34893 - dynamically created SELECT appears twice

Status: VERIFIED WORKSFORME

(Core :: Layout: Form Controls, defect, P2)

Description

[Myk Melez [:myk] [@mykmelez]]

Overview Description:

A pull-down (SELECT) menu created via JavaScript DOM methods appears twice.
Clicking on either appearance of the menu pulls down the second one.  Here's the
code that causes the problem (test case will be attached):

	foo = document.createElement('select');

	bar = document.createElement('option');
	bar.setAttribute('value', 'is');
	bar.setAttribute('label', 'this');
	foo.appendChild(bar);

	bar = document.createElement('option');
	bar.setAttribute('value', 'at');
	bar.setAttribute('label', 'that');
	foo.appendChild(bar);

	document.body.appendChild(foo);


Actual Results:

menu appears twice

Expected Results:

menu appears once

Build Date & Platform Bug Found:

Linux 2000-04-06

Additional Builds and Platforms Tested On:

Linux M14

Comment 1

[Myk Melez [:myk] [@mykmelez]]

Attachment: test case

Comment 2

[rods (gone)]

Jst, look at the source of the attachment, is this legal script? I didn't think 
it was legal to have a section of script inside the body tag that modified the 
document. I did the same example with an "onload" handler and it worked fine.

Of coarse, maybe we shouldn't be doing what we are doing (creating two selects, 
that is still probably a bug.  Also, if it is illegal to have script in the body 
that modifies the body why are we executing it?

Comment 3

[Johnny Stenback (:jst)]

I would love to say that scripts that modify the document are not legal, and
that really would simplify things a *lot*. However, to my knowledge no such
decision has been made for mozilla.

This brings up a really interesting issue tho, regardless of what is/has been
decided fixing this is to my knowledge quite complicated, either we haveto teach
the content sink how to deal with things possibly changin underneath it's feet
while scripts are running or we'd haveto add tests all over the place to check
if the document is currently "modifyable" when executing scripts, to my
knowledge there's no easy way to tell if the script will modify the body
element...

Rods, please fix (assuming the bug is in the frame code) the issue with two
selects (in your modified testcase), I'll open a separate bug on the "script in
the body" issue.

Comment 4

[rods (gone)]

I think I remember talking to rickg about this issue a while back because of a 
similar bug and I think I remember him saying it was illegal.

Comment 5

[rickg]

If the question is whether it's legal for a script to modify the document in 
which it is contained, the answer is yet. In this case your script appears to be 
creating the same element twice. I would expect a javascript error on the 
console at a minimum -- but otherwise it appears ok to me. 

Comment 6

[Myk Melez [:myk] [@mykmelez]]

Rickg: The code does create two OPTION elements, but it never creates the same

thing twice, it just reuses the variable name ("bar") for each new element (thus

dereferencing the previous object and referencing the new object).



Here is some code with a different variable name for each created element for

clarity which exhibits the same problem.



	bar = document.createElement('option'); // a new OPTION element

	bar.setAttribute('value', 'is');

	bar.setAttribute('label', 'this');



	baz = document.createElement('option'); // a different OPTION

	baz.setAttribute('value', 'at');

	baz.setAttribute('label', 'that');



	foo = document.createElement('select'); // a new SELECT element



	foo.appendChild(bar); // add first OPTION to SELECT

	foo.appendChild(baz); // add second OPTION to SELECT



	document.body.appendChild(foo); // add SELECT to document

Comment 7

[rickg]

*** Bug 34999 has been marked as a duplicate of this bug. ***

Comment 8

[Myk Melez [:myk] [@mykmelez]]

Eric Krock had this to say in bug 9136:

--
Moving to M16. In general, JavaScript should not try to access the contents of a
page while the page is still loading because there are not guarantees what state
the page is in. JS that accesses page contents should do so from within the
onload event handler at the earliest. This is inherently risky JS. Therefore,
moving to M17 as low priority.
--

Comment 9

[rods (gone)]

I have a fix in my tree. The setting of the default selected item needs to be 
delayed.

