Closed Bug 206839 Opened 22 years ago Closed 21 years ago

crash when opening second popup to reply to a post. @nsCSSFrameConstructor::FindFrameWithContent

Categories

(Core :: Layout, defect)

x86
All
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 203041

People

(Reporter: a7244270, Unassigned)

References

()

Details

(Keywords: crash, regression, testcase)

Attachments

(4 files, 1 obsolete file)

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030507 On this forum, above each post on the right, there is a graphic that looks like a pair of quotation marks. Clicking this graphic will open a new popup window, into which a user can post a reply. If the qouote graphic is clicked a second time, while the first popup is still open, mozilla accvios and dies. Reproducible: Always Steps to Reproduce: 1. click on the link provided 2. click on the quote graphic above any message 3. click on the quote graphic above any message _without closing the popup created in step two_ Actual Results: accvio, death. Expected Results: not died. IE replaces the old popup with a new one.
Alfonso: Can you still reproduce this problem in a recent build? It does not happen to me using the 20030912 nightly on Win 2000. Perhaps it has been fixed, or the site changed its code so the problem no longer occurs.
I got this crash in a 09/17 Firebird nightly by clicking "reply" twice at http://arstechnica.infopop.net/OpenTopic/page?a=tpc&s=50009562&f=174096756&m=5860909585&r=5100960685#5100960685. The top line in the stack trace is > gklayout.dll!nsCSSFrameConstructor::FindFrameWithContent(nsIPresContext * aPresContext=0x044c2450, nsIFrameManager * aFrameManager=0x044c3c28, nsIFrame * aParentFrame=0x04633650, nsIContent * aParentContent=0x04580190, nsIContent * aContent=0x04580238, nsFindFrameHint * aHint=0x00000000) Line 11270 + 0x11 C++
Keywords: crash
Summary: crash when opening second popup to reply to a post. → crash when opening second popup to reply to a post. @nsCSSFrameConstructor::FindFrameWithContent
Attached file Stacktrace
Status: UNCONFIRMED → NEW
Ever confirmed: true
Let's try Layout: Misc Code.
Assignee: general → misc
Component: Browser-General → Layout: Misc Code
QA Contact: general → nobody
It occurs in Mozilla 1.5RC1 (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20030916) on a Windows XP Pro machine.
Ok, I now see this too using the URL Jessee provided. Talkback ID for this incident was TB23726099X. 20030917 trunk nightly, Win 2000.
Whiteboard: TB23726099X
A minimal testcase would be great.
Keywords: qawanted
Attached file Part 1 of testcase (obsolete) —
This is part 1 of a minimal testcase. At least on my machine, it crashes Firebird every time I click the link twice without closing the popup between clicks. Part 2, the source of the popup window, will follow.
Replacing qawanted keyword with testcase. Also, I have reproduced this on WinXP too, don't know about any other operating systems
Keywords: qawantedtestcase
Attachment #131855 - Attachment description: Part 2 of testcase → popup window for testcase
Attached file testcase
attachment 131854 [details] with URL changed to point to attachment 131855 [details] (and some slight reformatting)
Attachment #131854 - Attachment is obsolete: true
regression between linux trunk 2002121908 and 2002122008
Keywords: regression
OS: Windows 2000 → All
Whiteboard: TB23726099X
This looks like a regression from bug 152844, caused by a race when tearing down the file control frame. And this is a duplicate of an existing bug with a patch (I think jkeiser and mats are working on that one....)
Whiteboard: DUPEME
Well, I'm not really working on that bug... I have verified that the URL and testcase is fixed by applying the patch in bug 203041 (to a current CVS tree) *** This bug has been marked as a duplicate of 203041 ***
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → DUPLICATE
Whiteboard: DUPEME
Product: Core → Core Graveyard
Component: Layout: Misc Code → Layout
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: