Closed Bug 275896 Opened 20 years ago Closed 20 years ago

Crash [@ nsIFrame::GetParentBox] when opening testcase with display:-moz-grid-line

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: neil)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

Testcase (crashes when opening)
220 bytes, text/html
Details
Null checks
1.05 KB, patch
bzbarsky
: review+
bzbarsky
: superreview+
Details | Diff | Splinter Review 
See testcase:
<html><head></head>
<body>
<span style="display:-moz-grid-line;">Mozilla should not crash with this
testcase</span>
</body></html>

I really don't have an idea, what display:-moz-grid-line is, but I guess it
should not crash Mozilla.

The crash occurs on my recent trunk nighlty build.

Talkback ID: 
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2728033Y

nsIFrame::GetParentBox 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 624]
nsGridRowLeafLayout::ComputeChildSizes 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 323]
nsSprocketLayout::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 279]
nsBoxFrame::DoLayout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1099]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsLineLayout.cpp,
line 1002]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 4119]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3809]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3698]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2723]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 3427]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp,
line 835]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
CanvasFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLFrame.cpp,
line 549]
nsFrame::BoxReflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 5355]
nsFrame::DoLayout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 5095]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
nsGfxScrollFrameInner::LayoutBox 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1666]
nsXULScrollFrame::DoLayout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 580]
nsIFrame::Layout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 805]
nsXULScrollFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1031]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 972]
ViewportFrame::Reflow 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsViewportFrame.cpp,
line 249]
IncrementalReflow::Dispatch 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 908]
PresShell::ProcessReflowCommands 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6254]
ReflowEvent::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6083]
PL_HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 693]
SHELL32.dll + 0x520c24 (0x778b0c24)
Confirmed in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6)
Gecko/20041223 Firefox/1.0+
Severity: normal → critical
Usual issue with XUL layout making assumptions about things.

Neil has a patch that fixes a bunch of these, iirc, but I can't find the bug
it's in....
I can confirm that my build does not crash on the given test case.
But I have no idea what I might have changed to fix it :-/
Ah, I was thinking of bug 271945, but that wouldn't fix this.

I'd try doing a diff of layout/xul and layout/base/nsCSSFrameConstructor in your
tree and seeing what turns up.  Let's get these null-checks in for now, pending
further work on defining interaction of XUL with stuff.
Attached patch Null checks — — Splinter Review 
Doh, layout/xul/base/src/grid/ of course :-[
Assignee: nobody → neil.parkwaycc.co.uk
Status: NEW → ASSIGNED
Attachment #172425 - Flags: superreview?(bzbarsky)
Attachment #172425 - Flags: review?(bzbarsky)
Comment on attachment 172425 [details] [diff] [review]
Null checks

r+sr=bzbarsky
Attachment #172425 - Flags: superreview?(bzbarsky)
Attachment #172425 - Flags: superreview+
Attachment #172425 - Flags: review?(bzbarsky)
Attachment #172425 - Flags: review+
Fix checked in.
Status: ASSIGNED → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
Verified FIXED using the testcase at
https://bugzilla.mozilla.org/attachment.cgi?id=169502 with the 2005-01-28-04
build of Seamonkey trunk on Windows XP.
Status: RESOLVED → VERIFIED
Still seeing this on the Aviary 1.0.x builds, looks like this never made it onto that branch.  The testcase here and in bug 313173 are reliably reproducible with current 1.0.8 builds.  If we can get these simple null checks in for 1.0.9, it'll be nice to get rid of this crash for good everywhere.
Flags: blocking-aviary1.0.9?
Flags: blocking1.7.14?
Crash Signature: [@ nsIFrame::GetParentBox]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: