Changing style settings of cloned node with absolute position causes mozilla to crash.

RESOLVED WORKSFORME

Status

()

Core
DOM: CSS Object Model
--
critical
RESOLVED WORKSFORME
16 years ago
16 years ago

People

(Reporter: Geraint, Assigned: jst)

Tracking

({crash})

Trunk
x86
Linux
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

(Reporter)

Description

16 years ago
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8) Gecko/20020204
BuildID:    2002020415

Take a look at http://www.copyn.plus.com/mozTest35.html

If you click the first blue box an absolutely positioned clone will be created
within a "3D-frame" appearing alongside the blue box.

If you click the second blue box mozilla will crash.

In each case the blue box is an absolutely positioned DIV within the larger box.
 When you click the blue box I create the "3D-frame" (another absolutely
positioned DIV), append it as a child of the larger box, clone the blue box and
append the clone as a child of the "3D-frame".

The difference is that in the first scenario I force the "3D-frame" to be
absolutely positioned by setting the style setting before appending it as a
child of the larger box, in the second I do not.  Since the absolute positioning
is part of the style settings of the classname assigned to the "3D-frame" this
step should be redundant.  It appears to be critical :-(.

I have more complex examples that do not cause a crash but where the absolute
position of the cloned node is ignored (I cannot recreate this in a more concise
example).

This behaviour is not exhibited in Mozilla 0.9.6 or earlier.

Reproducible: Always
Could you possibly crash in a talkback build and list the incident ID here?
Oh, as a note this is not reproducible in my Linux build from 2002-03-03.  I bet
this was fixed by Marc's changes to placeholder frame stuff....
(Reporter)

Comment 3

16 years ago
Talkback id of crash is TB3634588H
stephend, could you get the stack?  TB3634588H

Geraint, what was the build ID of that talkback build?
(Reporter)

Comment 5

16 years ago
I used the installer from the latest nightlies directory (as per link on
www.mozilla.org) and installed into a new directory.  Strangely, what it
installed was still Build ID 2002020415.  Is that a bug in the installer I ask
myself?

I am downloading the latest targz now and hope to get a true nightly build from
that.  ISDN at 7.4KB/sec means that takes longer than I would like :-(.  Will
check and repost with the results from that download.

Comment 6

16 years ago
worksforme with Linux builds back to 20020222.  crashes with 20020220 and earlier
(Reporter)

Comment 7

16 years ago
In Linux build 2002030406 the crash problem, together with the related but more
difficult to distill formating problem, are fixed.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → WORKSFORME
nsLineLayout::ReflowFrame()
nsBlockFrame::ReflowInlineFrame()
nsBlockFrame::DoReflowInlineFrames()
nsBlockFrame::DoReflowInlineFramesAuto()
nsBlockFrame::ReflowInlineFrames()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsAbsoluteContainingBlock::ReflowAbsoluteFrame()
nsAbsoluteContainingBlock::IncrementalReflow()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
CanvasFrame::Reflow()
nsBoxToBlockAdaptor::Reflow()
nsBoxToBlockAdaptor::DoLayout()
nsBox::Layout()
nsScrollBoxFrame::DoLayout()
nsBox::Layout()
nsContainerBox::LayoutChildAt()
nsGfxScrollFrameInner::LayoutBox()
nsGfxScrollFrameInner::Layout()
nsGfxScrollFrame::DoLayout()
nsBox::Layout()
nsBoxFrame::Reflow()
nsGfxScrollFrame::Reflow()
nsContainerFrame::ReflowChild()
ViewportFrame::Reflow()
nsHTMLReflowCommand::Dispatch()
PresShell::ProcessReflowCommand()
PresShell::ProcessReflowCommands()
PresShell::FlushPendingNotifications()
nsDocument::FlushPendingNotifications()
nsHTMLDocument::FlushPendingNotifications()
GlobalWindowImpl::FlushPendingNotifications()
GlobalWindowImpl::GetFrames()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_GetterSetter()
js_Invoke()
js_InternalInvoke()
js_GetProperty()
js_Interpret()
js_Invoke()
nsXPCWrappedJSClass::CallMethod()
nsXPCWrappedJS::CallMethod()
PrepareAndDispatch()
nsXPTCStubBase::Stub3()
nsEventListenerManager::HandleEventSubType()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleChromeEvent()
GlobalWindowImpl::HandleDOMEvent()
nsDocument::HandleDOMEvent()
nsEventStateManager::SendFocusBlur()
nsEventStateManager::SetContentState()
nsEventStateManager::PostHandleEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWidget::OnButtonPressSignal()
nsWindow::HandleGDKEvent()
dispatch_superwin_event()
handle_gdk_event()
libgdk-1.2.so.0 + 0x175e0 (0x403465e0)
libglib-1.2.so.0 + 0x10796 (0x40375796)
libglib-1.2.so.0 + 0x10da3 (0x40375da3)
libglib-1.2.so.0 + 0x10f4c (0x40375f4c)
libgtk-1.2.so.0 + 0x91b59 (0x40292b59)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x189ee (0x404879ee) 
Keywords: crash
You need to log in before you can comment on or make changes to this bug.