Closed Bug 350460 Opened 14 years ago Closed 14 years ago

Crash [@ DoDeletingFrameSubtree] after reloading a xul page a few times with display: -moz-popup and menuitem

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 372576

People

(Reporter: martijn.martijn, Assigned: martijn.martijn)

References

(Depends on 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

362 bytes, application/vnd.mozilla.xul+xml
Details
See upcoming testcase, which crashes current 1.8.0.7 builds and current trunk builds when reloading the page a few times.

Basically, the page consists of this:
  <menuitem style="display: -moz-popup;">
    <box style="display: -moz-popup;">
      <box style="display: -moz-popup;"/>
    </box>
  </menuitem>


Talkback ID: TB22599290Y
DoDeletingFrameSubtree   DeletingFrameSubtree   nsCSSFrameConstructor::RemoveMappingsForFrameSubtree   nsPopupSetFrame::Destroy   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameManager::Destroy   DocumentViewerImpl::Destroy   DocumentViewerImpl::Show   nsPresContext::EnsureVisible   PresShell::UnsuppressAndInvalidate   PresShell::UnsuppressPainting
Attached file testcase
When reloading this page a few times, I crash consistently.
Blocks: 324721
No longer blocks: 324721
Depends on: 324721
I debugged this crash and it's the same as bug 372576.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 372576
Perhaps we could tweak the testcase so that it crashes on load and
include it in the test suite?
Flags: in-testsuite?
Group: security
Crash Signature: [@ DoDeletingFrameSubtree]
Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a0b0b899cf1e
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.