189303 - javascript crashes mozilla on this page

Status: VERIFIED DUPLICATE of bug 161304

(SeaMonkey :: General, defect)

Description

[Pascal Chevrel (relman team) -> :pascalc]

Build 2003011412 winXP

go to http://stephkup.nexenservices.com/accessibilite/index.php

Mozilla crashes, disabling javascript prevents the crash.

Javascript : http://stephkup.nexenservices.com/accessibilite/styleswitcher.js

Phoenix 0.5 crashes too but not NS7.01

Comment 1

[Ruslan Ismailov]

Confirm crash with Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.3a)
Gecko/20021212 on Win98 and with 1.3b under Linux.

Comment 2

[Ruslan Ismailov]

Attachment: switching disabled style with html overflow:auto crash Mozilla

Crash on line:

document.getElementsByTagName("style")[0].disabled = true;

This style have only one declaration, html overlow: auto.

Comment 3

[Matthias Versen [:Matti]]

StyleSetImpl::ResolveStyleFor(nsIPresContext * 0x042ac5f8, nsIContent *
0x042f7590, nsIStyleContext * 0x04305418) line 1165 + 11 bytes
nsPresContext::ResolveStyleContextFor(nsPresContext * const 0x042ac5f8,
nsIContent * 0x042f7590, nsIStyleContext * 0x04305418, nsIStyleContext * *
0x0012d160) line 949 + 37 bytes
FrameManager::ReResolveStyleContext(nsIPresContext * 0x042ac5f8, nsIFrame *
0x043058c0, nsIContent * 0x0402c788, int -1, nsIAtom * 0x00000000,
nsStyleChangeList & {...}, nsChangeHint nsChangeHint_None, nsChangeHint &
nsChangeHint_None) line 1882
FrameManager::ReResolveStyleContext(nsIPresContext * 0x042ac5f8, nsIFrame *
0x0430555c, nsIContent * 0x00000000, int -1, nsIAtom * 0x00000000,
nsStyleChangeList & {...}, nsChangeHint nsChangeHint_None, nsChangeHint &
nsChangeHint_None) line 2026
FrameManager::ReResolveStyleContext(nsIPresContext * 0x042ac5f8, nsIFrame *
0x04305180, nsIContent * 0x00000000, int -1, nsIAtom * 0x00000000,
nsStyleChangeList & {...}, nsChangeHint nsChangeHint_None, nsChangeHint &
nsChangeHint_None) line 2026
FrameManager::ComputeStyleChangeFor(FrameManager * const 0x0431aec8,
nsIPresContext * 0x042ac5f8, nsIFrame * 0x04305180, int -1, nsIAtom *
0x00000000, nsStyleChangeList & {...}, nsChangeHint nsChangeHint_None,
nsChangeHint & nsChangeHint_None) line 2075
PresShell::ReconstructStyleData(PresShell * const 0x04334ce8, int 0) line 5395
PresShell::StyleSheetApplicableStateChanged(PresShell * const 0x04334cf0,
nsIDocument * 0x02f74b08, nsIStyleSheet * 0x0433ccb0, int 0) line 5466
nsDocument::SetStyleSheetApplicableState(nsIStyleSheet * 0x0433ccb0, int 0) line
1686
CSSStyleSheetImpl::SetDisabled(CSSStyleSheetImpl * const 0x0433ccb4, int 1) line
2688
nsHTMLStyleElement::SetDisabled(nsHTMLStyleElement * const 0x0433ca5c, int 1)
line 291 + 27 bytes
XPTC_InvokeByIndex(nsISupports * 0x0433ca5c, unsigned int 55, unsigned int 1,
nsXPTCVariant * 0x0012d68c) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_SETTER) line 2023 + 42 bytes
XPCWrappedNative::SetAttribute(XPCCallContext & {...}) line 1883 + 14 bytes
XPC_WN_GetterSetter(JSContext * 0x0432b308, JSObject * 0x03e54a28, unsigned int
1, long * 0x043540e8, long * 0x0012d950) line 1316 + 12 bytes
js_Invoke(JSContext * 0x0432b308, unsigned int 1, unsigned int 2) line 839 + 23
bytes
js_InternalInvoke(JSContext * 0x0432b308, JSObject * 0x03e54a28, long 65358432,
unsigned int 0, unsigned int 1, long * 0x0012e274, long * 0x0012e274) line 931 +
20 bytes
js_SetProperty(JSContext * 0x0432b308, JSObject * 0x03e54a28, long 22549672,
long * 0x0012e274) line 2636 + 47 bytes
js_Interpret(JSContext * 0x0432b308, long * 0x0012e3f4) line 2645 + 1752 bytes
