188050 - reproducable crash when I mouse over mailto: links on http://scottcollins.net

Status: RESOLVED DUPLICATE of bug 187890

(Core :: Layout, defect)

Description

[(not reading, please use [e-mail] instead)]

reproducable crash when I mouse over mailto: links on http://scottcollins.net

aFrame appears to point to a deleted frame (all the mFoos are 0xdddddddd)

here's the stack:

IsCanvasFrame(nsIFrame * 0x07823ec4) line 2473 + 33 bytes
nsCSSRendering::FindBackground(nsIPresContext * 0x085773d8, nsIFrame * 
0x07823ec4, const nsStyleBackground * * 0x0012eb70, int * 0x0012eb68) line 2612 
+ 9 bytes
ApplyRenderingChangeToTree(nsIPresContext * 0x085773d8, nsIFrame * 0x07823ec4, 
nsIViewManager * 0x00000000, nsChangeHint 94) line 10149 + 21 bytes
nsCSSFrameConstructor::ProcessRestyledFrames(nsCSSFrameConstructor * const 
0x07bccb38, nsStyleChangeList & {...}, nsIPresContext * 0x085773d8) line 10336 
+ 19 bytes
nsCSSFrameConstructor::ContentStatesChanged(nsCSSFrameConstructor * const 
0x07bccb38, nsIPresContext * 0x085773d8, nsIContent * 0x0856c928, nsIContent * 
0x00000000, int 4) line 10506
StyleSetImpl::ContentStatesChanged(StyleSetImpl * const 0x07bcca28, 
nsIPresContext * 0x085773d8, nsIContent * 0x0856c928, nsIContent * 0x00000000, 
int 4) line 1633
PresShell::ContentStatesChanged(PresShell * const 0x079d0558, nsIDocument * 
0x08a1ae10, nsIContent * 0x0856c928, nsIContent * 0x00000000, int 4) line 5115 
+ 53 bytes
nsDocument::ContentStatesChanged(nsDocument * const 0x08a1ae10, nsIContent * 
0x0856c928, nsIContent * 0x00000000, int 4) line 2040
nsEventStateManager::SetContentState(nsEventStateManager * const 0x07ba2c40, 
nsIContent * 0x083fc500, int 4) line 3977
nsEventStateManager::GenerateMouseEnterExit(nsIPresContext * 0x085773d8, 
nsGUIEvent * 0x0012f7b4) line 2573
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x07ba2c40, 
nsIPresContext * 0x085773d8, nsEvent * 0x0012f7b4, nsIFrame * 0x07751b14, 
nsEventStatus * 0x0012f5ac, nsIView * 0x085b6f60) line 379
PresShell::HandleEventInternal(nsEvent * 0x0012f7b4, nsIView * 0x085b6f60, 
unsigned int 1, nsEventStatus * 0x0012f5ac) line 6063 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x079d0554, nsIView * 0x085b6f60, 
nsGUIEvent * 0x0012f7b4, nsEventStatus * 0x0012f5ac, int 0, int & 1) line 5992 
+ 25 bytes
nsViewManager::HandleEvent(nsView * 0x085b6cd0, nsGUIEvent * 0x0012f7b4, int 0) 
line 2209
nsView::HandleEvent(nsViewManager * 0x08577650, nsGUIEvent * 0x0012f7b4, int 0) 
line 304
nsViewManager::DispatchEvent(nsViewManager * const 0x08577650, nsGUIEvent * 
0x0012f7b4, nsEventStatus * 0x0012f6b0) line 1943 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f7b4) line 83
nsWindow::DispatchEvent(nsWindow * const 0x085b6d8c, nsGUIEvent * 0x0012f7b4, 
nsEventStatus & nsEventStatus_eIgnore) line 1116 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7b4) line 1137
nsWindow::DispatchMouseEvent(unsigned int 300, unsigned int 0, nsPoint * 
0x00000000) line 5376 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 300, unsigned int 0, nsPoint * 
0x00000000) line 5633
nsWindow::ProcessMessage(unsigned int 512, unsigned int 0, long 23986288, long 
* 0x0012fc48) line 4068 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x004f02c4, unsigned int 512, unsigned int 0, 
long 23986288) line 1403 + 27 bytes
USER32! 77e3a290()
USER32! 77e145b1()
USER32! 77e1a752()
nsAppShellService::Run(nsAppShellService * const 0x01af8540) line 472
main1(int 2, char * * 0x00284f90, nsISupports * 0x00276eb8) line 1543 + 32 bytes
main(int 2, char * * 0x00284f90) line 1904 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e9ca90()

Comment 1

[(not reading, please use [e-mail] instead)]

adding dbaron and bz, who might have some guesses where to start.

Comment 2

[Olivier Cahagne]

*** This bug has been marked as a duplicate of 187890 ***