Comment 10

[rods (gone)]

oops, wrong but this isn't fixed in my tree

Comment 11

[rods (gone)]

*** Bug 34902 has been marked as a duplicate of this bug. ***

Comment 12

[rods (gone)]

Wow, I didn't fix this either, at least not that I knew of - fixed

Comment 13

[Myk Melez [:myk] [@mykmelez]]

Verified fixed on Linux 2000-04-21-08

Comment 14

[Myk Melez [:myk] [@mykmelez]]

This bug is back in Linux 2000-05-27-20.

Comment 15

[rods (gone)]

Jst, this bug magically fixed itself and now it is back. Could you take a look?

Comment 16

[Johnny Stenback (:jst)]

Not exactly sure on what's going on here but it would be good to get this
under control for beta3.

Comment 17

[ekrock's old account (dead)]

correctness of DOM1 implementation and ability to dynamically create documents.

Comment 18

[Nisheeth Ranjan]

Re-assigning to rods because jst is overloaded with nsbeta3+ bugs.  Rod, please 
triage this according to your group's priorities.  Thanks.

Comment 19

[rods (gone)]

This looks like a content sink or content model issue. Here is the call stack 
the first time the combobox frame gets created:

NS_NewComboboxControlFrame(nsIPresShell * 0x027074c0, nsIFrame * * 0x0012dfe0, 
unsigned int 65536) line 103
nsCSSFrameConstructor::ConstructSelectFrame(nsIPresShell * 0x027074c0, 
nsIPresContext * 0x02731060, nsFrameConstructorState & {...}, nsIContent * 
0x02a57b1c, nsIFrame * 0x0115d188, nsIAtom * 0x01964d00 {"select"}, 
nsIStyleContext * 0x02a59c00, nsIFrame * & 0x00000000, int & 0, int 0, int & 0, 
int 0, nsFrameItems & {...}) line 4043 + 17 bytes
nsCSSFrameConstructor::ConstructFrameByTag(nsIPresShell * 0x027074c0, 
nsIPresContext * 0x02731060, nsFrameConstructorState & {...}, nsIContent * 
0x02a57b1c, nsIFrame * 0x0115d188, nsIAtom * 0x01964d00 {"select"}, int 3, 
nsIStyleContext * 0x02a59c00, nsFrameItems & {...}) line 4930 + 63 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x027074c0, 
nsIPresContext * 0x02731060, nsFrameConstructorState & {...}, nsIContent * 
0x02a57b1c, nsIFrame * 0x0115d188, nsIAtom * 0x01964d00 {"select"}, int 3, 
nsIStyleContext * 0x02a59c00, nsFrameItems & {...}, int 0) line 7541 + 44 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x027074c0, nsIPresContext 
* 0x02731060, nsFrameConstructorState & {...}, nsIContent * 0x02a57b1c, nsIFrame 
* 0x0115d188, nsFrameItems & {...}) line 7467 + 56 bytes
nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x02701e00, 
nsIPresContext * 0x02731060, nsIContent * 0x0270a118, nsIContent * 0x02a57b1c, 
int 6, nsILayoutHistoryState * 0x00000000) line 8681 + 46 bytes
StyleSetImpl::ContentInserted(StyleSetImpl * const 0x02701ec0, nsIPresContext * 
0x02731060, nsIContent * 0x0270a118, nsIContent * 0x02a57b1c, int 6) line 1147
PresShell::ContentInserted(PresShell * const 0x027074c8, nsIDocument * 
0x0270e330, nsIContent * 0x0270a118, nsIContent * 0x02a57b1c, int 6) line 3443 + 
50 bytes
nsDocument::ContentInserted(nsDocument * const 0x0270e330, nsIContent * 
0x0270a118, nsIContent * 0x02a57b1c, int 6) line 1893
nsHTMLDocument::ContentInserted(nsHTMLDocument * const 0x0270e330, nsIContent * 
0x0270a118, nsIContent * 0x02a57b1c, int 6) line 1269
nsGenericHTMLContainerElement::InsertChildAt(nsIContent * 0x02a57b1c, int 6, int 
1) line 3457
nsHTMLBodyElement::InsertChildAt(nsHTMLBodyElement * const 0x0270a118, 
nsIContent * 0x02a57b1c, int 6, int 1) line 213 + 26 bytes
nsGenericElement::doInsertBefore(nsIDOMNode * 0x02a57b10, nsIDOMNode * 
0x00000000, nsIDOMNode * * 0x0012e870) line 2110 + 37 bytes
nsGenericHTMLContainerElement::AppendChild(nsIDOMNode * 0x02a57b10, nsIDOMNode * 
* 0x0012e870) line 442
nsHTMLBodyElement::AppendChild(nsHTMLBodyElement * const 0x0270a110, nsIDOMNode 
* 0x02a57b10, nsIDOMNode * * 0x0012e870) line 187 + 22 bytes
NodeAppendChild(JSContext * 0x026bc7f0, JSObject * 0x0120e9f8, unsigned int 1, 
long * 0x0116cfd8, long * 0x0012e920) line 570 + 25 bytes
js_Invoke(JSContext * 0x026bc7f0, unsigned int 1, unsigned int 0) line 716 + 23 
bytes
js_Interpret(JSContext * 0x026bc7f0, long * 0x0012f2d8) line 2517 + 15 bytes
js_Execute(JSContext * 0x026bc7f0, JSObject * 0x0113b2c8, JSScript * 0x02a50e20, 
JSFunction * 0x00000000, JSStackFrame * 0x00000000, unsigned int 0, long * 
0x0012f2d8) line 887 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x026bc7f0, JSObject * 0x0113b2c8, 
JSPrincipals * 0x027357a0, const unsigned short * 0x02a53990, unsigned int 243, 
const char * 0x02a53090, unsigned int 9, long * 0x0012f2d8) line 2770 + 27 bytes
nsJSContext::EvaluateString(nsJSContext * const 0x026bc1c0, const nsString & {"