js_Invoke(JSContext * 0x0432b308, unsigned int 1, unsigned int 2) line 856 + 13
bytes
js_InternalInvoke(JSContext * 0x0432b308, JSObject * 0x03cd66a0, long 65357184,
unsigned int 0, unsigned int 1, long * 0x0012e654, long * 0x0012e524) line 931 +
20 bytes
JS_CallFunctionValue(JSContext * 0x0432b308, JSObject * 0x03cd66a0, long
65357184, unsigned int 1, long * 0x0012e654, long * 0x0012e524) line 3431 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x03ea0268, void * 0x03cd66a0,
void * 0x03e54580, unsigned int 1, void * 0x0012e654, int * 0x0012e658, int 0)
line 1040 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x0431bdb0, nsIDOMEvent
* 0x0431d758) line 181 + 77 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0431bf88,
nsIDOMEvent * 0x0431d758, nsIDOMEventTarget * 0x03ce2d80, unsigned int 1,
unsigned int 7) line 1216 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x0431bd48,
nsIPresContext * 0x042ac5f8, nsEvent * 0x0012ed9c, nsIDOMEvent * * 0x0012ed58,
nsIDOMEventTarget * 0x03ce2d80, unsigned int 7, nsEventStatus * 0x0012edc4) line
1898 + 36 bytes
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x03ce2d70,
nsIPresContext * 0x042ac5f8, nsEvent * 0x0012ed9c, nsIDOMEvent * * 0x0012ed58,
unsigned int 7, nsEventStatus * 0x0012edc4) line 805
DocumentViewerImpl::LoadComplete(DocumentViewerImpl * const 0x02f75968, unsigned
int 0) line 938 + 47 bytes
nsDocShell::EndPageLoad(nsIWebProgress * 0x040ff904, nsIChannel * 0x043098d8,
unsigned int 0) line 4241
nsWebShell::EndPageLoad(nsIWebProgress * 0x040ff904, nsIChannel * 0x043098d8,
unsigned int 0) line 774
nsDocShell::OnStateChange(nsDocShell * const 0x040cf65c, nsIWebProgress *
0x040ff904, nsIRequest * 0x043098d8, unsigned int 131088, unsigned int 0) line 4173
nsDocLoaderImpl::FireOnStateChange(nsIWebProgress * 0x040ff904, nsIRequest *
0x043098d8, int 131088, unsigned int 0) line 1230
nsDocLoaderImpl::doStopDocumentLoad(nsIRequest * 0x043098d8, unsigned int 0)
line 867
nsDocLoaderImpl::DocLoaderIsEmpty() line 765
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x040ff8f4, nsIRequest *
0x042c9990, nsISupports * 0x00000000, unsigned int 0) line 695
nsLoadGroup::RemoveRequest(nsLoadGroup * const 0x040f7c40, nsIRequest *
0x042c9990, nsISupports * 0x00000000, unsigned int 0) line 694 + 35 bytes
PresShell::RemoveDummyLayoutRequest() line 6682 + 42 bytes
PresShell::DoneRemovingReflowCommands() line 6639
PresShell::ProcessReflowCommands(int 1) line 6498
ReflowEvent::HandleEvent() line 6286
HandlePLEvent(ReflowEvent * 0x03f27bb0) line 6300
PL_HandleEvent(PLEvent * 0x03f27bb0) line 663 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00ec6750) line 593 + 9 bytes
nsEventQueueImpl::ProcessPendingEvents(nsEventQueueImpl * const 0x0027c798) line
387 + 12 bytes
nsWindow::DispatchPendingEvents() line 3729
nsWindow::ProcessMessage(unsigned int 512, unsigned int 0, long 3605015, long *
0x0012fc48) line 4072
nsWindow::WindowProc(HWND__ * 0x000302fa, unsigned int 512, unsigned int 0, long
3605015) line 1402 + 27 bytes
USER32! 77e2a290()
USER32! 77e045b1()
USER32! 77e0a752()
nsAppShellService::Run(nsAppShellService * const 0x00f95c48) line 471
main1(int 2, char * * 0x00276ac8, nsISupports * 0x00276b40) line 1543 + 32 bytes
main(int 2, char * * 0x00276ac8) line 1904 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e8ca90()


*** This bug has been marked as a duplicate of 161304 ***

Comment 4

[Owen Marshall (Not reading bugmail)]

Hah, I am the reporter of that bug and I didn't catch this. Don't I feel stupid =P

Stack traces seem to be the same. Verified.