291022 - Crash with generated iframe inside br and display:none - Trunk [@ nsView::GetDimensions]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

The testcase which I'll attach, crashes current trunk build of Mozilla for me.
It doesn't crash with 2004-08-09 build, it crashes with 2004-08-10 build, so
this could very well be a regression from bug 230170.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

The crash doesn't always happen the first time. 
Then do a refresh and click again on the button in the testcase.
Normally the crash should happen within 5 times trying.

Comment 2

[Martijn Wargers (dead)]

Attachment: Backtrace

Backtrace from my recent debug build.

Comment 3

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050419
Firefox/1.0+
TB5208517H from the attached testcase, if it helps.
FWIW I couldn't get the testcase to crash no matter how much I mashed the 'click
me' - but I crashed when I closed the tab.

Comment 4

[Martijn Wargers (dead)]

Attachment: Testcase2 (using select instead of iframe)

The similar seems to happen when using the <select> element instead of
<iframe>.
Just to be sure it is understood, I'm repeating it: when it is not crashing
directly, you have to reload and then push the button.

Comment 5

[Jay Patel [:jay]]

Adding topcrash+ keyword since a couple of users have been able to succesfully
reproduce this and we have an idea of what the regression window is.   It's been
around for a while, so hopefully we can get some traction on this and get it fixed.

Comment 6

[Boris Zbarsky [:bzbarsky]]

I can't get my debug build to crash here (though my optimized build does crash).

In any case, I rather doubt there's a simple fix, but I bet that fixing bug
265367 will help.

Jay, if this is a real topcrash I can try to cobble something together for 1.8,
but only if it's a real topcrash.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Fixed by checkin for bug 265367.

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1)
Gecko/20050818 Mozilla/1.0

testcases:

https://bugzilla.mozilla.org/attachment.cgi?id=181206 and
https://bugzilla.mozilla.org/attachment.cgi?id=181189

Reloaded both numerous times as well as clicking on each button multiple times.
 Not crashing any longer.