338674 - Crash [@ nsCSSFrameConstructor::ConstructFrame] involving DOMAttributeModified event and some xul:nativescrollbar (!)

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Loading the testcase makes Firefox crash.  Tested with Firefox trunk 2006-05-17 on Mac.

I'm not sure why a DOMAttributeModified event is fired here at all.  It seems to be fired at a <xul:nativescrollbar> element for an "orient" attribute and a "sborient" attribute.  In fact, I don't know if XHTML pages are supposed to know about our scrollbar implementation at all.

Comment 1

[Jesse Ruderman]

Attachment: testcase - further DOM mutations (crashes Firefox)

Comment 2

[Jesse Ruderman]

Attachment: stack trace (mac debug)

Comment 3

[Jesse Ruderman]

Attachment: testcase - close the window during the event

Comment 4

[Jesse Ruderman]

Attachment: testcase - alert() during the event

Comment 5

[Jesse Ruderman]

All three testcases cause crashes, but with different signatures.  I'm assuming the root cause is the same.

The alert one also causes

###!!! ASSERTION: reflowing in the middle of frame construction: 'mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0', file ../../dist/include/layout/nsPresContext.h, line 833
###!!! ASSERTION: painting in the middle of frame construction: 'mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0', file ../../dist/include/layout/nsPresContext.h, line 825

Comment 6

[Jesse Ruderman]

Attachment: stack trace: nsIFrame::GetContent, nsGfxScrollFrameInner::SetCoordAttribute, ...

Comment 7

[Jesse Ruderman]

Attachment: stack trace: nsCachedStyleData::GetStyleData

Comment 8

[Jesse Ruderman]

[sg:critical] based on the last two stack traces.

CCing dbaron because he loves "painting in the middle of frame construction" (etc) bugs.

Comment 9

[Jesse Ruderman]

WFM, the event doesn't seem to be firing any more.  Sicking thought the fix for bug 328885 might have been what fixed this, but that was fixed before this was filed.

Comment 10

[Jesse Ruderman]

This bug went away between June 1 and June 2 (Mac nightlies).  Could this have been fixed by the patch for bug 90983, "Why check for mutationlisteners during initial page load?"?

Comment 11

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Yes, it is not unlikely that that bug fixed it.

Comment 12

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

But I am supriced bug 328885 didn't fix it, i need to investigate further.

Comment 13

[Jesse Ruderman]

Marking WFM.  I filed bug 345952 for the investigation mentioned in comment 12.

Comment 14

[Jesse Ruderman]

Checked in the first testcase as a crashtest.  The other testcases are too disruptive for easy automated testing.