131008 - Crash with 1 line of XUL [@ nsHTMLContainerFrame::CreateViewForFrame ][@ nsIFrame::GetView ]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P4)

Description

[Michael Hearn]

... or maybe it isn't XUL. First off, this is almost certainly invalid markup,
but it gives me definite, 100% repeatable crashes on 0.9.9 Win98:

<?xml-stylesheet href="chrome://global/skin" type="text/css"?>

<window xmlns:html="http://www.w3.org/1999/xhtml"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
	id="MainWindow"
	title="IWindow Test">
	

	<div style="width: 200px; height: 200px; background: lightblue; display:float;
position:absolute">abc</div>


</window>

Okay, there's almost certainly something wrong with that style, it's ages since
I did any CSS and I was never especially good at it anyway ;) Talkback IDs for
this one are:

TB4049014W
TB4049006H
email: [e-mail]

Comment 1

[Brian Ryner (not reading)]

Stack trace from talkback (both id's have identical stacks):

nsHTMLContainerFrame::CreateViewForFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line
555]
nsCSSFrameConstructor::ConstructFrameByDisplayType
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6103]
nsCSSFrameConstructor::ConstructFrameInternal
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 7107]
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 6963]
nsCSSFrameConstructor::ProcessChildren
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 12048]
nsCSSFrameConstructor::ConstructDocElementFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 3296]
nsCSSFrameConstructor::ContentInserted
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 8598]
StyleSetImpl::ContentInserted
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1452]
PresShell::InitialReflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2633]
nsXULDocument::StartLayout
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 4403]
nsXULDocument::ResumeWalk
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5945]
nsXULDocument::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 6162]
nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 163]
nsFileChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\file\src\nsFileChannel.cpp, line 483]
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 213]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00648c16 

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Minimal testcase

All that's needed is the "position:absolute"

Comment 3

[Olivier Cahagne]

Also crashing build 2002031221 on Linux.
OS -> All.

Comment 4

[Christine Hoffman]

Changing QA contact

Comment 5

[Olivier Cahagne]

still crashing using Linux build 20021128, same stack as comment 1.

Comment 6

[Andrew Schultz]

reassign

Comment 7

[Doron Rosenberg (IBM)]

ran into this myself, nasty.

Comment 8

[Boris Zbarsky [:bzbarsky]]

So the problem here is that nsCSSFrameConstructor::ConstructDocElementFrame only
pushes the root element as an absolute containing block if isBlockFrame is set.
 For XUL, it is _not_ set (it's not a blockframe).

The result is that we end up constructing an abs pos frame with a null parent
later on, and nsHTMLContainerFrame::CreateViewForFrame does not null-check the
result of GetParent().

It's not clear to me, frankly, how exactly a XUL box would go about being an
absolute containing block (I think I can see how it would have to act; we would
need a lot of work to get that working, though...).

Comment 9

[Adam Hauner]

(My crashes (TB23304148, TB23287311) on minimal testcase were with
nsIFrame::GetView signature, so adding it to summary)

Comment 10

[Jo Hermans]

Attachment: Mac OS X crash

same crash, but on Mac OS X 10.2.8

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7a) Gecko/20031223

Comment 11

[Jo Hermans]

Oh I see, that it's probably the same as bug 229263

Comment 12

[Bernd]

wfm winxp 2004111204

Comment 13

[Boris Zbarsky [:bzbarsky]]

This is covered over on trunk by some null-checks that effectively disable
positioning in XUL....  Those really need to be removed, though.

Comment 14

[olecom]

<https://bugzilla.mozilla.org/show_bug.cgi?id=137216#c20>

Comment 15

[Ronald Tilby]

The Minimal testcase WFM using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060526 Minefield/3.0a1 ID:2006052604

Comment 16

[Martijn Wargers (dead)]

The testcase is also wfm with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060916
Minefield/3.0a1
Most likely fixed by bug 231776.

Comment 17

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/54417ebbaea2