275917 - td:hover {display:block} causes crash on reload when animated gif inside [@ nsIFrame::Invalidate ]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase.

Talkback ID:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2731125X
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2731009K

nsIFrame::Invalidate 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 2509]
nsImageFrame::FrameChanged 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsImageFrame.cpp,
line 715]
nsImageListener::FrameChanged 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsImageFrame.cpp,
line 2139]
imgRequest::FrameChanged 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/modules/libpr0n/src/imgRequest.cpp,
line 370]
nsTimerImpl::Fire 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 396]
nsAppStartup::Run 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 147]
main 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x1eb69 (0x77e5eb69)

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Comment 2

[Mats Palmgren (inactive)]

Attachment: Crash data

When hovering the image:

###!!! ASSERTION: can't find deleted frame in lines: 'Error', file
nsBlockFrame.cpp, line 5255
Break: at file nsBlockFrame.cpp, line 5255

Comment 3

[Boris Zbarsky [:bzbarsky]]

Fixed by patch for bug 271422 (same exact situation as that bug, and losing the
image frame would cause exactly this crash).

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using build 2005-01-26-06 on this testcase:
https://bugzilla.mozilla.org/attachment.cgi?id=169515

with Windows XP Seamonkey trunk.