Closed Bug 19382 Opened 25 years ago Closed 25 years ago

[DOGFOOD]Some absolutely positioned form elements cause M11 to crash

Categories

(Core :: Layout, defect, P1)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: jay, Assigned: rods)

References

(
URL
)

Details

(Whiteboard: [PDT+] Still working on it) 

This page has 6 links to pages that have different absolutely positioned
elements. The only differences in the pages is the input type (except for the
select box.) The text box, radio button and check box work ok but the select
box, submit button and the simple button cause the crash.
OS: Windows 98 → All
Hardware: PC → All
Tested on Win 95 & Win 98 (build 1999111909), Mac8.5 (build 1999111908) and
Linux Red Hat 6.0 (Linux 2.2 - build 1999111909). Could not reproduce the
indicated crashes for 'Positioned Submit Button' or 'Positioned Button' links
but I did reproduce the crash clicking on the 'Positioned Select Box'
link across platform. Document has some HTML problems (no 'action' attribute for
form, closing </span> tag without opening tage) but so do the other files
Crash details:

MOZILLA caused an invalid page fault in
module GKHTML.DLL at 014f:601a5180.
Registers:
EAX=00000000 CS=014f EIP=601a5180 EFLGS=00010206
EBX=00000000 SS=0157 ESP=0063e854 EBP=0063e860
ECX=0063e940 DS=0157 ESI=0063e884 FS=a0cf
EDX=00000000 ES=0157 EDI=0063ebd8 GS=0000
Bytes at CS:EIP:
8b 08 ff 77 04 ff 37 50 ff 51 10 8b 46 0c 8d 56
Stack dump:
0063ec54 0063eb94 02432a30 0063ea6c 601a5be4 0063eb94 024d8b50 02432a30 0063ec54
02432a30 0063ec54 0063eb94 02432a30 024d8b50 0063eb94 00000000

Call Stack:    (Signature = nsBlockReflowState::nsBlockReflowState 495dd11d)

nsBlockReflowState::nsBlockReflowState
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 576]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1411]
nsAreaFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 294]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
nsScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollFrame.cpp, line 625]
nsListControlFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line
398]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
nsComboboxControlFrame::ReflowComboChildFrame
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsComboboxControlFrame.cpp,
line 433]
 nsComboboxControlFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsComboboxControlFrame.cpp,
line 758]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 293]
nsAbsoluteContainingBlock::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 151]
nsAreaFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 315]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
 RootFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 336]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
nsScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollFrame.cpp, line 625]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 528]
 nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line
145]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1650]
PresShell::ExitReflowLock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 709]
PresShell::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2100]
nsDocument::ContentAppended
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1516]
nsHTMLDocument::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line
1041]
HTMLContentSink::NotifyAppend
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp,
line 3515]
SinkContext::FlushTags
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp,
line 1747]
HTMLContentSink::WillInterrupt
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp,
line 2083]
CNavDTD::WillInterruptParse
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3227]
 nsParser::ResumeParse
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 985]
nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1308]
nsDocumentBindInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1290]
nsChannelListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1485]
nsHTTPResponseListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p, line 184]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line
417]
nsStreamListenerEvent::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line
174]
PL_HandleEvent [plevent.c, line 538]
PL_ProcessPendingEvents [plevent.c, line 499]
   _md_EventReceiverProc [plevent.c, line 976]
KERNEL32.DLL + 0x3663 (0xbff73663)
Call Stack:    (Signature = nsBlockReflowState::nsBlockReflowState 495dd11d)

nsBlockReflowState::nsBlockReflowState
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 576]
nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1411]
nsAreaFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 294]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
nsScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollFrame.cpp, line 625]
nsListControlFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsListControlFrame.cpp, line
398]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
nsComboboxControlFrame::ReflowComboChildFrame
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsComboboxControlFrame.cpp,
line 433]
 nsComboboxControlFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsComboboxControlFrame.cpp,
line 758]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 293]
nsAbsoluteContainingBlock::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 151]
nsAreaFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 315]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
 RootFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 336]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
nsScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollFrame.cpp, line 625]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
624]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 528]
 nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line
145]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1650]
PresShell::ExitReflowLock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 709]
PresShell::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2100]
nsDocument::ContentAppended
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1516]
nsHTMLDocument::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line
1041]
HTMLContentSink::NotifyAppend
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp,
line 3515]
SinkContext::FlushTags
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp,
line 1747]
HTMLContentSink::WillInterrupt
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp,
line 2083]
CNavDTD::WillInterruptParse
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3227]
 nsParser::ResumeParse
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 985]
nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1308]
nsDocumentBindInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1290]
nsChannelListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1485]
nsHTTPResponseListener::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p, line 184]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line
417]
nsStreamListenerEvent::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line
174]
PL_HandleEvent [plevent.c, line 538]
PL_ProcessPendingEvents [plevent.c, line 499]
   _md_EventReceiverProc [plevent.c, line 976]
KERNEL32.DLL + 0x3663 (0xbff73663)

Changing 'Platform' and 'OS' to 'All'.
Sorry about the extra </SPAN> tags and the lack of ACTION attributes. They're
all better now :) Don't know why the buttons crash on my Win98 box and not on
yours, chris. Thanks for looking at it.
Status: NEW → ASSIGNED
Priority: P3 → P1
Summary: Some absolutely positioned form elements cause M11 to crash → [DOGFOOD]Some absolutely positioned form elements cause M11 to crash
Target Milestone: M12
Probably a dup of 20042 but I'm keeping it open because the testcase is
interesting.
Assignee: pierre → troy
Status: ASSIGNED → NEW
Component: Style System → Layout
It's not a dup of bug 20042. As chrisd pointed out, it only crashes with the
"Positioned Select Box". The cause of the crash is the same on Mac and Windows:
nsBlockFrame::Reflow() creates a nsBlockReflowState with mSpaceManager set to
nil.

Reassigned to Troy. Feel free to change the priority, target milestone and
dogfood status that I copied earlier today from bug 20042.
Assignee: troy → rods
Rod, you nede to make sure that the NS_BLOCK_SPACE_MGR flag is specified when
the select is absolutely positioned. The way the block gets a space manager
Whiteboard: [PDT+]
Putting on PDT+ radar.
Status: NEW → ASSIGNED
Whiteboard: [PDT+] → [PDT+] Waiting to check in the fix.
Waiting to check in the fix.
QA Contact: chrisd → petersen
Whiteboard: [PDT+] Waiting to check in the fix. → [PDT+] Still working on it
I had it working but now I don't. It doesn't crash but it also doesn't show up.
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
added a a call to:
        nsHTMLContainerFrame::CreateViewForFrame(aPresContext, comboboxFrame,
                                                 aStyleContext, PR_FALSE);
to make sure we get a view when we are absolutely positioned.

fixed
QA Contact: petersen → chrisd
Chris, you made some comments earlier on this bug. Could you please check the
latest version ?
Blocks: 21564
Status: RESOLVED → VERIFIED
Using 12/10 build, verified fixed. No crashes, and problem described by rods on
12/3 is not longer apparent.
No longer blocks: 21564
You need to log in before you can comment on or make changes to this bug.