350460 - Crash [@ DoDeletingFrameSubtree] after reloading a xul page a few times with display: -moz-popup and menuitem

Status: RESOLVED DUPLICATE of bug 372576

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes current 1.8.0.7 builds and current trunk builds when reloading the page a few times.

Basically, the page consists of this:
  <menuitem style="display: -moz-popup;">
    <box style="display: -moz-popup;">
      <box style="display: -moz-popup;"/>
    </box>
  </menuitem>


Talkback ID: TB22599290Y
DoDeletingFrameSubtree   DeletingFrameSubtree   nsCSSFrameConstructor::RemoveMappingsForFrameSubtree   nsPopupSetFrame::Destroy   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameManager::Destroy   DocumentViewerImpl::Destroy   DocumentViewerImpl::Show   nsPresContext::EnsureVisible   PresShell::UnsuppressAndInvalidate   PresShell::UnsuppressPainting

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

When reloading this page a few times, I crash consistently.

Comment 2

[Mats Palmgren (inactive)]

I debugged this crash and it's the same as bug 372576.

Comment 3

[Mats Palmgren (inactive)]

Perhaps we could tweak the testcase so that it crashes on load and
include it in the test suite?

Comment 4

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a0b0b899cf1e

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a0b0b899cf1e