Closed Bug 206839 Opened 21 years ago Closed 21 years ago

crash when opening second popup to reply to a post. @nsCSSFrameConstructor::FindFrameWithContent

Categories

(Core :: Layout, defect)

x86
All
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 203041

People

(Reporter: a7244270, Unassigned)

References

()

Details

(Keywords: crash, regression, testcase)

Attachments

(4 files, 1 obsolete file)

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030507

On this forum, above each post on the right, there is a graphic that looks like 
a pair of quotation marks.  

Clicking this graphic will open a new popup window, into which a user can post 
a reply.

If the qouote graphic is clicked a second time, while the first popup is still 
open, mozilla accvios and dies.

Reproducible: Always

Steps to Reproduce:
1. click on the link provided
2. click on the quote graphic above any message
3. click on the quote graphic above any message _without closing the popup 
created in step two_
Actual Results:  
accvio, death.

Expected Results:  
not died.

IE replaces the old popup with a new one.
Alfonso: Can you still reproduce this problem in a recent build? It does not
happen to me using the 20030912 nightly on Win 2000. Perhaps it has been fixed,
or the site changed its code so the problem no longer occurs.
I got this crash in a 09/17 Firebird nightly by clicking "reply" twice at
http://arstechnica.infopop.net/OpenTopic/page?a=tpc&s=50009562&f=174096756&m=5860909585&r=5100960685#5100960685.

The top line in the stack trace is

>	gklayout.dll!nsCSSFrameConstructor::FindFrameWithContent(nsIPresContext *
aPresContext=0x044c2450, nsIFrameManager * aFrameManager=0x044c3c28, nsIFrame *
aParentFrame=0x04633650, nsIContent * aParentContent=0x04580190, nsIContent *
aContent=0x04580238, nsFindFrameHint * aHint=0x00000000)  Line 11270 + 0x11	C++
Keywords: crash
Summary: crash when opening second popup to reply to a post. → crash when opening second popup to reply to a post. @nsCSSFrameConstructor::FindFrameWithContent
Attached file Stacktrace
Status: UNCONFIRMED → NEW
Ever confirmed: true
Let's try Layout: Misc Code.
Assignee: general → misc
Component: Browser-General → Layout: Misc Code
QA Contact: general → nobody
It occurs in Mozilla 1.5RC1 (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.5) Gecko/20030916) on a Windows XP Pro machine.
Ok, I now see this too using the URL Jessee provided. Talkback ID for this
incident was TB23726099X. 20030917 trunk nightly, Win 2000.
Whiteboard: TB23726099X
A minimal testcase would be great.
Keywords: qawanted
Attached file Part 1 of testcase (obsolete) —
This is part 1 of a minimal testcase. At least on my machine, it crashes
Firebird every time I click the link twice without closing the popup between
clicks. Part 2, the source of the popup window, will follow.
Replacing qawanted keyword with testcase. Also, I have reproduced this on WinXP
too, don't know about any other operating systems
Keywords: qawantedtestcase
Attachment #131855 - Attachment description: Part 2 of testcase → popup window for testcase
Attached file testcase
attachment 131854 [details] with URL changed to point to attachment 131855 [details] (and some
slight reformatting)
Attachment #131854 - Attachment is obsolete: true
regression between linux trunk 2002121908 and 2002122008
Keywords: regression
OS: Windows 2000 → All
Whiteboard: TB23726099X
This looks like a regression from bug 152844, caused by a race when tearing down
the file control frame.

And this is a duplicate of an existing bug with a patch (I think jkeiser and
mats are working on that one....)
Whiteboard: DUPEME
Well, I'm not really working on that bug...

I have verified that the URL and testcase is fixed by applying the patch
in bug 203041 (to a current CVS tree)

*** This bug has been marked as a duplicate of 203041 ***
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → DUPLICATE
Whiteboard: DUPEME
Product: Core → Core Graveyard
Component: Layout: Misc Code → Layout
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: