233940 - Crash when choosing an alternate stylesheet

Status: VERIFIED WORKSFORME

(Core :: CSS Parsing and Computation, defect)

Description

[Michaël Gagné]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

When I choose the alternative css, foxfire crash

Reproducible: Always
Steps to Reproduce:
1.open the page
2.click on bottom left (alternate css)
3.choose "light"

Actual Results:  
Foxfire crash

Expected Results:  
change the css

Comment 1

[Bill Mason]

Works for me 20030210 PC/Win2000

Comment 2

[Michaël Gagné]

*** Bug 233943 has been marked as a duplicate of this bug. ***

Comment 3

[José Jeria]

WFM build 20040210, Win XP

Comment 4

[Michael Gall]

I believe this is only when the alternative css is not there. 

To reproduce,
1) Goto www.wakeless.net (The server can be quite slow)
2) Select "Pete Stylesheet" from alternative css menu
3) Click on body of webpage.

This is reproducable on all builds since atleast 0.7, maybe previously too.

Comment 5

[Michaël Gagné]

this site doesnt make my firefox to chash

(In reply to comment #4)
> I believe this is only when the alternative css is not there. 
> 
> To reproduce,
> 1) Goto www.wakeless.net (The server can be quite slow)
> 2) Select "Pete Stylesheet" from alternative css menu
> 3) Click on body of webpage.
> 
> This is reproducable on all builds since atleast 0.7, maybe previously too.

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to comment #4)
> To reproduce,
> 1) Goto www.wakeless.net (The server can be quite slow)
> 2) Select "Pete Stylesheet" from alternative css menu
> 3) Click on body of webpage.

I can confirm the crash with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.6) Gecko/20040206 Firefox/0.8

I'll try to create a small testcase later.

Comment 7

[brewthatistrue]

Attachment: file included in testcase01

testcase, part 2 of 2

Comment 8

[brewthatistrue]

Attachment: testcase00

testcase, part 1 of 2
click this one, and switch to the alternate stylesheet to crash

Comment 9

[brewthatistrue]

Attachment: testcase01

Comment 10

[Henrik Skupin [:whimboo][⌚️UTC+1]]

When i try the page from comment 4 i get following exception:

Die Anwendung "firefox.exe" hat einen Programmfehler verursacht. Datum und Zeit
des Fehlers: 03.03.2004 um 22:38:30.324  Ausnahme: c0000005 an Adresse 005DA000
(nsRegionRectIterator::Reset)  

Comment 11

[Alessandro Minelli]

(In reply to comment #4)
> To reproduce,
> 1) Goto www.wakeless.net (The server can be quite slow)
> 2) Select "Pete Stylesheet" from alternative css menu
> 3) Click on body of webpage.

Confirm crash using 0.8 final clean profile on Win XP full patched.

Comment 12

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Changed URL because we have several confirmings for www.wakeless.net.

-> QA

Comment 13

[Ben Fowler]

When I select the Pete Stylesheet from the Pop-up in the status bar, the page
goes blank, but Firefox seems not to crash and there are no surprising messages
in the Console.

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7b) Gecko/20040313
Firefox/0.8.0+

Ben

Comment 14

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Oh I forgot to say that you have to click inside the document after you changed
the style. I can produce it on any machine I have.

Comment 15

[Ben Fowler]

Attachment: Error log and gdb backtrace

It looks as though something is being passed a null pointer and asked
to treat it as a pointer to an object.

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7b) Gecko/20040321
Firefox/0.8.0+

Ben

Comment 16

[Ger Teunis]

Crashing here aswell> try the following:

1. go to http://texturizer.net/firefox/extensions/
2. Select Classic Theme
3. Select Basic theme
4. CRASH

Comment 17

[Neil Paris]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040329 Firefox/0.8.0+

Crash here on Slackware Linux Current with the wakeless.net

Talkback ID: TB8856X

Comment 18

[Asa Dotzler [:asa]]

