284252 - Crash using tree:hover,treecols:hover{display:inline;} with evil xul testcase

Status: VERIFIED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

The following testcase makes Mozilla crash when hovering over the text.
I couldn't make a testcase without using :hover rules (e.g. using
tree,treecols{display:inline;} as style doesn't crash directly).
This testcase also makes Mozilla1.0 crash, so this is not a (recent) regression.

Talkback ID: 4030637

nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 243]
nsBlockFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h,
line 258]
nsBlockFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 6008]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp,
line 139]
nsBlockFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 5835]
nsBoxFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1481]
nsBoxFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1607]
nsBoxFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1430]
nsBoxFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1481]
nsBoxFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1607]
nsBoxFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1430]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 305]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 229]
nsContainerFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 210]
PresShell::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5474]
nsView::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
316]
nsViewManager::RenderDisplayListElement 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1467]
nsViewManager::RenderViews 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1382]
nsViewManager::Refresh 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 945]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2023]
HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1127]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3981]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1419]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4750 (0x77e14750)
USER32.dll + 0x55b0 (0x77e155b0)
ntdll.dll + 0x1ff57 (0x77f9ff57)
USER32.dll + 0x1e6c5 (0x77e2e6c5)
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4195]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1419]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 145]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
KERNEL32.DLL + 0x2893d (0x7c59893d)

Possibly related bugs (at least they crash at the same line): bug 234062, bug
265973 and bug 275560.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Comment 2

[Xanthor Sccas]

(Confirm on GNU/Linux with Moz 1.8b1 : TB4046165Z)

Comment 3

[Boris Zbarsky [:bzbarsky]]

Usual deal.  Have asserts:

###!!! ASSERTION: uh oh. the block we need to reframe has no parent!: 'Error',
file /home/bzbarsky/mozilla/xlib/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 13096
###!!! ASSERTION: no frame to paint!: 'aFrame', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/generic/nsContainerFrame.cpp, line 242

Then crash because there is a null frame in the line.  The first assertion is
where things really go wrong; it comes up in some of the other XUL frame
construction bugs too.

Comment 4

[Ronald Tilby]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050905
Firefox/1.6a1
Testcase WFM

Comment 5

[Martijn Wargers (dead)]

Yes, this is WFM with current trunk build.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified for me too with build 2005-09-04-06 on Windows XP SeaMonkey trunk.