235120 - Select other Style CSS and crash [@ nsCSSFrameConstructor::RecreateFramesForContent]

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[radikal]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; es-ES; rv:1.6) Gecko/20040113

At http://mozilla.pasote.com :
- The left cell has links with a:over decoration that doesnt works.
- if you change the CSS Style (choosing 'Red' style, by example) the Mozilla
hangs, in Windows 2000 and Linux (Gentoo).


Reproducible: Always
Steps to Reproduce:
1.Open http://mozilla.pasote.com
2.Select View->Style Sheet->Red


Actual Results:  
Mozilla 1.6 hangs

Expected Results:  
Dont hang :)

The problem is caused by a float: left; CSS declaration, corresponding to the
left cell.

The following CSS declaration:

#MenusCont {
	width: 150px;
	background-color: #F9F9F9;
	margin: 0px;
	padding: 0px;
	vertical-align: top;
	float: left;
}

Applied to a <td> causes this problem...

<table id="TodoCont">
	<tr> 
	<td id="MenusCont">
	
[....]	

if the float: left; declaration is removed, the page works fine.

Comment 1

[Stefan [:stefanh]]

Attachment: Mac OS X crash log

I can confirm the crash on Mac OS 10.2.8 with Mozilla 2004021701 (Leaf:s 10.2.8
test build, downloaded from
http://ftp.mozilla.org/pub/mozilla.org/mozilla/nightly/latest-1.7a-OSX10.2.8-test).


Same crash happens with Mozilla 2004012705 on Mac OS 10.2.8.

Comment 2

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7a) Gecko/20040219

crashes also on Win98, found two maybe related bugs by querying for crashers in
style system:

Bug 229263 crashes at hixie.ch by switching stylesheet [@nsLineBox::GetAscent]

Bug 133219 Browser crash when selecting alternate style sheet on libpr0n.com [@
GetNearestContainingBlock]

READ Bug 133219 COMMENT 60 BEFORE COMMENTING there


http://bugzilla.mozilla.org/buglist.cgi?query_format=&short_desc_type=allwordssubstr&short_desc=&product=Browser&component=Style+System+%28CSS%29&long_desc_type=substring&long_desc=&bug_file_loc_type=allwordssubstr&bug_file_loc=&status_whiteboard_type=allwordssubstr&status_whiteboard=&keywords_type=allwords&keywords=crash&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&emailassigned_to1=1&emailtype1=exact&email1=&emailassigned_to2=1&emailreporter2=1&emailqa_contact2=1&emailtype2=exact&email2=&bugidtype=include&bug_id=&votes=&chfieldfrom=&chfieldto=Now&chfieldvalue=&cmdtype=doit&order=Reuse+same+sort+as+last+time&field0-0-0=noop&type0-0-0=noop&value0-0-0=

Comment 3

[Stefan [:stefanh]]

The stacks looks different, though (the only stack i can find that looks a bit
similar is the one in bug 133219 comment #7).

Comment 4

[Boris Zbarsky [:bzbarsky]]

The patch in bug 233094 fixes both issues on this site...

Comment 5

[Asa Dotzler [:asa]]

from talkback:
nsCSSFrameConstructor::RecreateFramesForContent[/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11258]
nsCSSFrameConstructor::ProcessRestyledFrames[/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9792]
PresShell::ReconstructStyleData[/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5305]
PresShell::EndUpdate[/mozilla/layout/html/base/src/nsPresShell.cpp, line 3567]
nsDocument::EndUpdate[/mozilla/content/base/src/nsDocument.cpp, line 1722]
CSSStyleSheetImpl::SetDisabled[/mozilla/content/html/style/src/nsCSSStyleSheet.cpp,
line 2447]
XPTC_InvokeByIndex[/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod[/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2029]
XPC_WN_GetterSetter[/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1312]
js_Invoke[/mozilla/js/src/jsinterp.c, line 943]
js_InternalInvoke[/mozilla/js/src/jsinterp.c, line 1036]
js_InternalGetOrSet[/mozilla/js/src/jsinterp.c, line 1079]
js_SetProperty[/mozilla/js/src/jsobj.c, line 2768]
js_Interpret[/mozilla/js/src/jsinterp.c, line 2156]
js_Invoke[/mozilla/js/src/jsinterp.c, line 959]
js_InternalInvoke[/mozilla/js/src/jsinterp.c, line 1036]
JS_CallFunctionValue[/mozilla/js/src/jsapi.c, line 3591]
nsJSContext::CallEventHandler[/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1269]
nsJSEventListener::HandleEvent[/mozilla/dom/src/events/nsJSEventListener.cpp,
line 181]
nsEventListenerManager::HandleEventSubType[/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1435]
nsEventListenerManager::HandleEvent[/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1512]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2851]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2870]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2870]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2870]
nsXULElement::HandleDOMEvent[/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2870]
PresShell::HandleDOMEventWithTarget[/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6097]
nsMenuFrame::Execute[/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 1651]
nsMenuFrame::HandleEvent[/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 443]
PresShell::HandleEventInternal[/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6067]
PresShell::HandleEvent[/mozilla/layout/html/base/src/nsPresShell.cpp, line 5942]
nsViewManager::HandleEvent[/mozilla/view/src/nsViewManager.cpp, line 2281]
nsViewManager::DispatchEvent[/mozilla/view/src/nsViewManager.cpp, line 2025]
HandleEvent[/mozilla/view/src/nsView.cpp, line 79]
nsWindow::DispatchEvent[/mozilla/widget/src/windows/nsWindow.cpp, line 1068]
nsWindow::DispatchWindowEvent[/mozilla/widget/src/windows/nsWindow.cpp, line 1085]
nsWindow::DispatchMouseEvent[/mozilla/widget/src/windows/nsWindow.cpp, line 5225]
ChildWindow::DispatchMouseEvent[/mozilla/widget/src/windows/nsWindow.cpp, line 5478]
nsWindow::ProcessMessage[/mozilla/widget/src/windows/nsWindow.cpp, line 4063]
nsWindow::WindowProc[/mozilla/widget/src/windows/nsWindow.cpp, line 1347]
USER32.dll + 0x2a2d0 (0x77e3a2d0)
USER32.dll + 0x45e5 (0x77e145e5)
USER32.dll + 0xa816 (0x77e1a816)
nsAppShellService::Run[/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 524]
main1[/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1308]
main[/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1712]
WinMain[/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1734]
WinMainCRTStartup()
KERNEL32.DLL + 0x287e7 (0x7c5987e7)

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Crash stack seems like it could be related to bug 236590.

Comment 7

[Anders Pedersen]

Confirmed crash.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040413
Firefox/0.8.0+
Microsoft Windows 2000 Pro 5.00.2195 SP4

Comment 8

[Boris Zbarsky [:bzbarsky]]

Fixed by checkin for bug 233094.