283142 - Crash [@ nsTableRowFrame::GetFirstCell] using menupopup:hover{display:table-cell} in evil testcase

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

See Talkback ID: TB3857567W

nsTableRowFrame::GetFirstCell 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/tables/nsTableRowFrame.cpp,
line 335]
TableBackgroundPainter::PaintRowGroup 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/tables/nsTablePainter.cpp,
line 506]
TableBackgroundPainter::PaintTable 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/tables/nsTablePainter.cpp,
line 456]
nsTableFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/tables/nsTableFrame.cpp,
line 1392]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 305]
nsTableOuterFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp,
line 334]
nsBoxFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1478]
nsBoxFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1604]
nsBoxFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1427]
nsBoxFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1478]
nsBoxFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1604]
nsBoxFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1427]
nsBoxFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1478]
nsBoxFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1604]
nsBoxFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1427]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 305]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 229]
nsContainerFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 210]
PresShell::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5473]
nsView::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
316]
nsViewManager::RenderDisplayListElement 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1467]
nsViewManager::RenderViews 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1382]
nsViewManager::Refresh 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 945]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2023]
HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1114]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3947]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1400]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4750 (0x77e14750)
USER32.dll + 0x55b0 (0x77e155b0)
ntdll.dll + 0x1ff57 (0x77f9ff57)
USER32.dll + 0x1e6c5 (0x77e2e6c5)
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4158]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1400]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 145]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
KERNEL32.DLL + 0x2893d (0x7c59893d)

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

To reproduce crash with testcase:
- click on "Click on me"
- Hover over the "Hover over me" menuitems
- Click another time on "Click on me".
- Hover again over the "Hover over me" menuitems
Approximately at that step it should have crashed Mozilla by now :)

Comment 2

[Martijn Wargers (dead)]

Doesn't crash with:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a4) Gecko/2004092805
Crashes with:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a5) Gecko/2004092905
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-09-28+05%3A00%3A00&maxdate=2004-09-29+06%3A00%3A00&cvsroot=%2Fcvsroot
Maybe a regression from bug 258513?

Also a difference between before and after is that "Click on me" is not
returning to it's old spot after hovering over the menuitems.

Comment 3

[Boris Zbarsky [:bzbarsky]]

XUL menupopups do all sorts of broken stuff... probably not even worth looking
into this until we make them stop doing it.

Comment 4

[Bernd]

the patch in bug 311661 while not perfect but does fix this bug

Comment 5

[Martijn Wargers (dead)]

Indeed, the testcase doesn't crash anymore. This can be marked fixed, I presume?

Comment 6

[Boris Zbarsky [:bzbarsky]]

Yeah, fixed by bug 311661.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED with SeaMonkey 1.1a;Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.9a1) Gecko/20051013 Mozilla/1.0