309364 - crash on this site

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[BlackHalt]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7

http://cu.serveris.lv/files/test.php
page code:
<?xml version="1.0"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" 
       
onload="document.getElementById('x').showPopup(document.getElementById('y'), -1,
-1, 'popup', 'bottomleft', 'topleft')">
<textbox id="y" />
<popup id="x">
<listbox>
</listbox>
</popup>
</window>

Reproducible: Always

Steps to Reproduce:
1.Click on http://cu.serveris.lv/files/test.php or type in adressbar.
2.Firefox crash and shuting down.
Actual Results:  
code crash Firefox

Comment 1

[Ryan Flint [:rflint] (ping via IRC for reviews)]

I can confirm this for 1.0.7 (Talkback ID: TB9554042K), but it no longer exists
in  Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20050920
Firefox/1.4

Comment 2

[Ria Klaassen (not reading all bugmail)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050920
Firefox/1.6a1 ID:2005092008

It crashes in 1.0.6 but not in the current trunk and branch builds.

Comment 3

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b5) Gecko/20050920
Firefox/1.4 ID:2005092011

WFM

resolving, this won't get into 1.0.7 or any 1.0.X i guess

Comment 4

[timeless]

Incident ID: 9554042 
Stack Signature nsView::GetDimensions a038d188 
Product ID Firefox10 
Build ID 2005091410 
Trigger Time 2005-09-20 12:48:19.0 
Platform Win32 
Operating System Windows NT 5.1 build 2600 
Module firefox.exe + (001e329f) 
URL visited  
User Comments  
Since Last Crash 728 sec 
Total Uptime 728 sec 
Trigger Reason Access violation 
Source File, Line No. c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/view/src/nsView.h, line 248 
Stack Trace  

nsView::GetDimensions  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/view/src/nsView.h, line 248]
nsView::GetClippedRect  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 839]
nsViewManager::UpdateView  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1761]
nsViewManager::MoveViewTo  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2603]
nsContainerFrame::PositionFrameView  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, 
line 510]
nsContainerFrame::PositionChildViews  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, 
line 1020]
nsSprocketLayout::Layout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, 
line 517]
nsContainerBox::DoLayout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, 
line 610]
nsBox::Layout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsBox::Layout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsContainerBox::DoLayout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, 
line 610]
nsBox::Layout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsContainerBox::DoLayout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, 
line 610]
nsBox::Layout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsBox::Layout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsContainerBox::DoLayout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, 
line 610]
nsBox::Layout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsContainerBox::DoLayout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, 
line 610]
nsBox::Layout  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsRootBoxFrame::Reflow  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, 
line 240]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, 
line 982]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp, 
line 249]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 
904]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 
6401]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 
6226]
PL_HandleEvent  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/xpcom/threads/plevent.c, line 674]
0x778b0c24
nsMathMLChar::Stretch  [c:/builds/tinderbox/Fx-
Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/mathml/base/src/nsMathMLChar.cpp, 
line 1611]
0x26eb8007