207604 - Running this script which adds rows to a sometimes invisible table crashes

Status: RESOLVED DUPLICATE of bug 118685

(Core :: Layout, defect)

Description

[Chris Carlin]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030507
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030507

When I view the attached webpage as is, Mozilla will crash when the second radio
button is selected (sometimes it takes a second). On the other hand, if I
comment out the parts that set visible to false eveything works as expected.

The JavaScript console never shows errors, though perhaps it would if it didn't
crash.

I've had this same crashing under this copy of Mozilla as well as a copy of the
5-27 Firebird nightly on a different computer.

Reproducible: Always

Steps to Reproduce:
1. View the page
2. Click on the "Enter records manually" radio button
3. Perhaps click the "add row" button (that will appear after clicking the radio
button), but I don't think this is actually necessary

Actual Results:  
After a couple of seconds Mozilla crashes.

Expected Results:  
A row or five is added to the table that is unhidden after clicking the radio
button (page works properly under IE, look there to see expected results).

A bunch of talkbacks have been reported on this as I've been trying to figure a
way around the crash. Check for reports from [e-mail].

Comment 1

[Matthias Versen [:Matti]]

you forgot the attachment ?

Comment 2

[Chris Carlin]

Attachment: The case

My mistake.

Comment 3

[tenthumbs]

Crashes on my two hour old Linux trunk build.

Comment 4

[tenthumbs]

Attachment: stacktrace

Comment 5

[Matthias Versen [:Matti]]

-> Layout (wfm in my 1 day old win2k build)

Comment 6

[Chris Carlin]

Continues to crash for me under the following build:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030529 Mozilla
Firebird/0.6

Comment 7

[tenthumbs]

I crash executing this line:

1268          ev = new CantRenderReplacedElementEvent(this, aFrame, 
mPresShell);

(gdb) p *aFrame
$13 = {<nsISupports> = {_vptr.nsISupports = 0x809d60a},
       mRect = {x = 300,y = 1368, width = 2888, height = 72},
       mContent = 0x98, mStyleContext = 0x79700844, mParent = 0x0,
       mNextSibling = 0x0, mState = 0}

mStyleContext is certainly bogus.

Comment 8

[Mats Palmgren (inactive)]

When I run the testcase in this bug it crashes with the same stack as in
bug 118685 (see attachment 125193 [details] for crash data on that bug).
They look to be the same kind of problem to me.

Comment 9

[Mats Palmgren (inactive)]

This was fixed by "Patch2 rev. 2" on bug 118685

*** This bug has been marked as a duplicate of 118685 ***