347853 - Crash [@ nsIView::Destroy] with fixed and relative positioned quote elements and removing styles

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes Mozilla when loading it.
This regressed between 2006-07-04 and 2006-07-05.
The only patch that could be responsible for the crash is the patch from bug 343540, I think.

Talkback ID: TB21894378Q
0x00000000
nsIView::Destroy  

Marking security sensitive, I guess.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Uri Bernstein]

Attachment: simplified testcase

This testcase crashes for me consistently after refreshing once (it does not auto-refresh).
It does not contain <q> elements, and the <blockquote> is replaced with a <div>. Also, only the style on the <dd> is removed.

With this testcase, upon the initial load, I get the following assertion:
###!!! ASSERTION: Allowed only one anonymous view between frames: 'ancestorView == view->GetParent()->GetParent()', file /Users/urib/mozilla/layout/generic/nsContainerFrame.cpp, line 268

(I do not get this assertion with the original testcase).

Comment 3

[Uri Bernstein]

So, this look similar to bug 329762. Somewhere, some view is probably not getting reparented correctly. Now to find out where...

Comment 4

[Uri Bernstein]

Attachment: one option

This re-parents the views on the new frame(s), if we decide it's going to have a different parent. As far as I can tell, it fixes the bug.

Alternatively (and perhaps better), we might be able to create the new frame with the correct parent to begin with. This means pushing the logic for finding the last continuation of the :before pseudo-element upwards, to before where we create the new frame. It kind of scares me, so I'll try to do it only if it is really considered a better approach.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 232716 [details] [diff] [review]
one option

Let's do this for now, it's more branch-friendly.

Comment 6

[Uri Bernstein]

Checked in, but mentioned the wrong bug number (bug 343540) in the checkin comment.
Checking in layout/base/nsCSSFrameConstructor.cpp;
/cvsroot/mozilla/layout/base/nsCSSFrameConstructor.cpp,v  <--  nsCSSFrameConstructor.cpp
new revision: 1.1248; previous revision: 1.1247
done