15913 - mouse over link, extra content inserted into document

Status: VERIFIED DUPLICATE of bug 32518

(Core :: CSS Parsing and Computation, defect, P3)

Description

[buster]

go to mozillazine
see article about where to get irc clients
(http://www.mozillazine.org/talkback.html?article=795)
click on "Stroud's website" http://cws.internet.com/32irc.html
mouse over "next" link
notice lots of extra "next" links added to page content!

Comment 1

[cbegle]

is this still happening for you, buster? i just tried it with M10, and it
worked okay for me.  if it does happen, reopen it, but it should probably
be assigned to joki and the events components.  thanks!

Comment 2

[buster]

yes, it still happens with M11 code as of (approx) 10/22

Comment 3

[Mike McCabe]

Reassigning to events.

Comment 4

[leger]

Clearing WORKSFORME resolution due to reopen of this bug.

Comment 5

[Jonathan O'Keeffe]

Attachment: [TESTCASE] - HTML + CSS files

Comment 6

[Jonathan O'Keeffe]

Added test case, based on deconstructing page where problem was originally
reported (http://cws.internet.com/32irc.html).
Problem is *very* sensitive to placement of various SCRIPT and other tags on
the page.  If seemingly random SCRIPT or FORM tags in the testcase are moved or
removed, problem goes away.  Same goes for seemingly unrelated rules in the
stylesheet.  Tested using M10 build on W98.

Comment 7

[buster]

note:  jokeeffe's attachment is a .zip file that contains the .html and .css
files.

Comment 8

[ekrock's old account (dead)]

Bulk moving [testcase] code to new testcase keyword. Sorry for the spam!

Comment 9

[Dan Erikson]

This may be a dup of/related to bug 25379.

Comment 10

[Dan Erikson]

Doh!  Meant bug #25376, not 25379.

Comment 11

[/\/\arcio Galli]

This URL http://cws.internet.com/32irc.html
is crashing here win 98, 2000022908
Someone else have this?

Comment 12

[buster]

crash submitted as bug 29709

Comment 13

[harishd]

*** Bug 25376 has been marked as a duplicate of this bug. ***

Comment 14

[harishd]

Refer to bug 25376 for a better test case.

Comment 15

[harishd]

*** Bug 25352 has been marked as a duplicate of this bug. ***

Comment 16

[joki (gone)]

Somewhere in the course of the following stack we seem to end up creating new 
children and adding them to the doc.  Pretty cool, really.  But though its event 
triggered, the bug seems to be in style somewhere.