GetFrameFromLine[/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 5730]
nsBlockFrame::GetFrameForPointUsing[/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5806]
nsBlockFrame::GetFrameForPoint[/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5839]
PresShell::HandleEvent[/mozilla/layout/html/base/src/nsPresShell.cpp, line 5852]
nsViewManager::HandleEvent[/mozilla/view/src/nsViewManager.cpp, line 2235]
nsViewManager::DispatchEvent[/mozilla/view/src/nsViewManager.cpp, line 2025]
HandleEvent[/mozilla/view/src/nsView.cpp, line 79]
nsWindow::DispatchEvent[/mozilla/widget/src/windows/nsWindow.cpp, line 1068]
nsWindow::DispatchWindowEvent[/mozilla/widget/src/windows/nsWindow.cpp, line 1085]
nsWindow::DispatchFocus[/mozilla/widget/src/windows/nsWindow.cpp, line 5418]
nsWindow::ProcessMessage[/mozilla/widget/src/windows/nsWindow.cpp, line 4167]
nsWindow::WindowProc[/mozilla/widget/src/windows/nsWindow.cpp, line 1347]
USER32.dll + 0x3a50 (0x77d43a50)
USER32.dll + 0x3b1f (0x77d43b1f)
USER32.dll + 0x44f5 (0x77d444f5)
USER32.dll + 0x4525 (0x77d44525)
ntdll.dll + 0x25da3 (0x77f75da3)
nsView::~nsView[/mozilla/view/src/nsView.cpp, line 167]
nsView::`scalar deleting destructor'
nsIView::Destroy[/mozilla/view/src/nsView.cpp, line 253]
nsView::~nsView[/mozilla/view/src/nsView.cpp, line 118]
nsIView::Destroy[/mozilla/view/src/nsView.cpp, line 253]
nsFrame::Destroy[/mozilla/layout/html/base/src/nsFrame.cpp, line 646]
nsSubDocumentFrame::Destroy[/mozilla/layout/html/document/src/nsFrameFrame.cpp,
line 565]
nsLineBox::DeleteLineList[/mozilla/layout/html/base/src/nsLineBox.cpp, line 303]
nsBlockFrame::Destroy[/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 303]
nsFrameList::DestroyFrame[/mozilla/layout/base/src/nsFrameList.cpp, line 214]
nsAbsoluteContainingBlock::RemoveFrame[/mozilla/layout/html/base/src/nsAbsoluteContainingBlock.cpp,
line 141]
ViewportFrame::RemoveFrame[/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 156]
nsFrameManager::RemoveFrame[/mozilla/layout/html/base/src/nsFrameManager.cpp,
line 758]
nsCSSFrameConstructor::ContentRemoved[/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9434]
nsCSSFrameConstructor::RecreateFramesForContent[/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11266]
nsCSSFrameConstructor::ProcessRestyledFrames[/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9792]
PresShell::ReconstructStyleData[/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5305]
PresShell::EndUpdate[/mozilla/layout/html/base/src/nsPresShell.cpp, line 3567]
nsDocument::EndUpdate[/mozilla/content/base/src/nsDocument.cpp, line 1722]
CSSStyleSheetImpl::SetDisabled[/mozilla/content/html/style/src/nsCSSStyleSheet.cpp,
line 2447]
XPTC_InvokeByIndex[/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod[/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2029]
XPC_WN_GetterSetter[/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1312]
js_Invoke[/mozilla/js/src/jsinterp.c, line 943]
js_InternalInvoke[/mozilla/js/src/jsinterp.c, line 1036]
js_InternalGetOrSet[/mozilla/js/src/jsinterp.c, line 1079]
js_SetProperty[/mozilla/js/src/jsobj.c, line 2768]
js_Interpret[/mozilla/js/src/jsinterp.c, line 2156]
js_Invoke[/mozilla/js/src/jsinterp.c, line 959]
js_InternalInvoke[/mozilla/js/src/jsinterp.c, line 1036]
JS_CallFunctionValue[/mozilla/js/src/jsapi.c, line 3591]
nsJSContext::CallEventHandler[/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1269]
nsJSEventListener::HandleEvent[/mozilla/dom/src/events/nsJSEventListener.cpp,
line 181]
nsEventListenerManager::HandleEventSubType[/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1435]
nsEventListenerManager::HandleEvent[/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1512]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2851]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2870]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2870]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2870]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2870]
PresShell::HandleDOMEventWithTarget[/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6097]
nsMenuFrame::Execute[/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 1651]
nsMenuFrame::HandleEvent[/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 443]
PresShell::HandleEventInternal[/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6067]
PresShell::HandleEvent[/mozilla/layout/html/base/src/nsPresShell.cpp, line 5942]
nsViewManager::HandleEvent[/mozilla/view/src/nsViewManager.cpp, line 2281]
nsViewManager::DispatchEvent[/mozilla/view/src/nsViewManager.cpp, line 2025]

Comment 19

[Asa Dotzler [:asa]]

dupe of bug 235405? Stacks look similar.

