267978 - Crash when changing display:table position:absolute div to display:block on :hover

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041104 Firefox/0.9.1+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041104 Firefox/0.9.1+

See upcoming testcase.
Talkback ID:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1746717W

This seems a regression:
Doesn't happen with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041026
Firefox/0.9.1+ 6:32am
Happens with:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a5) Gecko/20041027
Firefox/0.9.1+	6:57am

See:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-10-26+06%3A30%3A00&maxdate=2004-10-27+07%3A00%3A00&cvsroot=%2Fcvsroot

Maybe this is caused by bug 263406?

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase that causes crash

Comment 2

[Martijn Wargers (dead)]

Attachment: Backtrace

This is a backtrace from the crasher, from an earlier, not yet minimised
testcase.

Comment 3

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041104
crashed on testcase:
nsCSSFrameConstructor::FindFrameWithContent 55cc45bf
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1748906K

seems to be a top-crasher:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsCSSFrameConstructor%3A%3AFind&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

other bugs with this signature, don´t have testcases:

Bug 244758 Mozilla crashes when signing out of Bank of America website [@
nsCSSFrameConstructor::FindFrameWithContent ]

Bug 255175 Sometimes crashes on customized vBulletin 3 forums when viewing
subforums [@ nsCSSFrameConstructor::FindFrameWithContent ]

Comment 4

[Bernd]

Boris, is that yours or mine?

Comment 5

[Bernd]

this crashes with trunk 20041102 and is wfm with winxp 2004110505

Comment 6

[Bernd]

probably fixed by bug 266850

Comment 7

[Boris Zbarsky [:bzbarsky]]

Yes, this was probably broken by bug 263406 and yes, it should be fixed by bug
266850.  Martijn, could you test whether it is and comment?

Comment 8

[Martijn Wargers (dead)]

Yes, fixed. doesn't crash anymore in current nightly build.