224659 - crash if popup contains textbox or iframe elements [@ nsView::GetDimensions]

Status: RESOLVED DUPLICATE of bug 107518

(Core :: XUL, defect)

Description

[alexander :surkov (:asurkov)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5) Gecko/20031007

Any popups described popup elements cannot contain such elemenets as textbox or
iframe. Otherwise, mozilla will be crasehd.

Reproducible: Always

Steps to Reproduce:
1. Create document with next contents

<textbox id="txt" context="clipmenu"/>
<popupset>
  <popup id="clipmenu">
    <textbox/>
  </popup>
</popupset>
Actual Results:  
Mozilla will be crashed

Expected Results:  
Popup with textbox or iframe should be showed

Comment 1

[Boris Zbarsky [:bzbarsky]]

Please attach such a document to this bug using
http://bugzilla.mozilla.org/attachment.cgi?bugid=224659&action=enter ?

Comment 2

[alexander :surkov (:asurkov)]

Attachment: test case

Comment 3

[alexander :surkov (:asurkov)]

Comment on attachment 134749 [details]
test case

><a0:window xmlns:a0="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="remote_example" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" title="Simple Remote Example"><a0:textbox id="txt" context="clipmenu"/><a0:popupset><a0:popup id="clipmenu"><a0:textbox/></a0:popup></a0:popupset></a0:window>

Comment 4

[alexander :surkov (:asurkov)]

Comment on attachment 134749 [details]
test case

><a0:window xmlns:a0="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="remote_example" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" title="Simple Remote Example"><a0:textbox id="txt" context="clipmenu"/><a0:popupset><a0:popup id="clipmenu"><a0:textbox/></a0:popup></a0:popupset></a0:window>

Comment 5

[alexander :surkov (:asurkov)]

Comment on attachment 134749 [details]
test case

When you click mouse right button on textbox then Mozilla will be crached.

Comment 6

[Boris Zbarsky [:bzbarsky]]

The problem is that we have a view with no parent here... The crash stack is:

#0  0x417738b7 in nsViewManager::UpdateView(nsIView*, nsRect const&, unsigned) (
    this=0x4300dde0, aView=0x0, aRect=@0xbfffd1c0, aUpdateFlags=4)
    at /home/bzbarsky/mozilla/debug/mozilla/view/src/nsViewManager.cpp:1738
#1  0x41775a48 in nsViewManager::MoveViewTo(nsIView*, int, int) (this=0x4300dde0, 
    aView=0x42d42388, aX=2870, aY=294)
    at /home/bzbarsky/mozilla/debug/mozilla/view/src/nsViewManager.cpp:2579
#2  0x412acd01 in nsContainerFrame::PositionFrameView(nsIPresContext*, nsIFrame*) (
    aPresContext=0x4300d890, aKidFrame=0x43063018)
    at
/home/bzbarsky/mozilla/debug/mozilla/layout/html/base/src/nsContainerFrame.cpp:494
#3  0x412adec3 in nsContainerFrame::PositionChildViews(nsIPresContext*, nsIFrame*) (
    aPresContext=0x4300d890, aFrame=0x43062f78)

(gdb) frame 2
#2  0x412acd01 in nsContainerFrame::PositionFrameView(nsIPresContext*, nsIFrame*) (
    aPresContext=0x4300d890, aKidFrame=0x43063018)
    at
/home/bzbarsky/mozilla/debug/mozilla/layout/html/base/src/nsContainerFrame.cpp:494
494         vm->MoveViewTo(view, origin.x, origin.y);
(gdb) p aKidFrame
$3 = (nsIFrame *) 0x43063018
(gdb) p aKidFrame->HasView()
$4 = 8192
(gdb) p aKidFrame->GetView()
$5 = (class nsIView *) 0x42d42388
(gdb) p aKidFrame->GetView()->GetParent()
$6 = (nsIView *) 0x0

Comment 7

[Benjamin Smedberg]

Wow, did we never have a bug for this before? This has been a problem forever (I
first experienced it when first learning XUL on mozilla1.0). Neil and I
discussed this a long time ago... the problem occurs for any scrollable frame in
a popup.

Comment 8

[[e-mail]]

Many times... bug 126090 is the nearest equivalent; it got marked as duplicate
of bug 35299, and then there's bug 211839, marked as dup of 209365, which itself
is collecting further duplicates... this information brought to you courtesy of
http://bugzilla.mozilla.org/query.cgi

Comment 9

[Ariel Fatecha]

about comment #7: it's not necessary scrollframe in popup, textbox in scrollbox
too, bug 107520.

Comment 10

[Anders Pedersen]

Confirmed, after doing as shown in <a
href="http://bugzilla.mozilla.org/show_bug.cgi?id=224659#c5">comment #5</a>.

talkbackid: TB9498X
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040331
Microsoft Windows 2000 Professional 5.00.2195 SP4

Comment 11

[Asa Dotzler [:asa]]

from talkback:

nsView::GetDimensions[/mozilla/view/src/nsView.h]
nsView::GetClippedRect[/mozilla/view/src/nsView.cpp, line 841]
nsViewManager::UpdateView[/mozilla/view/src/nsViewManager.cpp, line 1734]
nsViewManager::MoveViewTo[/mozilla/view/src/nsViewManager.cpp, line 2562]
nsContainerFrame::PositionFrameView[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 483]
nsContainerFrame::PositionChildViews[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 991]
nsContainerFrame::PositionChildViews[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 996]
nsContainerFrame::PositionChildViews[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 996]
nsContainerFrame::PositionChildViews[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 996]
nsBox::SetBounds[/mozilla/layout/xul/base/src/nsBox.cpp, line 602]
nsSprocketLayout::Layout[/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line
484]
nsContainerBox::DoLayout[/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 612]
nsBox::Layout[/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsScrollBoxFrame::DoLayout[/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp,
line 337]
nsBox::Layout[/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsSprocketLayout::Layout[/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line
520]
nsContainerBox::DoLayout[/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 612]
nsBox::Layout[/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsSprocketLayout::Layout[/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line
520]
nsContainerBox::DoLayout[/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 612]
nsBox::Layout[/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsPopupSetFrame::DoLayout[/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp, line
267]
nsBox::Layout[/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsSprocketLayout::Layout[/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line
520]
nsContainerBox::DoLayout[/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 612]
nsBox::Layout[/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsStackLayout::Layout[/mozilla/layout/xul/base/src/nsStackLayout.cpp, line 322]
nsContainerBox::DoLayout[/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 612]
nsBox::Layout[/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsBoxFrame::Reflow[/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 868]
nsRootBoxFrame::Reflow[/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 240]
nsContainerFrame::ReflowChild[/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 953]
ViewportFrame::Reflow[/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 249]
IncrementalReflow::Dispatch[/mozilla/layout/html/base/src/nsPresShell.cpp, line 900]
PresShell::ProcessReflowCommands[/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6353]
ReflowEvent::HandleEvent[/mozilla/layout/html/base/src/nsPresShell.cpp, line 6178]
PL_HandleEvent[/mozilla/xpcom/threads/plevent.c, line 674]
PL_ProcessPendingEvents[/mozilla/xpcom/threads/plevent.c, line 612]
_md_EventReceiverProc[/mozilla/xpcom/threads/plevent.c, line 1415]
nsAppShellService::Run[/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 524]
main1[/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1313]
main[/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1719]
WinMain[/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1745]
WinMainCRTStartup()
KERNEL32.DLL + 0x287e7 (0x7c5987e7)

Comment 12

[Asa Dotzler [:asa]]

this stack trace looks like 107518

*** This bug has been marked as a duplicate of 107518 ***