353610 - Crash [@ nsCSSFrameConstructor::AttributeChanged] [@ nsNativeThemeMac::ThemeSupportsWidget]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Loading the testcase crashes Firefox.  

A nightly dereferences null in [@ nsNativeThemeMac::ThemeSupportsWidget] called by nsCSSFrameConstructor::AttributeChanged, while a debug build dereferences 0xddddddfd in nsCachedStyleData::GetStyleData called indirectly by [@ nsCSSFrameConstructor::AttributeChanged].

In a debug build, I see some assertions before the crash:

###!!! ASSERTION: We don't support out-of-flow kids: '!aListName', file /Users/admin/trunk/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1190
###!!! ASSERTION: not in child list: 'nsFrameList(aChildFrame->GetParent()->GetFirstChild(listName)) .ContainsFrame(aChildFrame)', file /Users/admin/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 1930
###!!! ASSERTION: We don't support out-of-flow kids: '!aListName', file /Users/admin/trunk/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1136

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jesse Ruderman]

On the Firefox 2 branch, this testcase causes assertions but not a crash.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Jesse, do you still see this?  I get neither asserts nor a crash with two different trunk builds (which both have some changes, but one has a clean layout/).  

Note that there were some fixes at the end of September (bug 330909 comes to mind) that might have fixed this testcase.

Comment 4

[Jesse Ruderman]

Works for me (non-Cocoa opt and non-Cocoa debug) and for enn (Cocoa debug).