17664 - [CRASH] [DOGFOOD] [JUMP DEMO]setting text color and position offset of A link element causes crash

Status: VERIFIED FIXED

(Core :: DOM: CSS Object Model, defect, P1)

Description

[ekrock's old account (dead)]

On WinNT 4.0 SP3 in AppRunner 1999102508.

To repro:
1) Open above URL.
2) Click the "Salerno" link (in the first table cell) several times in rapid
succession.  This usually causes the crash.

Note that the presence of this bug is a serious problem for marketing as it
causes the browser to crash (frequently!) during our standard demo of Nav5.

Add'l info:
1) Can't reproduce this 100% of the time but it happens *quite frequently* on
this page, so if you don't see the bug, try restarting the browser and trying
again.

2) I reproduced the crash today (11/01) so if you look at my Talkback filings
for today you should find the Talkback report for this crash.

3) The crash is occurring when you click one of the links in this line:

<P>Our package includes round-trip airfare from New York via Rome Fiumicino.
Accomodation is at the <A HREF="foo.html">Savoy Four Seasons</A>, Napoli. You
may also choose one of several tour packages to <A HREF="foo.html">Salerno</A>,
<A HREF="foo.html">Sorrento</A> and the <A HREF="foo.html">Amalfi Coast</A>.</P>

All of the A elements in this document have been given method handlers by this
function, called on page open:

function init() {
  var links = document.getElementsByTagName("A");
  for (var i=0; i<links.length; i++) {
    links.item(i).onmouseover=hlt;
    links.item(i).onmouseout=dlt;
    links.item(i).onmousedown=depress;
    links.item(i).onmouseup=undepress;
    links[i].onclick=donothing;
  }
}

Here are the method handlers:

function hlt(event) {
  this.style.backgroundColor="rgb(255, 255, 204)";
  this.style.textDecoration="underline";
}

function dlt(event) {
  this.style.backgroundColor="transparent";
  this.style.textDecoration="none";
}

function depress() {
  this.style.position="relative";
  this.style.left="3px;"
  this.style.top="3px;"
  this.style.color="#660000";
}

function undepress() {
  this.style.position="relative";
  this.style.left="0px;"
  this.style.top="0px;"
  this.style.color="#000099";
}

4) Yes, I know we need a simplified test case!  I'll try to create this ASAP.

Comment 1

[ekrock's old account (dead)]

Marking P1, critical, M12. Proposing [DOGFOOD] as marketing can't safely use
this part of our standard demo (Jump Travel) until this is fixed.

Comment 2

[leger]

Putting on PDT+ radar.

Comment 3

[kevinyen]

Changing the Summary notation to [JUMP] from [DEMO] to differentiate.  [DEMO]
bugs are specific to the Press & Analyst demo we're doing in November.

[JUMP] is also important, but as far as I know, is not as important as the Press
& Analyst.  It's for the Jump travel standards demo that we have given many
times in teh past.

thx,
kevin

Comment 4

[vidur (gone)]

The best that I could get is a crash with the following stack trace when I try
to drag one of the links (something that happened inadvertantly when I clicked
on one repeatedly). The crash is on line 339 with a null mGestureDownFrame.
Presumably the frame has been destroyed (as a result of the style change on the
mouse down). Reassigning to pinkerton.

nsEventStateManager::GenerateDragGesture(nsIPresContext & {...}, nsGUIEvent *
0x0012fbe0) line 339 + 36 bytes
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x022bd270,
nsIPresContext & {...}, nsGUIEvent * 0x0012fbe0, nsIFrame * 0x025995f0,
nsEventStatus & nsEventStatus_eIgnore, nsIView * 0x0259c260) line 166
PresShell::HandleEvent(PresShell * const 0x029c4234, nsIView * 0x0259c260,
nsGUIEvent * 0x0012fbe0, nsEventStatus & nsEventStatus_eIgnore) line 2223 + 43
bytes
nsView::HandleEvent(nsView * const 0x0259c260, nsGUIEvent * 0x0012fbe0, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834
nsView::HandleEvent(nsView * const 0x021c9f10, nsGUIEvent * 0x0012fbe0, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x01e69d50, nsGUIEvent * 0x0012fbe0, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x01e69de0, nsGUIEvent * 0x0012fbe0, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x029c2df0, nsGUIEvent * 0x0012fbe0, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsViewManager::DispatchEvent(nsViewManager * const 0x029c0c20, nsGUIEvent *
0x0012fbe0, nsEventStatus & nsEventStatus_eIgnore) line 1739
HandleEvent(nsGUIEvent * 0x0012fbe0) line 63
nsWindow::DispatchEvent(nsWindow * const 0x01e69c14, nsGUIEvent * 0x0012fbe0,
nsEventStatus & nsEventStatus_eIgnore) line 403 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbe0) line 424
nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3420 +
21 bytes

Comment 5

[Mike Pinkerton (not reading bugmail)]

fixed, null check added.

Comment 6

[leger]

Marking Fixed.  Pinkerton, please reopen if still a problem.