Closed Bug 284122 Opened 20 years ago Closed 20 years ago

crash when switching between two page styles [@ 0x030ba95f - DoDeletingFrameSubtree ]

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Version:
1.7 Branch
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED DUPLICATE of bug 256108

People

(Reporter: bugmail-mozilla, Assigned: dbaron)

References

(
URL
)

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-CH; rv:1.7.6) Gecko/20050226 Firefox/1.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-CH; rv:1.7.6) Gecko/20050226 Firefox/1.0.1

Firefox and Mozilla crash when switching from the style "Moderne Fixe" to
"Geckozone" of the page http://extensions.geckozone.org/StylesheetChooserPlus/.

The crash was verified on Windows and Linux (couldn't try on Mac). It appears on
some other pages of this site, always when switching from the style "Moderne
Fixe" to the theme "Geckozone". Reverse switch (from Geckozone to moderne fixe)
doesn't crash. Switch from "Moderne" (not "fixe) to "Geckozone" also doesn't crash.

Reproducible: Always

Steps to Reproduce:
1. Go on the page http://extensions.geckozone.org/StylesheetChooserPlus
2. Select the style called "Moderne fixe" (via the menu "View" > "Page style")
3. Now select the theme "Geckozone"

Actual Results:  
Crash

Expected Results:  
Change the page style.

The theme "Moderne Fixe" is an alternate stylesheet of the page
(http://extensions.geckozone.org/styles/moderne_fixe.css), and "Geckozone" is
the main theme (http://extensions.geckozone.org/styles/geckozone.css).
The theme "Moderne fixe" looks like the theme "Moderne"
(http://extensions.geckozone.org/styles/moderne.css) who doesn't crash, it has
just a position:fixed menu and header.

This crash also appears on some other pages of the site, but not all. I was not
able to find what caused it exactly. Other switch combination doesn't crash.

The crash seems to append in all aviary builds (I'm using the latest), but trunk
builds doesn't.
I had the crash as well. 
(In reply to comment #1)
> I had the crash as well. 

win98se, mozilla 1.7.5


Xavier Robin: Could you provide Talkback incident ID of your crash?
Keywords: crash
The Feedback agent couldn't connect yesterday, but now it's ok : Tracback id
TB4010489Q
TB4010489Q:
0x030ba95f
DoDeletingFrameSubtree 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9161]
DeletingFrameSubtree 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9207]
nsCSSFrameConstructor::RemoveFixedItems 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 13325]
nsCSSFrameConstructor::RecreateFramesForContent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11368]
nsCSSFrameConstructor::ProcessRestyledFrames 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9877]
PresShell::ReconstructStyleData 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5315]
PresShell::EndUpdate 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 3557]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2034]
XPC_WN_GetterSetter 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1311]
js_Invoke 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/jsinterp.c,
line 949]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/jsinterp.c,
line 1043]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/jsinterp.c,
line 1086]
js_SetProperty 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/jsobj.c,
line 2852]
js_Interpret 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/jsinterp.c,
line 2179]
js_Invoke 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/jsinterp.c,
line 966]
nsXPCWrappedJSClass::CallMethod 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1436]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1516]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2841]
PresShell::HandleDOMEventWithTarget 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6139]
nsMenuFrame::Execute 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1671]
nsMenuFrame::HandleEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 454]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6103]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5921]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2326]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2066]
HandleEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsView.cpp,
line 77]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x8709 (0x77d18709)
USER32.dll + 0x87eb (0x77d187eb)
USER32.dll + 0x89a5 (0x77d189a5)
USER32.dll + 0x89e8 (0x77d189e8)
nsAppShell::Run 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppShellService::Run 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[c:/builds/tinderbox/Fx-1.0.1-aup-l10n/WINNT_5.1_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)
Summary: crash when switching between two page styles → crash when switching between two page styles [@ 0x030ba95f - DoDeletingFrameSubtree ]
I'm not sure why the version was marked as "Trunk", given that all the comments
are from users of Firefox 1.0.1, which is from the 1.7 branch and that this has
been fixed on the trunk since early October.

*** This bug has been marked as a duplicate of 256108 ***
Status: UNCONFIRMED → RESOLVED
Closed: 20 years ago
Resolution: --- → DUPLICATE
Sorry, I didn't see it was marked "trunk" when I filled the bug. But why didn't
this bug land on the branch ? If new relases of Firefox or Mozilla are going to
come, it would be a good idea to land it...
Status: RESOLVED → VERIFIED
Version: Trunk → 1.7 Branch
Sorry, I didn't see it was marked "trunk" when I filled the bug. But why didn't
this bug land on the branch ? If new relases of Firefox or Mozilla are going to
come, it would be a good idea to land it...
Crash Signature: [@ 0x030ba95f - DoDeletingFrameSubtree ]
You need to log in before you can comment on or make changes to this bug.