222061 - Setting style.display on div with iframe to 'none' crashes browser

Status: RESOLVED DUPLICATE of bug 205492

(Core Graveyard :: GFX: Gtk, defect)

Description

[Dave O]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20031010 Galeon/1.3.9
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20031010 Galeon/1.3.9

In http://genericorp.net/~count/mozcrash.html (minimum case, derived from
espn.com) mozilla crashes immediately upon loading the page.  Crash will not
occur if all of the following are not met:

must have iframe
must have some displayed text
assign 'none' to style.display DOM element of div

Reproducible: Always

Steps to Reproduce:
1. load example page
2. watch mozilla crash
3. rinse, repeat

Actual Results:  
segfault

Expected Results:  
unsure

Comment 1

[Mats Palmgren (inactive)]

WFM, 2003-10-13-05 trunk Linux

Comment 2

[Nathan Poznick]

Crashes for me on
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031003 Firebird/0.7

Comment 3

[Jesiah S]

WFM LInux 2003102005 and LInux Firebird 20031022

Comment 4

[Boris Zbarsky [:bzbarsky]]

Dave, Nathan, could you please test a current build and check whether that
crashes for you too?

Comment 5

[Nathan Poznick]

I just tried with the 20031025 nightly, and it no longer crashes - however, I do
get the following printed to stderr when it loads the page:

Gtk-WARNING **: invalid cast from (NULL) pointer to `GtkObject'

Comment 6

[Boris Zbarsky [:bzbarsky]]

Chris, what's up with that warning?  I've seen that too, recently...

Comment 7

[Nathan Poznick]

I was a bit curious, so I built my own nightly using the same options that the
Debian mozilla packages use, and it *did* still crash.  Offhand my guess would
be it's triggered by something in either GTK2 or XFT (My Firebird build uses
both of those, and exhibits the crash as well).  I'm building again, sans
"--disable-debug --enable-strip-libs" to see if I can get any useful debugging
information from the crash.

./configure --prefix=/home/kraken/mozilla --enable-svg --without-system-mng
--without-system-png --disable-pedantic
--with-default-mozilla-five-home=/home/kraken/mozilla --disable-debug
--disable-tests --disable-short-wchar --enable-xprint --enable-strip-libs
--enable-crypto --enable-mathml --enable-oji --enable-extensions=all
--enable-ldap --with-system-zlib --enable-freetype2
--enable-default-toolkit=gtk2 --enable-toolkit=gtk2 --enable-xft

Comment 8

[Boris Zbarsky [:bzbarsky]]

.

Comment 9

[Nathan Poznick]

I recompiled for debugging, and ran
./mozilla -g http://genericorp.net/~count/mozcrash.html
When it crashed, I did a thread apply all bt full.  The complete output of the
session is at http://drunkmonkey.org/mozcrash.txt

Comment 10

[Christian :Biesinger (don't email me, ping me on IRC)]

I can reproduce the crash too.
This is the reason:
(gdb) print mDrawingarea
$1 = (MozDrawingarea *) 0x0

Comment 11

[Christopher Blizzard (:blizzard)]

Same as bug 222061?  I have a workaround patch in my moz rpms for Red Hat that
just print out an NS_WARNING and return failure.

Comment 12

[Christopher Blizzard (:blizzard)]

-> dup

*** This bug has been marked as a duplicate of 205492 ***