        foo = document.createElement('select');

        bar = document.createElement('option');
        foo.appendChil"}, void * 0x0113b2c8, nsIPrincipal * 0x0273579c, const 
char * 0x02a53090, unsigned int 9, const char * 0x004fd468, nsString & {""}, int 
* 0x0012f334) line 525 + 55 bytes
HTMLContentSink::EvaluateScript(nsString & {"

        foo = document.createElement('select');

        bar = document.createElement('option');
        foo.appendChil"}, nsIURI * 0x026d7280, int 9, const char * 0x004fd468) 
line 4523
HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode & {...}) line 4860
HTMLContentSink::AddLeaf(HTMLContentSink * const 0x0272ab60, const nsIParserNode 
& {...}) line 3053 + 12 bytes
CNavDTD::AddLeaf(const nsIParserNode * 0x02a55810) line 3497 + 22 bytes
CNavDTD::HandleScriptToken(const nsIParserNode * 0x02a55810) line 2042 + 12 
bytes
CNavDTD::OpenContainer(const nsIParserNode * 0x02a55810, nsHTMLTag 
eHTMLTag_script, int 1, nsEntryStack * 0x00000000) line 3175 + 12 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x01987900, nsHTMLTag eHTMLTag_script, 
nsIParserNode * 0x02a55810) line 1138 + 20 bytes
CNavDTD::HandleStartToken(CToken * 0x01987900) line 1562 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x0270e090, CToken * 0x01987390, nsIParser 
* 0x02724600) line 770 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x0270e090, nsIParser * 0x02724600, 
nsITokenizer * 0x02708890, nsITokenObserver * 0x00000000, nsIContentSink * 
0x0272ab60) line 499 + 20 bytes
nsParser::BuildModel() line 1983 + 34 bytes
nsParser::ResumeParse(int 1, int 0) line 1864 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x02724608, nsIChannel * 0x026d7130, 
nsISupports * 0x00000000, nsIInputStream * 0x026d761c, unsigned int 0, unsigned 
int 491) line 2314 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x026d7390, 
nsIChannel * 0x026d7130, nsISupports * 0x00000000, nsIInputStream * 0x026d761c, 
unsigned int 0, unsigned int 491) line 251 + 46 bytes
nsResChannel::OnDataAvailable(nsResChannel * const 0x026d7134, nsIChannel * 
0x026d7eb0, nsISupports * 0x00000000, nsIInputStream * 0x026d761c, unsigned int 
0, unsigned int 491) line 735
nsFileChannel::OnDataAvailable(nsFileChannel * const 0x026d7eb8, nsIChannel * 
0x026d7b90, nsISupports * 0x00000000, nsIInputStream * 0x026d761c, unsigned int 
0, unsigned int 491) line 658 + 49 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x026f9cc0) 
line 400 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x026f9c70) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x026f9c70) line 587 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x018ec4e0) line 528 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00671518, unsigned int 49427, unsigned int 0, 
long 26133728) line 1043 + 9 bytes
USER32! 77e71820()


Here is the call stack when the second combobox frame gets created:

NS_NewComboboxControlFrame(nsIPresShell * 0x027074c0, nsIFrame * * 0x0012b484, 
unsigned int 65536) line 103
nsCSSFrameConstructor::ConstructSelectFrame(nsIPresShell * 0x027074c0, 
nsIPresContext * 0x02731060, nsFrameConstructorState & {...}, nsIContent * 
0x02a57b1c, nsIFrame * 0x0115d188, nsIAtom * 0x01964d00 {"select"}, 
nsIStyleContext * 0x02a59c00, nsIFrame * & 0x00000000, int & 0, int 0, int & 0, 
int 0, nsFrameItems & {...}) line 4043 + 17 bytes
nsCSSFrameConstructor::ConstructFrameByTag(nsIPresShell * 0x027074c0, 
nsIPresContext * 0x02731060, nsFrameConstructorState & {...}, nsIContent * 
0x02a57b1c, nsIFrame * 0x0115d188, nsIAtom * 0x01964d00 {"select"}, int 3, 
nsIStyleContext * 0x02a59c00, nsFrameItems & {...}) line 4930 + 63 bytes
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x027074c0, 
nsIPresContext * 0x02731060, nsFrameConstructorState & {...}, nsIContent * 
0x02a57b1c, nsIFrame * 0x0115d188, nsIAtom * 0x01964d00 {"select"}, int 3, 
nsIStyleContext * 0x02a59c00, nsFrameItems & {...}, int 0) line 7541 + 44 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x027074c0, nsIPresContext 
* 0x02731060, nsFrameConstructorState & {...}, nsIContent * 0x02a57b1c, nsIFrame 
* 0x0115d188, nsFrameItems & {...}) line 7467 + 56 bytes
nsCSSFrameConstructor::ContentAppended(nsCSSFrameConstructor * const 0x02701e00, 
nsIPresContext * 0x02731060, nsIContent * 0x0270a118, int 6) line 8196
StyleSetImpl::ContentAppended(StyleSetImpl * const 0x02701ec0, nsIPresContext * 
0x02731060, nsIContent * 0x0270a118, int 6) line 1138
PresShell::ContentAppended(PresShell * const 0x027074c8, nsIDocument * 
0x0270e330, nsIContent * 0x0270a118, int 6) line 3416 + 46 bytes
nsDocument::ContentAppended(nsDocument * const 0x0270e330, nsIContent * 
0x0270a118, int 6) line 1873
nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x0270e330, nsIContent * 
0x0270a118, int 6) line 1249
HTMLContentSink::NotifyAppend(nsIContent * 0x0270a118, int 6) line 4353
SinkContext::FlushTags(int 1) line 1991
HTMLContentSink::BeginUpdate(HTMLContentSink * const 0x0272ab70, nsIDocument * 
0x0270e330) line 4430 + 16 bytes
nsDocument::BeginUpdate(nsDocument * const 0x0270e330) line 1761
nsGenericHTMLElement::UnsetAttribute(int 0, nsIAtom * 0x01968900 
{"-moz-option-selected"}, int 1) line 1515
nsHTMLOptionElement::UnsetAttribute(nsHTMLOptionElement * const 0x02a54768, int 
0, nsIAtom * 0x01968900 {"-moz-option-selected"}, int 1) line 99 + 26 bytes
nsListControlFrame::DisplayDeselected(nsIContent * 0x02a54768) line 990
nsListControlFrame::SetContentSelected(int 0, int 0) line 1702
nsListControlFrame::Deselect() line 1722
nsListControlFrame::Reset(nsIPresContext * 0x02731060) line 1828
nsListControlFrame::Reflow(nsListControlFrame * const 0x0115d674, nsIPresContext 
* 0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 486
nsContainerFrame::ReflowChild(nsIFrame * 0x0115d674, nsIPresContext * 
0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, 
int 0, unsigned int 21, unsigned int & 0) line 693 + 31 bytes
nsComboboxControlFrame::ReflowComboChildFrame(nsIFrame * 0x0115d674, 
nsIPresContext * 0x02731060, nsHTMLReflowMetrics & {...}, const 
nsHTMLReflowState & {...}, unsigned int & 0, int 1073741824, int 1073741824) 
line 631 + 44 bytes
nsComboboxControlFrame::Reflow(nsComboboxControlFrame * const 0x0115d588, 
nsIPresContext * 0x02731060, nsHTMLReflowMetrics & {...}, const 
nsHTMLReflowState & {...}, unsigned int & 0) line 1389
nsLineLayout::ReflowFrame(nsIFrame * 0x0115d588, nsIFrame * * 0x0012cec4, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 937
nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineLayout & 
{...}, nsLineBox * 0x0115d560, nsIFrame * 0x0115d588, unsigned char * 
0x0012c43c) line 4336 + 29 bytes
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & {...}, nsLineLayout & 
{...}, nsLineBox * 0x0115d560, int * 0x0012cab8, unsigned char * 0x0012c900, int 
0, int 1) line 4220 + 28 bytes
nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState & {...}, nsLineBox * 
0x0115d560, int * 0x0012cab8, unsigned char * 0x0012c900, int 0, int 1) line 
4156 + 42 bytes
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & {...}, nsLineBox * 
0x0115d560, int * 0x0012cab8, int 1, int 0) line 4101 + 32 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0115d560, int 
* 0x0012cab8, int 1) line 3236 + 29 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2925 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x0115d188, nsIPresContext * 
0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 1729 + 15 bytes
nsBlockReflowContext::DoReflowBlock(nsHTMLReflowState & {...}, nsReflowReason 
eReflowReason_Incremental, nsIFrame * 0x0115d188, const nsRect & {x=0 y=0 
width=9180 height=1073741824}, int 1, int 0, int 1, nsMargin & {top=0 right=0 
bottom=0 left=0}, unsigned int & 0) line 561 + 36 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x0115d188, const nsRect & {x=0 y=0 
width=9180 height=1073741824}, int 1, int 0, int 1, nsMargin & {top=0 right=0 
bottom=0 left=0}, unsigned int & 0) line 331 + 50 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 
0x0115d1fc, int * 0x0012d5f0) line 3854 + 56 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0115d1fc, int 
* 0x0012d5f0, int 1) line 3118 + 23 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2925 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x0115d100, nsIPresContext * 
0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 1729 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x0115d100, nsIPresContext * 
0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, 
int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes
CanvasFrame::Reflow(CanvasFrame * const 0x0115c42c, nsIPresContext * 0x02731060, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 306
nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState & {...}, nsIPresContext * 
0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0, int 0, int 0, int 9180, int 4470, int 1) line 813
nsBoxToBlockAdaptor::DoLayout(nsBoxToBlockAdaptor * const 0x0115d098, 
nsBoxLayoutState & {...}) line 484 + 52 bytes
nsBox::Layout(nsBox * const 0x0115d098, nsBoxLayoutState & {...}) line 1002
nsScrollBoxFrame::DoLayout(nsScrollBoxFrame * const 0x0115c544, nsBoxLayoutState 
& {...}) line 377
nsBox::Layout(nsBox * const 0x0115c544, nsBoxLayoutState & {...}) line 1002
nsContainerBox::LayoutChildAt(nsBoxLayoutState & {...}, nsIBox * 0x0115c544, 
const nsRect & {x=0 y=0 width=9180 height=4470}) line 593 + 16 bytes
nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState & {...}, nsIBox * 0x0115c544, 
const nsRect & {x=0 y=0 width=9180 height=4470}) line 1063 + 17 bytes
nsGfxScrollFrameInner::Layout(nsBoxLayoutState & {...}) line 1146
nsGfxScrollFrame::DoLayout(nsGfxScrollFrame * const 0x0115c4a0, nsBoxLayoutState 
& {...}) line 1071 + 15 bytes
nsBox::Layout(nsBox * const 0x0115c4a0, nsBoxLayoutState & {...}) line 1002
nsBoxFrame::Reflow(nsBoxFrame * const 0x0115c468, nsIPresContext * 0x02731060, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 740
nsGfxScrollFrame::Reflow(nsGfxScrollFrame * const 0x0115c468, nsIPresContext * 
0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 775 + 25 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x0115c468, nsIPresContext * 
0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, 
int 0, unsigned int 0, unsigned int & 0) line 693 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0115c3f0, nsIPresContext * 
0x02731060, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 546
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x02a67b50, 
nsIPresContext * 0x02731060, nsHTMLReflowMetrics & {...}, const nsSize & 
{width=9180 height=4470}, nsIRenderingContext & {...}) line 145
PresShell::ProcessReflowCommands(int 0) line 4239
PresShell::FlushPendingNotifications(PresShell * const 0x027074c0) line 3330
PresShell::DidCauseReflow() line 4189
PresShell::ContentInserted(PresShell * const 0x027074c8, nsIDocument * 
0x0270e330, nsIContent * 0x0270a118, nsIContent * 0x02a57b1c, int 6) line 3446
nsDocument::ContentInserted(nsDocument * const 0x0270e330, nsIContent * 
0x0270a118, nsIContent * 0x02a57b1c, int 6) line 1893
nsHTMLDocument::ContentInserted(nsHTMLDocument * const 0x0270e330, nsIContent * 
0x0270a118, nsIContent * 0x02a57b1c, int 6) line 1269
nsGenericHTMLContainerElement::InsertChildAt(nsIContent * 0x02a57b1c, int 6, int 
1) line 3457
nsHTMLBodyElement::InsertChildAt(nsHTMLBodyElement * const 0x0270a118, 
nsIContent * 0x02a57b1c, int 6, int 1) line 213 + 26 bytes
nsGenericElement::doInsertBefore(nsIDOMNode * 0x02a57b10, nsIDOMNode * 
0x00000000, nsIDOMNode * * 0x0012e870) line 2110 + 37 bytes
nsGenericHTMLContainerElement::AppendChild(nsIDOMNode * 0x02a57b10, nsIDOMNode * 
* 0x0012e870) line 442
nsHTMLBodyElement::AppendChild(nsHTMLBodyElement * const 0x0270a110, nsIDOMNode 
* 0x02a57b10, nsIDOMNode * * 0x0012e870) line 187 + 22 bytes
NodeAppendChild(JSContext * 0x026bc7f0, JSObject * 0x0120e9f8, unsigned int 1, 
long * 0x0116cfd8, long * 0x0012e920) line 570 + 25 bytes
js_Invoke(JSContext * 0x026bc7f0, unsigned int 1, unsigned int 0) line 716 + 23 
bytes
js_Interpret(JSContext * 0x026bc7f0, long * 0x0012f2d8) line 2517 + 15 bytes
js_Execute(JSContext * 0x026bc7f0, JSObject * 0x0113b2c8, JSScript * 0x02a50e20, 
JSFunction * 0x00000000, JSStackFrame * 0x00000000, unsigned int 0, long * 
0x0012f2d8) line 887 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x026bc7f0, JSObject * 0x0113b2c8, 
JSPrincipals * 0x027357a0, const unsigned short * 0x02a53990, unsigned int 243, 
const char * 0x02a53090, unsigned int 9, long * 0x0012f2d8) line 2770 + 27 bytes
nsJSContext::EvaluateString(nsJSContext * const 0x026bc1c0, const nsString & {"