Comment 20

[Michael Gall]

While it may be caused by the same bug, it certainly is not a dupe. This is
caused by selecting an alternative, non-existant stylesheet. Maybe the summary
should be changed to reflect this.

Comment 21

[Ben Fowler]

Attachment: Patch which prevents crash

Are we talking about the same defect?

The enclosed patch stops the crash (but does nothing about any underlying
cause).

Ben

Comment 22

[Neil Paris]

Crash in Moz 1.7 Beta: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b)
Gecko/20040316

Talkback ID is TB9606Q
Captured at 04/01/04 at 01:20 AM

Comment 23

[Michael Gall]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040331 Firefox/0.8

Seems to be fixed.

Comment 24

[Neil Paris]

(In reply to comment #23)
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040331
Firefox/0.8
> 
> Seems to be fixed.

I can confirm this:

Now WFM with:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040403
and with 
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040403 Firefox/0.8.0+

Has the patch from Comment #21 been applied?

Comment 25

[Ben Fowler]

I think that this is fixed. 

The crash does not occur.

Ben

Comment 26

[Ben Fowler]

Apologies.

It is true that the, crash no longer occurs when following the recipe given, but
it is possible that the page has been fixed (or at least altered).

We either need a different test case or to hear from the reporter.

Ben

Comment 27

[Henrik Skupin [:whimboo][⌚️UTC+1]]

URL seems to be fixed so i remove it. Also I tried testcase 1 and Mozilla/5.0
(Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040412 Firefox/0.8.0+ and I
can confirm the bug. The browser still crashes.

Comment 28

[Ben Fowler]

I haven't (yet) been able to produce the crash using the testcase01.

Is there a detailled recipe?

Ben

Comment 29

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Firefox crashes only when running Win2k and Win98. With 2k I get a Box with the
message that a protocol will be created but there is nothing to see. :( Win98
tells me following:

FIREFOX verursachte einen Fehler durch eine ungültige Seite
in Modul FIREFOX.EXE bei 0167:0061bce4.
Register:
EAX=00000000 CS=0167 EIP=0061bce4 EFLGS=00000202
EBX=00c8d288 SS=016f ESP=00c8d224 EBP=00c8d244
ECX=00c8d250 DS=016f ESI=01b26850 FS=0e37
EDX=00000000 ES=016f EDI=00000003 GS=0000
Bytes bei CS:EIP:
ff 50 6c 85 c0 78 0c 8b 45 0c 85 c0 74 05 8b 4d 
Stapelwerte:
01b26850 021dc6d0 00c8d288 00000002 00c8d250 00c8d280 01b26994 01b267d4 00c8d2a4
0061bbf6 00c8d270 00c8d288 00c8d2b4 021dc6d0 00000002 021df3d0 

I don't know if that information will help but I don't have a debug build to get
the whole information.

Comment 30

[Michaël Gagné]

Mozilla/5.0 (Windows;U;Windows NT 5.0;en-US;rv:1.6) Gecko/20040206 Firefox/0.8

The testcase01 and www.wakeless.net no longer cause my browser to crash

can you confirm that this bug is fixed?

Comment 31

[Michael Gall]

www.wakeless.net is my site, I've been making some changes to it, but I believe
that selecting Pete Stylesheet there should still cause the crash if it exists.
The stylesheet it is pointing to does not exist and that was what I believe
caused the crash. I suggest that it is fixed.

Comment 32

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Crash doesn't any longer appear with current builds.

Marking WFM but feel free to reopen if it will happen again.

Comment 33

[Henrik Skupin [:whimboo][⌚️UTC+1]]

v

Comment 34

[Neil Paris]

Attachment: testcase

I see a crash again when changing to a stylesheet (I don't know if this is a
new bug or if it actually belongs here)

Found this on Hixie's blog, when trying to change to the "Orange" stylesheet.

I can crash everytime by changing the Stylesheet to the "No Theme" or "Basic
Page Style" (depending on Fx or Moz), and then changing back to "Orange"

Submitted a Talkback with http://ln.hixie.ch as the URL (I can get Talkback at
will).

Witnessed in a CVS build of Fx from 20040428 and with Moz 1.7 RC1, both on
Slackware Linux current. (New Profile with Moz still crashes)

Comment 35

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I can confirm with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a)
Gecko/20040429 Firefox/0.8.0+

-> Reopening

Comment 36

[Neil Paris]

I saw this crash in Fx and in Mozilla 1.7 RC1

--> Browser?