nsFrame::CreateAndPostReflowCommand(nsIPresShell * 0x04cca870, nsIFrame * 
0x02e2d290, nsIReflowCommand::ReflowType ReflowDirty, nsIFrame * 0x00000000, 
nsIAtom * 0x00000000, nsIAtom * 0x00000000) line 2724
nsBlockFrame::ReflowDirtyChild(nsBlockFrame * const 0x02e2d290, nsIPresShell * 
0x04cca870, nsIFrame * 0x00000000) line 6192 + 21 bytes
nsBlockFrame::RemoveFrame(nsBlockFrame * const 0x02e2d290, nsIPresContext * 
0x053d0610, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x02e2d314) 
line 5041
FrameManager::RemoveFrame(FrameManager * const 0x04cca2b0, nsIPresContext * 
0x053d0610, nsIPresShell & {...}, nsIFrame * 0x02e2d290, nsIAtom * 0x00000000, 
nsIFrame * 0x02e2d314) line 632
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x04ccab00, 
nsIPresContext * 0x053d0610, nsIContent * 0x04ccc03c, nsIContent * 0x04ce16dc, 
int 1) line 7182 + 63 bytes
nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x04ccab00, 
nsIPresContext * 0x053d0610, nsIContent * 0x04ccc03c, nsIContent * 0x04ce16dc, 
nsIContent * 0x04ce16dc, int 1) line 6759 + 28 bytes
nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext * 0x053d0610, 
nsIFrame * 0x040ab524) line 10555 + 47 bytes
nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x04ccab00, 
nsIPresContext * 0x053d0610, nsIContent * 0x04ce5a1c, nsIContent * 0x04ce567c, 
int 3, nsILayoutHistoryState * 0x04cdf080) line 6542 + 19 bytes
nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext * 0x053d0610, 
nsIContent * 0x04ce567c) line 8749 + 40 bytes
nsCSSFrameConstructor::ContentStatesChanged(nsCSSFrameConstructor * const 
0x04ccab00, nsIPresContext * 0x053d0610, nsIContent * 0x04ce567c, nsIContent * 
0x00000000) line 7706 + 16 bytes
StyleSetImpl::ContentStatesChanged(StyleSetImpl * const 0x04ccabb0, 
nsIPresContext * 0x053d0610, nsIContent * 0x04ce567c, nsIContent * 0x04ccc03c) 
line 1002
PresShell::ContentStatesChanged(PresShell * const 0x04cca878, nsIDocument * 
0x05331cc0, nsIContent * 0x04ce567c, nsIContent * 0x04ccc03c) line 2578 + 46 
bytes
nsDocument::ContentStatesChanged(nsDocument * const 0x05331cc0, nsIContent * 
0x04ce567c, nsIContent * 0x04ccc03c) line 1570
nsEventStateManager::SetContentState(nsEventStateManager * const 0x04cd9730, 
nsIContent * 0x04ce567c, int 4) line 2232
nsGenericHTMLElement::HandleDOMEventForAnchors(nsIPresContext * 0x053d0610, 
nsEvent * 0x0012f53c, nsIDOMEvent * * 0x0012f484, unsigned int 2, nsEventStatus 
* 0x0012f57c) line 869
nsHTMLAnchorElement::HandleDOMEvent(nsHTMLAnchorElement * const 0x04ce567c, 
nsIPresContext * 0x053d0610, nsEvent * 0x0012f53c, nsIDOMEvent * * 0x0012f484, 
unsigned int 2, nsEventStatus * 0x0012f57c) line 342
nsGenericDOMDataNode::HandleDOMEvent(nsIPresContext * 0x053d0610, nsEvent * 
0x0012f53c, nsIDOMEvent * * 0x0012f484, unsigned int 1, nsEventStatus * 
0x0012f57c) line 807 + 39 bytes
nsTextNode::HandleDOMEvent(nsTextNode * const 0x04ce53fc, nsIPresContext * 
0x053d0610, nsEvent * 0x0012f53c, nsIDOMEvent * * 0x00000000, unsigned int 1, 
nsEventStatus * 0x0012f57c) line 234
nsEventStateManager::GenerateMouseEnterExit(nsIPresContext * 0x053d0610, 
nsGUIEvent * 0x0012faf8) line 1372
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x04cd9730, 
nsIPresContext * 0x053d0610, nsGUIEvent * 0x0012faf8, nsIFrame * 0x02e2d4b0, 
nsEventStatus * 0x0012fa04, nsIView * 0x04cd8180) line 427
PresShell::HandleEvent(PresShell * const 0x04cca874, nsIView * 0x04cd8180, 
nsGUIEvent * 0x0012faf8, nsEventStatus * 0x0012fa04) line 3005 + 43 bytes
nsView::HandleEvent(nsView * const 0x04cd8180, nsGUIEvent * 0x0012faf8, unsigned 
int 8, nsEventStatus * 0x0012fa04, int & 0) line 799
nsView::HandleEvent(nsView * const 0x04cdf120, nsGUIEvent * 0x0012faf8, unsigned 
int 8, nsEventStatus * 0x0012fa04, int & 0) line 784
nsView::HandleEvent(nsView * const 0x04ccade0, nsGUIEvent * 0x0012faf8, unsigned 
int 28, nsEventStatus * 0x0012fa04, int & 0) line 784
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x04ccb070, nsGUIEvent * 
0x0012faf8, nsEventStatus * 0x0012fa04) line 1216
HandleEvent(nsGUIEvent * 0x0012faf8) line 69
nsWindow::DispatchEvent(nsWindow * const 0x04cd82d4, nsGUIEvent * 0x0012faf8, 
nsEventStatus & nsEventStatus_eIgnore) line 493 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012faf8) line 514
nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 2974 + 
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 
3192
nsWindow::ProcessMessage(unsigned int 512, unsigned int 0, long 6291485, long * 
0x0012fd94) line 2248 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00690726, unsigned int 512, unsigned int 0, long 
6291485) line 671 + 27 bytes
USER32! 77e71268()
0060001d()

Comment 17

[rickg]

Moving crufty m14-m15 bugs out to m16 for proper triage.

Comment 18

[Pierre Saslawsky]

The bug can no longer be reproduced at this page, however I'm marking it as dup 
of bug 32518 so that we keep a link between the two bugs and don't lose the stack 
trace from joki.


*** This bug has been marked as a duplicate of 32518 ***

Comment 19

[Katcha Da]

Verified duplicate.