Closed Bug 275746 Opened 20 years ago Closed 20 years ago

[FIX]Crash [@ nsTableRowFrame::IR_TargetIsChild] when clicking in drop down list, when changing from display:table-cell to display:inline

Categories

(Core :: Layout, defect, P1)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.8beta1

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(3 files)

Testcase
467 bytes, text/html
Details
Similar testcase
510 bytes, text/html
Details
Fix for the new crash
2.02 KB, patch
bernd_mozilla
: review+
roc
: superreview+
Details | Diff | Splinter Review 
The testcase that I will attach crashes my 2004-12-21 trunk build of Firefox.

1. Hover over the select drop down list.
2. Click on 'Option 2'
Result:crash

Talkback ID:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2704126Y

nsTableRowFrame::IR_TargetIsChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp,
line 1193]
nsTableRowFrame::IncrementalReflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp,
line 1119]
nsTableRowFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp,
line 1418]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsTableRowGroupFrame::IR_TargetIsChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp,
line 1646]
nsTableRowGroupFrame::IncrementalReflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp,
line 1324]
nsTableRowGroupFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp,
line 1230]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsTableFrame::IR_TargetIsChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 2978]
nsTableFrame::IncrementalReflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 2687]
nsTableFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp,
line 1947]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
nsTableOuterFrame::OuterReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1329]
nsTableOuterFrame::IR_InnerTableReflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1689]
nsTableOuterFrame::IR_TargetIsInnerTableFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1443]
nsTableOuterFrame::IR_TargetIsChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1425]
nsTableOuterFrame::IncrementalReflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1394]
nsTableOuterFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 1953]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3427]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3427]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
CanvasFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLFrame.cpp,
line 549]
nsFrame::BoxReflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 5355]
nsFrame::DoLayout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 5095]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
nsGfxScrollFrameInner::LayoutBox 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1666]
nsXULScrollFrame::DoLayout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 580]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
nsXULScrollFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1031]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
ViewportFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsViewportFrame.cpp,
line 249]
IncrementalReflow::Dispatch 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 908]
PresShell::ProcessReflowCommands 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6254]
PresShell::FlushPendingNotifications 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 4972]
nsDocument::FlushPendingNotifications 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 4055]
nsHTMLDocument::FlushPendingNotifications 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1260]
nsComboboxControlFrame::ShowList 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/forms/nsComboboxControlFrame.cpp,
line 586]
nsComboboxControlFrame::RollupFromList 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/forms/nsComboboxControlFrame.cpp,
line 2256]
nsListControlFrame::MouseUp 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/forms/nsListControlFrame.cpp,
line 2476]
nsListEventListener::MouseUp 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/forms/nsListControlFrame.cpp,
line 3236]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1604]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2000]
nsHTMLSelectElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLSelectElement.cpp,
line 1793]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2029]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5917]
PresShell::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5772]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2404]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2129]
HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1102]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5387]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5638]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1383]
USER32.dll + 0x27b17 (0x77d37b17)
USER32.dll + 0x2cdce (0x77d3cdce)
Attached file Testcase — 

    
    

    
  
The patch in bug 269566 may well fix this... (or at least it will fix this exact
crash, but there may be more crashes around after that).
Depends on: 269566

    
    

    
  

      
      
      
      

        Attached file
          
        Similar testcase
        — 
      

    


  
The patch in bug 269566 fixed the crash that was reported here, but exposed
another one.  This testcase will recurse to death when it's loaded.

    
    

    
  


  
The problem was that while constructing anon kids we processed pseudo frames,
which stuck the pseudo cell frame we had wrapped around ourselves in our own
child list.  Then when we tried to restore state, we recursed to death.
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED

        Attachment #172377 -
        Flags: superreview?(roc)

        Attachment #172377 -
        Flags: review?(bernd_mozilla)

    
  
OS: Windows XP → All
Priority: -- → P1
Hardware: PC → All
Summary: Crash [@ nsTableRowFrame::IR_TargetIsChild] when clicking in drop down list, when changing from display:table-cell to display:inline → [FIX]Crash [@ nsTableRowFrame::IR_TargetIsChild] when clicking in drop down list, when changing from display:table-cell to display:inline
Target Milestone: --- → mozilla1.8beta

        Attachment #172377 -
        Flags: superreview?(roc) → superreview+

    
  

        Attachment #172377 -
        Flags: review?(bernd_mozilla) → review+

    
    

    
  
Fixed.

Status: ASSIGNED → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED

    
    

    
  
Both testcases at https://bugzilla.mozilla.org/attachment.cgi?id=169411 and
https://bugzilla.mozilla.org/attachment.cgi?id=172376 work fine for me now with
build 2005-02-02 on Windows XP, Seamonkey trunk.

Verified FIXED
Status: RESOLVED → VERIFIED

    
    

    
  
Checked in a crashtest for this.
Flags: in-testsuite+
Crash Signature: [@ nsTableRowFrame::IR_TargetIsChild]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: