236590 - Mozilla crashes when moving the mouse over some menu items on the page. - M17beta [@ nsCSSFrameConstructor::StyleChangeReflow] [@ IsCanvasFrame] [@ 0x00000000 - IsCanvasFrame]

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[tom.williams]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:) Gecko/20040305 MultiZilla/1.6.2.1d
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:) Gecko/20040305 MultiZilla/1.6.2.1d

When I move the mouse over some menu items on the http://markschenk.com/ page,
Mozilla crashes.

Reproducible: Always
Steps to Reproduce:
1.Go to http://markschenk.com/
2.Move the mouse over the menu optons
3.

Actual Results:  
Mozilla crashes.

Expected Results:  
Mozilla should not crash.

Comment 1

[Rene Pronk]

WFM Mozilla 1.7a & Firefox 0.8, WinXP

Comment 2

[Olivier Cahagne]

confirming crash using FF 20040303 Win2k.

Comment 3

[Mats Palmgren (inactive)]

Attachment: Stack

Comment 4

[Mats Palmgren (inactive)]

Confirming bug, 2004-03-02-08 trunk Linux.

Comment 5

[Mats Palmgren (inactive)]

I should have added:

(gdb) frame 8
#8  0x41eae37c in nsCSSFrameConstructor::StyleChangeReflow(nsIPresContext*,
nsIFrame*, nsIAtom*) (this=0x8760d70,
    aPresContext=0x87790e0, aFrame=0x87b72f4, aAttribute=0x0) at
nsCSSFrameConstructor.cpp:9665
9665      rv = CallQueryInterface(aFrame, &box);
(gdb) p *aFrame
$4 = {<nsISupports> = {_vptr.nsISupports = 0x0}, mRect = {x = -572662307, y =
-572662307, width = -572662307, height = -572662307},
  mContent = 0xdddddddd, mStyleContext = 0xdddddddd, mParent = 0xdddddddd,
mNextSibling = 0xdddddddd, mState = 3722304989}

Comment 6

[Mats Palmgren (inactive)]

Regression occured 2004-02-23-08 -- 2004-02-24-07

Comment 7

[Andrew Schultz]

Attachment: testcase

testcase crashes linux trunk 2003030407

Comment 8

[Sekundes]

*** Bug 237968 has been marked as a duplicate of this bug. ***

Comment 9

[Boris Zbarsky [:bzbarsky]]

Mats, thanks for narrowing down the regression range!

This was broken by bryner's patch for bug 233972.  GetFrameProperty() used to
return NS_IFRAME_MGR_PROP_NOT_THERE if the property was not set, but after that
patch it started returning NS_ERROR_FAILURE.  As a result, the code added by rbs
in revision 1.813 of nsCSSFrameConstructor (protection against this exact crash
in ProcessRestyledFrames) became a no-op, since it was checking for
NS_IFRAME_MGR_PROP_NOT_THERE.

Note that nsFrameManager.h documentation now contradicts the code... so the
frame manager code is what we should be fixing, I would say.

We really don't want to ship 1.7 with this bug.

Comment 10

[Andrew Schultz]

*** Bug 237983 has been marked as a duplicate of this bug. ***

Comment 11

[Olivier Cahagne]

*** Bug 237499 has been marked as a duplicate of this bug. ***

Comment 12

[Brian Ryner (not reading)]

Attachment: patch

Comment 13

[Brian Ryner (not reading)]

Comment on attachment 144422 [details] [diff] [review]
patch

requesting approval for 1.7

Comment 14

[chris hofmann]

Comment on attachment 144422 [details] [diff] [review]
patch

a=chofmann for 1.7

Comment 15

[Brian Ryner (not reading)]

fix checked in.

Comment 16

[Jay Patel [:jay]]

*** Bug 238454 has been marked as a duplicate of this bug. ***

Comment 17

[Jay Patel [:jay]]

Added [@ IsCanvasFrame] [@ 0x00000000 - IsCanvasFrame] to track those stack
signatures.

Comment 18

[Jay Patel [:jay]]

No longer crashing on mouseover at
http://www.stunicholls.myby.co.uk/layouts/3cols.html or http://markschenk.com/ .
  Marking verified.

Comment 19

[Jay Patel [:jay]]

No longer crashing on mouseover with MozillaTrunk 2004040413 build at
http://www.stunicholls.myby.co.uk/layouts/3cols.html or http://markschenk.com/ .
  Marking verified.