310505 - Evil testcase using drop down list crashes Mozilla [@ nsCachedStyleData::GetStyleData]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase.
Hovering over the drop down list should not crash Mozilla, but it crashes for me
in 2005-09-28 trunk build.
Talkback ID: TB9876033K

Surprisingly, it doesn't crash Mozilla1.7. I'll look for the regression range.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Actually, this is a recent regression.
Testcase doesn't crash with 2005-09-20 build, but crashes with 2005-09-21 build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-09-20+06%3A00%3A00&maxdate=2005-09-21+08%3A00%3A00&cvsroot=%2Fcvsroot
Most likely a fall-out from bug 117984

Comment 3

[Boris Zbarsky [:bzbarsky]]

Either that or maybe bug 307277...

Mats, could you check this out?

Comment 4

[Jesse Ruderman]

This might be a dup of bug 310426.

Comment 5

[Bernd]

Backing out the patch for bug 117984 does fix the testcase here. Backing out bug 307277 does not fix this.

Comment 6

[Adam Guthrie]

Attachment: stacktrace from testcase

Comment 7

[Adam Guthrie]

Fixed by the patch for bug 315752.

Comment 8

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051220 Firefox/1.6a1