13730 - [CRASH]crashing in layout when putting HTML into an iframe

Status: VERIFIED FIXED

(Core :: Layout, defect, P1)

Description

[Robert John Churchill]

Rick, I don't know if this bug is yours or not, but I'm hoping that you'll know
who to reassign it to if its not yours.

I'm seeing a crash in layout when document.writeln()'ing some HTML into an
iframe. To reproduce:

run apprunner, select "Search | Search the internet". Click on the checkbox to
the left of a search engine (for example, select Google). Type some text into the
input field to search for (for example, "LDAP") and click on the Search button or
simply press return.

You should see a list of results appear. You'll notice that above the table of
results, you'll see "All Search Results" followed by a button for each engine you
selected (so, Google should appear here if you chose it). Click on the "Google"
button.

What SHOULD happen is that the tree of results disappears, and is replaced by the
complete HTML as sent from Google for the search you just did. However, instead
it'll crash (on all platforms, I believe.)

A partial stack trace:

PresShell::Paint(nsIView*,nsIRenderingContext&,const nsRect&)
nsTableRowFrame::Paint(nsIPresContext&,nsIRenderingContext&,
                       const nsRect&,nsFramePaintLayer)
nsTableFrame::GetTableFrame(nsIFrame*,nsTableFrame*&)

Comment 1

[rickg]

V -- please take a look at this crasher.

Comment 2

[vidur (gone)]

rjc, I need a more reduced test case. I spent a bit of time searching through
browser .xul and .js files trying to create one and realized that you could
probably do this with a lot less effort. Sorry to push this back on you, but I'm
too doomed at this moment to spend a huge amount of time reducing a test case.

Temporarily assigning this to rjc for a test case.

Comment 3

[Robert John Churchill]

Vidur, I don't have a simpler test case, but I can point you directly at the JS
where this is happening, and its pretty small and trivial.  Look at:

mozilla/xpfe/components/search/resources/internetresults.js
in the function  doEngineClick()  [starting around line 20]

Simply, this function gets a string chunk of HTML out from RDF, and then at the
END of the  doEngineClick()  function it does a doc.open() on an iframe defines
in "internetresults.xul", then a doc.writeln(), then a doc.close()

Hope that helps,
Robert

Comment 4

[Robert John Churchill]

On current builds (late evening of Nov 24, 1999) this now works correctly on all
platforms (Mac, Win98, WinNT, and Linux). Marking as fixed.

Comment 5

[Chris Petersen]

Marking as verified fixed in the Nov 29th build (Mac , Linux and Windows)