206839 - crash when opening second popup to reply to a post. @nsCSSFrameConstructor::FindFrameWithContent

Status: RESOLVED DUPLICATE of bug 203041

(Core :: Layout, defect)

Description

[Alfonso Urdaneta]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030507

On this forum, above each post on the right, there is a graphic that looks like 
a pair of quotation marks.  

Clicking this graphic will open a new popup window, into which a user can post 
a reply.

If the qouote graphic is clicked a second time, while the first popup is still 
open, mozilla accvios and dies.

Reproducible: Always

Steps to Reproduce:
1. click on the link provided
2. click on the quote graphic above any message
3. click on the quote graphic above any message _without closing the popup 
created in step two_
Actual Results:  
accvio, death.

Expected Results:  
not died.

IE replaces the old popup with a new one.

Comment 1

[Jon Henry]

Alfonso: Can you still reproduce this problem in a recent build? It does not
happen to me using the 20030912 nightly on Win 2000. Perhaps it has been fixed,
or the site changed its code so the problem no longer occurs.

Comment 2

[Jesse Ruderman]

I got this crash in a 09/17 Firebird nightly by clicking "reply" twice at
http://arstechnica.infopop.net/OpenTopic/page?a=tpc&s=50009562&f=174096756&m=5860909585&r=5100960685#5100960685.

The top line in the stack trace is

>	gklayout.dll!nsCSSFrameConstructor::FindFrameWithContent(nsIPresContext *
aPresContext=0x044c2450, nsIFrameManager * aFrameManager=0x044c3c28, nsIFrame *
aParentFrame=0x04633650, nsIContent * aParentContent=0x04580190, nsIContent *
aContent=0x04580238, nsFindFrameHint * aHint=0x00000000)  Line 11270 + 0x11	C++

Comment 3

[Jesse Ruderman]

Attachment: Stacktrace

Comment 4

[Jesse Ruderman]

Let's try Layout: Misc Code.

Comment 5

[Joergen Ramskov]

It occurs in Mozilla 1.5RC1 (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.5) Gecko/20030916) on a Windows XP Pro machine.

Comment 6

[Jon Henry]

Ok, I now see this too using the URL Jessee provided. Talkback ID for this
incident was TB23726099X. 20030917 trunk nightly, Win 2000.

Comment 7

[David Baron :dbaron:]

Attachment: stack from talkback

Comment 8

[Boris Zbarsky [:bzbarsky]]

A minimal testcase would be great.

Comment 9

[Jon Henry]

Attachment: Part 1 of testcase

This is part 1 of a minimal testcase. At least on my machine, it crashes
Firebird every time I click the link twice without closing the popup between
clicks. Part 2, the source of the popup window, will follow.

Comment 10

[Jon Henry]

Attachment: popup window for testcase

Comment 11

[Jon Henry]

Replacing qawanted keyword with testcase. Also, I have reproduced this on WinXP
too, don't know about any other operating systems

Comment 12

[David Baron :dbaron:]

Attachment: testcase

attachment 131854 [details] with URL changed to point to attachment 131855 [details] (and some
slight reformatting)

Comment 13

[Andrew Schultz]

regression between linux trunk 2002121908 and 2002122008

Comment 14

[Boris Zbarsky [:bzbarsky]]

This looks like a regression from bug 152844, caused by a race when tearing down
the file control frame.

And this is a duplicate of an existing bug with a patch (I think jkeiser and
mats are working on that one....)

Comment 15

[Mats Palmgren (inactive)]

Well, I'm not really working on that bug...

I have verified that the URL and testcase is fixed by applying the patch
in bug 203041 (to a current CVS tree)

*** This bug has been marked as a duplicate of 203041 ***