Comment 37

[Michaël Gagné]

I confirm that the testcase "testcase" makes my Mozilla/5.0 (Windows; U; 
Windows NT 5.0; en-US; rv:1.8a) Gecko/20040502 Firefox/0.8 to crash when i 
change from basic theme to orange one

Comment 38

[Neil Paris]

Changing component to Browser.

Comment 39

[Neil Paris]

From Talkback:

Stack Signature	 _ZNK8nsIFrame7GetViewEv() 87d01f4c
Product ID	Mozilla17
Build ID	2004042110
Trigger Time	2004-04-30 18:15:08.0
Platform	LinuxIntel
Operating System	Linux 2.4.22
Module	libgklayout.so + (00094f17)
URL visited	http://ln.hixie.ch
User Comments	Changed to alternate style-sheet "Orange" > Crash Found with
nightly of Firefox, reproduced on Moz 1.7 RC1
Since Last Crash	sec
Total Uptime	sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File Name	
Trigger Line No.	
Stack Trace 	
_ZNK8nsIFrame7GetViewEv()
_ZN20nsHTMLContainerFrame18CreateViewForFrameEP8nsIFrameS1_i()
_ZN21nsCSSFrameConstructor27ConstructFrameByDisplayTypeEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStatePK14nsStyleDisplayP10nsIContentiP7nsIAtomP8nsIFrameP14nsStyleContextR12nsFrameItems()
_ZN21nsCSSFrameConstructor22ConstructFrameInternalEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameP7nsIAtomiP14nsStyleContextR12nsFrameItemsi()
_ZN21nsCSSFrameConstructor14ConstructFrameEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameR12nsFrameItems()
_ZN21nsCSSFrameConstructor15ProcessChildrenEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameiR12nsFrameItemsiP14nsTableCreator()
_ZN21nsCSSFrameConstructor23ConstructTableCellFrameEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameP14nsStyleContextR14nsTableCreatoriR12nsFrameItemsRS9_SG_Ri()
_ZN21nsCSSFrameConstructor17TableProcessChildEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentS7_P8nsIFrameP7nsIAtomP14nsStyleContextR14nsTableCreatorR12nsFrameItemsRS9_()
_ZN21nsCSSFrameConstructor20TableProcessChildrenEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameR14nsTableCreatorR12nsFrameItemsRS9_()
_ZN21nsCSSFrameConstructor19ConstructTableFrameEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameS9_P14nsStyleContextR14nsTableCreatoriR12nsFrameItemsRS9_SG_Ri()
_ZN21nsCSSFrameConstructor27ConstructFrameByDisplayTypeEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStatePK14nsStyleDisplayP10nsIContentiP7nsIAtomP8nsIFrameP14nsStyleContextR12nsFrameItems()
_ZN21nsCSSFrameConstructor22ConstructFrameInternalEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameP7nsIAtomiP14nsStyleContextR12nsFrameItemsi()
_ZN21nsCSSFrameConstructor14ConstructFrameEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameR12nsFrameItems()
_ZN21nsCSSFrameConstructor29ConstructDocElementTableFrameEP12nsIPresShellP14nsIPresContextP10nsIContentP8nsIFrameRS7_P21nsILayoutHistoryState()
_ZN21nsCSSFrameConstructor24ConstructDocElementFrameEP12nsIPresShellP14nsIPresContextR23nsFrameConstructorStateP10nsIContentP8nsIFrameRS9_()
_ZN21nsCSSFrameConstructor30ReconstructDocElementHierarchyEP14nsIPresContext()
_ZN21nsCSSFrameConstructor24RecreateFramesForContentEP14nsIPresContextP10nsIContent()
_ZN21nsCSSFrameConstructor21ProcessRestyledFramesER17nsStyleChangeListP14nsIPresContext()
_ZN9PresShell20ReconstructStyleDataEv()
_ZN9PresShell9EndUpdateEP11nsIDocumentj()
_ZN10nsDocument9EndUpdateEj()
_ZN17CSSStyleSheetImpl11SetDisabledEi()
XPTC_InvokeByIndex()
