206156 - http://www.kissonline.com/bbs - Crash when clicking "General KISS Discussion"

Status: VERIFIED FIXED

(SeaMonkey :: General, defect, P2)

Description

[Markus Långström]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030515 Mozilla Firebird/0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030515 Mozilla Firebird/0.6

Firebird and Mozilla crashes when trying to visit the General KISS Discussion
forum on this page. This is probably a dupe but has been 100 % reproducible for
a long time.

Talkback ID: TB20204024H

Reproducible: Always

Steps to Reproduce:
1. Go to http://www.kissonline.com/bbs
2. Click "General KISS Discussion"


Actual Results:  
Crash

Comment 1

[Matthias Versen [:Matti]]

00000384()
nsContainerFrame::Destroy(nsContainerFrame * const 0x06420d68, nsIPresContext *
0x063f00b8) line 140
nsLineBox::DeleteLineList(nsIPresContext * 0x063f00b8, nsLineList & {...}) line
306 + 10 bytes
nsBlockFrame::Destroy(nsBlockFrame * const 0x063455b4, nsIPresContext *
0x063f00b8) line 423 + 10 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x063f00b8, nsLineList & {...}) line
306 + 10 bytes
nsBlockFrame::Destroy(nsBlockFrame * const 0x063458fc, nsIPresContext *
0x063f00b8) line 423 + 10 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x063f00b8, nsLineList & {...}) line
306 + 10 bytes
nsBlockFrame::Destroy(nsBlockFrame * const 0x063450ec, nsIPresContext *
0x063f00b8) line 423 + 10 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x063f00b8, nsLineList & {...}) line
306 + 10 bytes
nsBlockFrame::Destroy(nsBlockFrame * const 0x06344ee8, nsIPresContext *
0x063f00b8) line 423 + 10 bytes
nsFrameList::DestroyFrames(nsFrameList * const 0x047dd008, nsIPresContext *
0x063f00b8) line 130 + 13 bytes
nsContainerFrame::Destroy(nsContainerFrame * const 0x06343318, nsIPresContext *
0x063f00b8) line 143
CanvasFrame::Destroy(CanvasFrame * const 0x064828a8, nsIPresContext *
0x063f00b8) line 252 + 9 bytes
nsFrameList::DestroyFrames(nsFrameList * const 0x047dd008, nsIPresContext *
0x063f00b8) line 130 + 13 bytes
nsContainerFrame::Destroy(nsContainerFrame * const 0x064cf758, nsIPresContext *
0x063f00b8) line 143
nsBoxFrame::Destroy(nsBoxFrame * const 0x06482ca8, nsIPresContext * 0x063f00b8)
line 1103 + 9 bytes
nsFrameList::DestroyFrames(nsFrameList * const 0x047dd008, nsIPresContext *
0x063f00b8) line 130 + 13 bytes
nsContainerFrame::Destroy(nsContainerFrame * const 0x00000000, nsIPresContext *
0x063f00b8) line 143
nsBoxFrame::Destroy(nsBoxFrame * const 0x06482b94, nsIPresContext * 0x063f00b8)
line 1103 + 9 bytes
nsGfxScrollFrame::Destroy(nsGfxScrollFrame * const 0x06482b94, nsIPresContext *
0x063f00b8) line 459 + 10 bytes
nsFrameList::DestroyFrames(nsFrameList * const 0x047dd008, nsIPresContext *
0x063f00b8) line 130 + 13 bytes
nsContainerFrame::Destroy(nsContainerFrame * const 0x06440c00, nsIPresContext *
0x063f00b8) line 143
ViewportFrame::Destroy(ViewportFrame * const 0x064827a0, nsIPresContext *
0x063f00b8) line 67 + 10 bytes
FrameManager::Destroy(FrameManager * const 0x06416a88) line 517
PresShell::Destroy(PresShell * const 0x00000000) line 1843
DocumentViewerImpl::Destroy(DocumentViewerImpl * const 0x0637ac24) line 1135
DocumentViewerImpl::Show(DocumentViewerImpl * const 0x063fed08) line 1368
PresShell::UnsuppressAndInvalidate(PresShell * const 0x047dd008) line 4946
PresShell::UnsuppressPainting(PresShell * const 0x061eabf8) line 4991 + 7 bytes
PresShell::sPaintSuppressionCallback(nsITimer * 0x0488f5e0, void * 0x061eabf8)
line 2948
nsTimerImpl::Fire(nsTimerImpl * const 0x047dd008) line 382 + 7 bytes
PL_HandleEvent(PLEvent * 0x0614ca88) line 660
PL_ProcessPendingEvents(PLEventQueue * 0x1002bfa2) line 592 + 6 bytes
_md_EventReceiverProc(HWND__ * 0x00df43a0, unsigned int 4202193, unsigned int
14594248, long -2147483648) line 1396
nsAppShellService::Run(nsAppShellService * const 0x00deb0c8) line 479
main1(int 0, char * * 0x00243e00, nsISupports * 0x00000000) line 1268 + 9 bytes
main(int 3, char * * 0x00243e00) line 1647 + 22 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x001334ee,
HINSTANCE__ * 0x00400000) line 1671 + 23 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e9847c()


*** This bug has been marked as a duplicate of 156982 ***

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Reopening because I have a fix for this bug and I'm not sure it fixes the thing
it was duped to.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

There's a longstanding bug here about odd situations where an inline frame has a
view, it's found to contain a block, and for some reason the block (or following
inlines) don't get a view even though they should have the same style context.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

We need to reparent views for the children of the anonymous block and trailing
inline container even if those frames don't themselves have a view. In
particular the leading inline container can have a view, in which case children
with views will have that view as their parent and we break that relationship
when we reparent those child frames.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 123666 [details] [diff] [review]
fix

r+sr=dbaron, but how about adding an inline nsIFrame::HasView() that just
checks the NS_FRAME_HAS_VIEW bit so that we don't waste time actually getting
the view from the frame manager's property table?

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

That's actually in my nsIFrame fixup patch.

Comment 7

[Asa Dotzler [:asa]]

Comment on attachment 123666 [details] [diff] [review]
fix

a=asa (on behalf of drivers) for checkin to 1.4

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fix checked in.

Comment 9

[Henrik Skupin [:whimboo][⌚️UTC+1]]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040120
Firebird/0.8.0+

-> verified.