!! Break: at file nsBlockFrame.cpp, line 4921
###!!! ASSERTION: bad prevSibling: 'tmp == aDeletedFrame', file
nsBlockFrame.cpp, line 4925
###!!! Break: at file nsBlockFrame.cpp, line 4925
Document http://www.dhtmlcentral.com/script/script30_demo.html loaded
successfully
###!!! ASSERTION: invalid float type: '(NS_STYLE_FLOAT_LEFT ==
floaterDisplay->mFloats) || (NS_STYLE_FLOAT_RIGHT == floaterDisplay->mFloats)',
file nsBlockReflowState.cpp, line 887
###!!! Break: at file nsBlockReflowState.cpp, line 887

When closing tab:

#0  0x00000000 in ?? ()
#1  0x41d930ac in nsFrameList::DestroyFrames (this=0x8921ae4,
aPresContext=0x88c7668)
    at nsFrameList.cpp:130
#2  0x41be7812 in nsBlockFrame::Destroy (this=0x8921aa0, aPresContext=0x88c7668)
    at nsBlockFrame.cpp:326
#3  0x41d930ac in nsFrameList::DestroyFrames (this=0x891c1f8,
aPresContext=0x88c7668)
    at nsFrameList.cpp:130
#4  0x41be538a in nsAbsoluteContainingBlock::DestroyFrames (this=0x891c1f8, 
    aDelegatingFrame=0x891c1ac, aPresContext=0x88c7668)
    at nsAbsoluteContainingBlock.cpp:375

(gdb) frame 0
#0  0x00000000 in ?? ()
(gdb) frame 1
#1  0x41d930ac in nsFrameList::DestroyFrames (this=0x8921ae4,
aPresContext=0x88c7668)
    at nsFrameList.cpp:130
130         frame->Destroy(aPresContext);
Current language:  auto; currently c++

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Full stack

Comment 4

[Chris Petersen]

Changing QA Contact

Comment 5

[Amarendra Hanumanula]

 This bug might be related to Bug # 109666 . But comments in that bug says that 
the carsh was fixed. May be crash in this bug is not related to the crash in 
bug# 109666. Setting the priority to P1 since this is a high visibility site and 
to get it on radar.

Comment 6

[Amarendra Hanumanula]

 Changing the priority to P2

Comment 7

[Kevin McCluskey (gone)]

Marking nsbeta1+

Comment 8

[Marc Attinasi]

WFM using 02/25 build.  Looks like this was related to the problem where the
placeholder frame for a positioned element was being left in the frame list.

Please reopen if still not working for you - thanks!

Comment 9

[Adam Hauner]

v=aha