290240 - XUL listbox in popup makes firefox crash [@ nsView::GetDimensions]

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Thomas Borg Salling]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

This xul code makes my firefox crash:

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<?xml-stylesheet href="sofrelog.css" type="text/css"?>

<window id="DetailForm"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
xmlns:html="http://www.w3.org/1999/xhtml" debug="false">
    <vbox>
        <textbox id="TEST" editable="true" popup="TEST_popup" />
        <popup id="TEST_popup">
            <listbox row="5" /> 
        </popup>
    </vbox>
</window>


Reproducible: Always

Steps to Reproduce:
1. Point firefox to a page with the shown xul code.
2. Crash!
3.

Actual Results:  
Firefox crashes, and automatically submits crash/incident report via the internet.

Expected Results:  
Display a listbox in a popup window.

Comment 1

[Steve England [:stevee]]

Reporter, in your /firefox/components/ directory, please run talkback.exe and
report what talkback ID's you submitted for the crash.

Comment 2

[Thomas Borg Salling]

One of the submitted incidents has id TB5070218H.

In the example above "row" should be "rows" in the listbox element, but that
doesn't change the behaviour.

Comment 3

[Martijn Wargers (dead)]

From Talkback ID:
nsView::GetDimensions 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.h,
line 248]
nsView::GetClippedRect 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 839]
nsViewManager::UpdateView 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1761]
nsViewManager::MoveViewTo 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2608]
nsContainerFrame::PositionFrameView 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 510]
nsContainerFrame::PositionChildViews 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 1020]
nsSprocketLayout::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 517]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsRootBoxFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp,
line 240]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 249]
IncrementalReflow::Dispatch 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 904]
PresShell::ProcessReflowCommands 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6401]
ReflowEvent::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6226]
PL_HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
0x778b0c24
nsEncoderNodeFixup::FixupNode 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp,
line 3709]

Comment 4

[Martijn Wargers (dead)]

Attachment: Testcase

Testcase from reporter works for me with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050412
Firefox/1.0+
Reporter, could try also with the latest nightly trunk build?
http://ftp.scarlet.be/pub/mozilla.org/firefox/nightly/latest-trunk/

Comment 5

[Steve England [:stevee]]

Testcase crashes with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-GB; rv:1.7.6)
Gecko/20050321 Firefox/1.0.2

Testcase does not crash with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.8b2) Gecko/20050413 Firefox/1.0+

Comment 6

[Martijn Wargers (dead)]

Ok, marking WFM. If someone can reproduce this in today's trunk builds, then
please reopen.

Comment 7

[Thomas Borg Salling]

I can confirm, that testcase does not crash on
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050412
Firefox/1.0+

Thanks.

Comment 8

[Thomas Borg Salling]

When is the next formal firefox release that does not have this bug?

Comment 9

[Nickolay_Ponomarev]

1.1, summer 2005