If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crashes when switching style on http://ln.hixie.ch/

RESOLVED DUPLICATE of bug 231776

Status

()

Core
Layout
--
critical
RESOLVED DUPLICATE of bug 231776
13 years ago
13 years ago

People

(Reporter: Wladimir Palant, Unassigned)

Tracking

Trunk
x86
Windows XP
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(2 attachments)

(Reporter)

Description

13 years ago
This is a reproducible crash. Go to ln.hixie.ch and try to switch the style to
Orange - it results in a crash in Mozilla 1.7.3, Mozilla trunk nightly
2004091512 and Firefox 1.0PR. The crash occurs in
nsHTMLContainerFrame::CreateViewForFrame() - GetAncestorWithView() fails causing
an assertion and parent->GetView() one line below crashes then. Talkback ID is
TB834574W. Detailed stack trace:

nsIFrame::GetView()
nsHTMLContainerFrame::CreateViewForFrame()
nsCSSFrameConstructor::ConstructFrameByDisplayType()
nsCSSFrameConstructor::ConstructFrameInternal()
nsCSSFrameConstructor::ConstructFrame()
nsCSSFrameConstructor::ProcessChildren()
nsCSSFrameConstructor::ConstructTableCellFrame()
nsCSSFrameConstructor::TableProcessChild()
nsCSSFrameConstructor::TableProcessChildren()
nsCSSFrameConstructor::ConstructTableFrame()
nsCSSFrameConstructor::ConstructFrameByDisplayType()
nsCSSFrameConstructor::ConstructFrameInternal()
nsCSSFrameConstructor::ConstructFrame()
nsCSSFrameConstructor::ConstructDocElementTableFrame()
nsCSSFrameConstructor::ConstructDocElementFrame()
nsCSSFrameConstructor::ReconstructDocElementHierarchy()
nsCSSFrameConstructor::RecreateFramesForContent()
nsCSSFrameConstructor::ProcessRestyledFrames()
nsIPresShell::ReconstructStyleDataInternal()
PresShell::EndUpdate()
nsDocument::EndUpdate()
nsCSSStyleSheet::SetDisabled()

Bug 256108 describes a similar problem, the stack trace is different though.
(Reporter)

Comment 1

13 years ago
Created attachment 159083 [details]
Minimized testcase
(Reporter)

Comment 2

13 years ago
If this is a regression, then it is not a recent one - build 2004031809 crashes
as well.
(Reporter)

Comment 3

13 years ago
Created attachment 159087 [details] [diff] [review]
Add missing checks

This adds two additional checks to nsHTMLContainerFrame::CreateViewForFrame()
and prevents the crash. However, there might be more work to do - with this
patch the element with absolute positioning isn't displayed at all. I don't
know what behavior would be correct here and even if I knew - I don't know
enough about CSS processing to fix this.
(Reporter)

Updated

13 years ago
Attachment #159087 - Flags: review?(dbaron)
(Reporter)

Comment 4

13 years ago
It seems that this is a regression from bug 113083.

Comment 5

13 years ago
Just noting that there are 4 talkbacks about this - I'm assuming they are all
the same..

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=hixie&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=
(Reporter)

Updated

13 years ago
Attachment #159087 - Flags: review?(dbaron)
(Reporter)

Comment 6

13 years ago

*** This bug has been marked as a duplicate of 231776 ***
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.