        foo = document.createElement('select');

        bar = document.createElement('option');
        foo.appendChil"}, void * 0x0113b2c8, nsIPrincipal * 0x0273579c, const 
char * 0x02a53090, unsigned int 9, const char * 0x004fd468, nsString & {""}, int 
* 0x0012f334) line 525 + 55 bytes
HTMLContentSink::EvaluateScript(nsString & {"

        foo = document.createElement('select');

        bar = document.createElement('option');
        foo.appendChil"}, nsIURI * 0x026d7280, int 9, const char * 0x004fd468) 
line 4523
HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode & {...}) line 4860
HTMLContentSink::AddLeaf(HTMLContentSink * const 0x0272ab60, const nsIParserNode 
& {...}) line 3053 + 12 bytes
CNavDTD::AddLeaf(const nsIParserNode * 0x02a55810) line 3497 + 22 bytes
CNavDTD::HandleScriptToken(const nsIParserNode * 0x02a55810) line 2042 + 12 
bytes
CNavDTD::OpenContainer(const nsIParserNode * 0x02a55810, nsHTMLTag 
eHTMLTag_script, int 1, nsEntryStack * 0x00000000) line 3175 + 12 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x01987900, nsHTMLTag eHTMLTag_script, 
nsIParserNode * 0x02a55810) line 1138 + 20 bytes
CNavDTD::HandleStartToken(CToken * 0x01987900) line 1562 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x0270e090, CToken * 0x01987390, nsIParser 
* 0x02724600) line 770 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x0270e090, nsIParser * 0x02724600, 
nsITokenizer * 0x02708890, nsITokenObserver * 0x00000000, nsIContentSink * 
0x0272ab60) line 499 + 20 bytes
nsParser::BuildModel() line 1983 + 34 bytes
nsParser::ResumeParse(int 1, int 0) line 1864 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x02724608, nsIChannel * 0x026d7130, 
nsISupports * 0x00000000, nsIInputStream * 0x026d761c, unsigned int 0, unsigned 
int 491) line 2314 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x026d7390, 
nsIChannel * 0x026d7130, nsISupports * 0x00000000, nsIInputStream * 0x026d761c, 
unsigned int 0, unsigned int 491) line 251 + 46 bytes
nsResChannel::OnDataAvailable(nsResChannel * const 0x026d7134, nsIChannel * 
0x026d7eb0, nsISupports * 0x00000000, nsIInputStream * 0x026d761c, unsigned int 
0, unsigned int 491) line 735
nsFileChannel::OnDataAvailable(nsFileChannel * const 0x026d7eb8, nsIChannel * 
0x026d7b90, nsISupports * 0x00000000, nsIInputStream * 0x026d761c, unsigned int 
0, unsigned int 491) line 658 + 49 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x026f9cc0) 
line 400 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x026f9c70) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x026f9c70) line 587 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x018ec4e0) line 528 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00671518, unsigned int 49427, unsigned int 0, 
long 26133728) line 1043 + 9 bytes
USER32! 77e71820()

---------------------------
The interesting part is the frame got created through content being inserted. 
Then the PresShell calls DidCauseReflow which checks to see if the doc was 
loading and, if so, then calls FlushPendingNotifications. And that call causes 
the initial reflow to happen. During the initial reflow the combobox unsets an 
attribute on the option content, which ends up calling 
nsGenericHTMLElement::UnsetAttribute which  (follow the stack trace) eventually 
calls HTMLContentSink::BeginUpdate and flushes the tags in the sink. The sink 
for some reason thinks the select hasn't been created and then a new select 
frame gets created from content appended.

So somewhere the sink needs to get flushed before the "DidCauseReflow".

This only happens if a select is dynamically created via script in the onload 
handler. If I create a a select dynamically via pressing a button everything is 
fine. Also, I commented out the FlushPendingNotifications.  in the 
DidCauseReflow and the select did not show up until I caused a reflow by 
resizing the page, BUT only one select appeared.

Summary:
The sink needs to get flushed or be told told SOMETHING before DidCauseReflow is 
called.

reassigning to harishd

This is a content sink issue for when elements are created via JS in the onload 
handler, where the element being created set/unsets an attribute on a piece of 
content in its initial reflow.

Comment 20

[harishd]

Rod, I spoke to Vidur and Johnny and according to them sink doesn't play any 
part for DOM calls.  Adding Vidur for more input.

Comment 21

[Nisheeth Ranjan]

Marking nsbeta3- and futuring...

Comment 22

[bsharma]

Updating QA contact.

Comment 23

[harishd]

Seems to work correctly. Marking WFM.

Comment 24

[Myk Melez [:myk] [@mykmelez]]

Yep, I don't see the problem anymore either on Linux on Mac.  Marking verified.