_ZN16XPCWrappedNative10CallMethodER14XPCCallContextNS_8CallModeE()
_Z19XPC_WN_GetterSetterP9JSContextP8JSObjectjPlS3_()
js_Invoke()
js_InternalInvoke()
js_InternalGetOrSet()
js_SetProperty()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
_ZN11nsJSContext16CallEventHandlerEP8JSObjectS1_jPlS2_()
_ZN17nsJSEventListener11HandleEventEP11nsIDOMEvent()
_ZN22nsEventListenerManager18HandleEventSubTypeEP16nsListenerStructP11nsIDOMEventP17nsIDOMEventTargetjj()
_ZN22nsEventListenerManager11HandleEventEP14nsIPresContextP7nsEventPP11nsIDOMEventP17nsIDOMEventTargetjP13nsEventStatus()
_ZN12nsXULElement14HandleDOMEventEP14nsIPresContextP7nsEventPP11nsIDOMEventjP13nsEventStatus()
_ZN12nsXULElement14HandleDOMEventEP14nsIPresContextP7nsEventPP11nsIDOMEventjP13nsEventStatus()
_ZN12nsXULElement14HandleDOMEventEP14nsIPresContextP7nsEventPP11nsIDOMEventjP13nsEventStatus()
_ZN12nsXULElement14HandleDOMEventEP14nsIPresContextP7nsEventPP11nsIDOMEventjP13nsEventStatus()
_ZN12nsXULElement14HandleDOMEventEP14nsIPresContextP7nsEventPP11nsIDOMEventjP13nsEventStatus()
_ZN9PresShell24HandleDOMEventWithTargetEP10nsIContentP7nsEventP13nsEventStatus()
_ZN11nsMenuFrame7ExecuteEP10nsGUIEvent()
_ZN11nsMenuFrame11HandleEventEP14nsIPresContextP10nsGUIEventP13nsEventStatus()
_ZN9PresShell19HandleEventInternalEP7nsEventP7nsIViewjP13nsEventStatus()
_ZN9PresShell11HandleEventEP7nsIViewP10nsGUIEventP13nsEventStatusiRi()
_ZN13nsViewManager11HandleEventEP6nsViewP10nsGUIEventi()
_ZN13nsViewManager13DispatchEventEP10nsGUIEventP13nsEventStatus()
_Z11HandleEventP10nsGUIEvent()
_ZN8nsWidget13DispatchEventEP10nsGUIEventR13nsEventStatus()
_ZN8nsWidget19DispatchWindowEventEP10nsGUIEvent()
_ZN8nsWidget18DispatchMouseEventER12nsMouseEvent()
_ZN8nsWidget21OnButtonReleaseSignalEP15_GdkEventButton()
_ZN8nsWindow21OnButtonReleaseSignalEP15_GdkEventButton()
_ZN8nsWindow14HandleGDKEventEP9_GdkEvent()
_Z23dispatch_superwin_eventP9_GdkEventP8nsWindow()
_Z16handle_gdk_eventP9_GdkEventPv()
libgdk-1.2.so.0 + 0x16b44 (0x40276b44)
libglib-1.2.so.0 + 0xfe75 (0x402a3e75)
libglib-1.2.so.0 + 0x1032c (0x402a432c)
libglib-1.2.so.0 + 0x1055c (0x402a455c)
libgtk-1.2.so.0 + 0x8c083 (0x401ce083)
_ZN10nsAppShell3RunEv()
_ZN17nsAppShellService3RunEv()
_Z5main1iPPcP11nsISupports()
main()
libc.so.6 + 0x15936 (0x403cb936)

Comment 40

[Neil Paris]

Marking WORKSFORME (This bug was WFM'ed earlier; reopened because of a crash
when switching to the "Orange" stylesheet [testcase], however, that particular
crash is because of Bug 231776, all relevent comments concerning the latter
crash should be added there. Sorry for spam/inconvenience)

Comment 41

[Anne (:annevk)]

This is actually a duplicate of that bug, marking...

-> DUPLICATE

*** This bug has been marked as a duplicate of 231776 ***

Comment 42

[Neil Paris]

Anne, THIS bug, bug 233940, was caused by changing to an alternate stylesheet
that did not exist. The bug you marked this as a dupe of is ONLY caused when
position is absolute and the root is 'display: table'. I do not believe this is
a dupe of bug 231776; I had erroneously hijacked this bug, and when I found bug
231776, I re-closed this bug as WFM (as if I had not added the testcase and
reopened the bug).

Comment 43

[Anne (:annevk)]

Sorry for spamming everyone, I was confused and read comment 40 wrongly.

Comment 44

[Henrik Skupin [:whimboo][⌚️UTC+1]]

v.