254412 - an <iframe> inside a <popup> crashes the browser when popup is displayed [@ nsView::GetDimensions ]

Status: RESOLVED EXPIRED

(Core :: XUL, defect)

Description

[Ilya Bely]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6a) Gecko/20031030
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2

An <iframe> tag inside a <popup> crashes the browser when popup should be displayed.

It crashes when a XUL is loaded from chrome, local file, or a web server.




Reproducible: Always
Steps to Reproduce:
The following XUL crashes the browser when button is clicked.

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://softomate_toolbar/content/style.css"
type="text/css"?>

<window
    id="toolbar-window"
    title="Toolbar"
    orient="horizontal"
    xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
    align="center">


<popupset>
  <popup id="popupbubble">
	<iframe src="n.html" width="180" height="50" maxheight="50" />
	<zzdescription value="bubble"/>
  </popup>
</popupset>

<toolbarbutton
	    id="pop_bubble"
		popup="popupbubble"
		label="crash browser!"/>

</window>

Actual Results:  
browser crashes

Expected Results:  
display the popup

Comment 1

[Adam Hauner]

Ilya: Could you provide TalkBack incident ID also for this crash?

Comment 2

[Ilya Bely]

Attachment: talkback dump

I do not know how to get the icident ID send by talkback, I only can say that I

had included id of the bug (254412) into the description.

I'm including the talkback dump into the attachment.

Comment 3

[Ilya Bely]

icident signature is
 nsView::GetDimensions 3a81f2cb

Comment 4

[Nathan Strom]

I'll confirm this bug, but I can't change its status. I was able to reproduce
using the posted testcase, with one change: 
<?xml-stylesheet href="chrome://softomate_toolbar/content/style.css"
type="text/css"?>
changed to
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
since I didn't have a chrome entry for softomate_toolbar (Googling shows it as
some sort of spyware, but that's secondary to this crash issue).

To reproduce the crash via local (file://) access, I also had to create a file
called n.html.

I was able to reproduce the crash over HTTP as well, but only with the file
served as "application/vnd.mozilla.xul+xml" -- serving as "text/xml" did not
cause a crash.

My talkback IDs: TB489129X and TB489156E for locally executed, TB489203E for HTTP.

Modified testcase posted here; try loading this page and clicking the button:
http://nstrom.chaosnet.org/test.xul

I'm using Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040803
Firefox/0.9.3

Comment 5

[Ilya Bely]

The test page http://nstrom.chaosnet.org/test.xul crashes on my home computer.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040204

This is clean installation of Mozilla (the googlebar is the only addition), but,
unfortunately, I had compiled it without TalkBack support. I'll test the page
and post an icident id tommorow on the same computer as the initial report.

Comment 6

[Adam Hauner]

Roc, should this be also dupe of bug 38589 (maybe bug 35299)?

TB489129:
nsView::GetDimensions 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/view/src/nsView.h,
line 248]
nsView::GetClippedRect 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 841]
nsViewManager::UpdateView 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1738]
nsViewManager::MoveViewTo 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2567]
nsContainerFrame::PositionFrameView 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 510]
nsBox::SetBounds 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 584]
nsSprocketLayout::Layout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 484]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsRootBoxFrame::Reflow 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp,
line 240]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 249]
IncrementalReflow::Dispatch 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 900]
PresShell::ProcessReflowCommands 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6366]
ReflowEvent::HandleEvent 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6191]
PL_HandleEvent 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
SETUPAPI.DLL + 0x30c24 (0x778b0c24)

Comment 7

[Boris Zbarsky [:bzbarsky]]

Isn't this a dup of bug 174347 ?

Comment 8

[Nathan Strom]

(In reply to comment #7)
> Isn't this a dup of bug 174347 ?

Could be, although the stack trace is different: compare TB489203E for this bug
to TB491774W for bug 174347.

Comment 9

[Ilya Bely]

icident id for the http://nstrom.chaosnet.org/test.xul 
TB495009K

Comment 10

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 11

[Gervase Markham [:gerv]]

This bug has been automatically resolved after a period of inactivity (see above
comment). If anyone thinks this is incorrect, they should feel free to reopen it.