142888 - Mozilla crashes when preview tab clicked in composer

Status: VERIFIED DUPLICATE of bug 152973

(Core :: DOM: Editor, defect)

Description

[Bruce Terry]

While trying to edit the above page in composer, I made minor changes in the
code on the HTML Source page and then clicked the preview tab to see the result
of the changes.  Twice Mozilla crashed.  Crash data was sent.  The Mozilla
version was 1.0 RC1.

Comment 1

[Kathleen :Brade]

Michael--can you reproduce?
Bruce Terry--can you come up with a minimal testcase?  What change(s) did you
make in the html source tab?  Is adding a space enough?  Do you have the
Talkback ID numbers?

Comment 2

[michael wendell]

I am able to reproduce this bug on Win 98 using the 05-08 trunk build.  05-07
1.0.0 branch appears to be working fine.

My steps:
1. Load http://www.ovc.edu/terry/dissertation/index.htm in browser
2. Click File - Edit Page to load page into Composer
3. Click on HTML Source View
4. Type "new text" after body tag
5. Click on Preview 

Crash, Talkback ID: TB6106703Z

Comment 3

[Kathleen :Brade]

nsRuleNode::WalkRuleTree [nsRuleNode.cpp, line 1544]
nsRuleNode::GetMarginData [nsRuleNode.cpp, line 1320]
nsRuleNode::GetStyleData [nsRuleNode.cpp, line 4741]
nsStyleContext::GetStyleData [nsStyleContext.cpp, line 348]
IsPercentageAwareChild [nsBlockFrame.cpp, line 1112]
nsBlockFrame::ReflowInlineFrame [nsBlockFrame.cpp, line 3768]
nsBlockFrame::DoReflowInlineFrames [nsBlockFrame.cpp, line 3534]
nsBlockFrame::DoReflowInlineFramesAuto [nsBlockFrame.cpp, line 3424]
nsBlockFrame::ReflowInlineFrames [nsBlockFrame.cpp, line 3369]
nsBlockFrame::ReflowLine [nsBlockFrame.cpp, line 2527]
nsBlockFrame::ReflowDirtyLines [nsBlockFrame.cpp, line 2171]
nsBlockFrame::Reflow [nsBlockFrame.cpp, line 928]
nsBlockReflowContext::DoReflowBlock [nsBlockReflowContext.cpp, line 581]
nsBlockReflowContext::ReflowBlock [nsBlockReflowContext.cpp, line 359]
nsBlockFrame::ReflowBlockFrame [nsBlockFrame.cpp, line 3125]
nsBlockFrame::ReflowLine [nsBlockFrame.cpp, line 2393]
nsBlockFrame::ReflowDirtyLines [nsBlockFrame.cpp, line 2171]
nsBlockFrame::Reflow [nsBlockFrame.cpp, line 928]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
CanvasFrame::Reflow [nsHTMLFrame.cpp, line 565]
nsBoxToBlockAdaptor::Reflow [nsBoxToBlockAdaptor.cpp, line 837]
nsBoxToBlockAdaptor::DoLayout [nsBoxToBlockAdaptor.cpp, line 619]
nsBox::Layout [nsBox.cpp, line 1052]
nsScrollBoxFrame::DoLayout [nsScrollBoxFrame.cpp, line 395]
nsBox::Layout [nsBox.cpp, line 1052]
nsContainerBox::LayoutChildAt [nsContainerBox.cpp, line 650]
nsGfxScrollFrameInner::LayoutBox [nsGfxScrollFrame.cpp, line 1063]
nsGfxScrollFrameInner::Layout [nsGfxScrollFrame.cpp, line 1222]
nsGfxScrollFrame::DoLayout [nsGfxScrollFrame.cpp, line 1071]
nsBox::Layout [nsBox.cpp, line 1052]
nsBoxFrame::Reflow [nsBoxFrame.cpp, line 1001]
nsGfxScrollFrame::Reflow [nsGfxScrollFrame.cpp, line 780]
nsContainerFrame::ReflowChild [nsContainerFrame.cpp, line 807]
ViewportFrame::Reflow [nsViewportFrame.cpp, line 588]
nsHTMLReflowCommand::Dispatch [nsHTMLReflowCommand.cpp, line 224]
PresShell::ProcessReflowCommand [nsPresShell.cpp, line 6188]
PresShell::ProcessReflowCommands [nsPresShell.cpp, line 6243]
PresShell::FlushPendingNotifications [nsPresShell.cpp, line 5049]
PresShell::EndReflowBatching [nsPresShell.cpp, line 5080]
nsEditor::EndUpdateViewBatch [nsEditor.cpp, line 4270]
nsEditor::EndTransaction [nsEditor.cpp, line 673]
nsEditorShell::EndBatchChanges [nsEditorShell.cpp, line 4284]
XPTC_InvokeByIndex [xptcinvoke.cpp, line 106]
XPCWrappedNative::CallMethod [xpcwrappednative.cpp, line 1995]
XPC_WN_CallMethod [xpcwrappednativejsops.cpp, line 1267]
js_Invoke [jsinterp.c, line 790]
js_Interpret [jsinterp.c, line 2744]
js_Invoke [jsinterp.c, line 806]
js_InternalInvoke [jsinterp.c, line 881]
JS_CallFunctionValue [jsapi.c, line 3426]
nsJSContext::CallEventHandler [nsJSEnvironment.cpp, line 1045]
nsJSEventListener::HandleEvent [nsJSEventListener.cpp, line 184]
nsEventListenerManager::HandleEventSubType [nsEventListenerManager.cpp, line 1220]
nsEventListenerManager::HandleEvent [nsEventListenerManager.cpp, line 2212]
nsXULElement::HandleDOMEvent [nsXULElement.cpp, line 3447]
PresShell::HandleDOMEventWithTarget [nsPresShell.cpp, line 6036]
nsButtonBoxFrame::MouseClicked [nsButtonBoxFrame.cpp, line 195]
nsButtonBoxFrame::HandleEvent [nsButtonBoxFrame.cpp, line 142]
PresShell::HandleEventInternal [nsPresShell.cpp, line 6005]
PresShell::HandleEventWithTarget [nsPresShell.cpp, line 5956]
nsEventStateManager::CheckForAndDispatchClick [nsEventStateManager.cpp, line 2624]
nsEventStateManager::PostHandleEvent [nsEventStateManager.cpp, line 1705]
PresShell::HandleEventInternal [nsPresShell.cpp, line 6009]
PresShell::HandleEvent [nsPresShell.cpp, line 5911]

Comment 4

[jack.jia]

  This bug can reproduced in the NS7.0_PR1 and can not existed in the trunk.  

Comment 5

[Kathleen :Brade]

This sounds like a duplicate of bug 152973 (which was duped to 141054 which is
fixed now).  Can someone confirm?

Comment 6

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

*** Bug 143177 has been marked as a duplicate of this bug. ***

Comment 7

[Kathleen :Brade]

*** This bug has been marked as a duplicate of 152973 ***

Comment 8

[sujay]

verified.