317724 - Crash [@ nsCSSFrameConstructor::FindPrimaryFrameFor] with evil testcase, using display: -moz-popup, isindex and more

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, Mozilla crashes when hovering over the testcase.

Talkback ID: TB12210582Y

0x01f25fe0
nsCSSFrameConstructor::FindPrimaryFrameFor  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11267]
nsFrameManager::GetPrimaryFrameFor  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsFrameManager.cpp, line 408]
nsCSSFrameConstructor::FindPrimaryFrameFor  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11237]
nsFrameManager::GetPrimaryFrameFor  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsFrameManager.cpp, line 408]
nsGenericHTMLElement::GetPrimaryFrameFor  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 2112]
nsHTMLInputElement::GetValue  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 594]
nsTextControlFrame::GetValue  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 3047]
nsTextControlFrame::InitEditor  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsTextControlFrame.cpp, line 1703]
nsCSSFrameConstructor::CreateAnonymousFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5969]
nsCSSFrameConstructor::CreateAnonymousFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5842]
nsCSSFrameConstructor::ConstructHTMLFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5777]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7930]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7819]
nsCSSFrameConstructor::CreateAnonymousFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5968]
nsCSSFrameConstructor::CreateAnonymousFrames  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5842]
nsCSSFrameConstructor::ConstructHTMLFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 5777]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7930]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7819]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11618]
nsCSSFrameConstructor::ConstructBlock  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12679]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6797]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7994]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7819]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11618]
nsCSSFrameConstructor::ConstructXULFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6486]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7936]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7819]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11618]
nsCSSFrameConstructor::ConstructTableCaptionFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3687]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6920]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7994]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7819]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11618]
nsCSSFrameConstructor::ConstructBlock  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12679]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6848]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7994]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7819]
nsCSSFrameConstructor::ProcessInlineChildren  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12924]
nsCSSFrameConstructor::ConstructInline  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12736]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6873]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7994]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7819]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11618]
nsCSSFrameConstructor::ConstructBlock  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12679]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6848]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7994]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7819]
nsCSSFrameConstructor::ContentInserted  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9446]
nsCSSFrameConstructor::ReinsertContent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9557]
nsCSSFrameConstructor::ContentInserted  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9466]
nsCSSFrameConstructor::RecreateFramesForContent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11498]
nsCSSFrameConstructor::RestyleElement  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10377]
nsCSSFrameConstructor::ProcessOneRestyle  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13211]
nsCSSFrameConstructor::ProcessPendingRestyles  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13259]
nsCSSFrameConstructor::RestyleEvent::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13324]
SHELL32.dll + 0x520c24 (0x778b0c24)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Andrew Schultz]

crashes on linux too
regressed between linux seamonkey trunk builds 2005-08-16-05 and 2005-08-17-01

Comment 3

[Bernd]

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-08-16+05%3A00%3A00&maxdate=2005-08-17+01%3A00%3A00&cvsroot=%2Fcvsroot

bug 265367 or bug 289377 come into mind

Comment 4

[Boris Zbarsky [:bzbarsky]]

The patch for bug 306940 seems to fix this for me.

Comment 5

[Martijn Wargers (dead)]

Yes, this seems fixed. Fixed by bug 306940.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on trunk using https://bugzilla.mozilla.org/attachment.cgi?id=204144&action=view as a testcase under SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Mozilla/1.0