359786 - crash when listitem is first element inside listitem (due to infinite recusion)

Status: RESOLVED DUPLICATE of bug 306911

(Core :: Layout, defect)

Description

[Soyapi Mumba]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

When a <listitem> is the first or only element inside another <listitem>, the browser crashes.

This can easily happen when you mistakenly type listitem instead of listcell when implementing a multi-column listbox

Reproducible: Always

Steps to Reproduce:
1. In a XUL file,create a listbox with at least one listitem
2. Inside any listitem, insert another listitem
3. Open the XUL file in the browser

Actual Results:  
Firefox crashed

Expected Results:  
The same behaviour when a listitem is not the first embedded element

Comment 1

[Soyapi Mumba]

Attachment: Test case

Comment 2

[Adam Guthrie]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20061107 Minefield/3.0a1

I crash in 1.8 build, but not on trunk. Unfortunately, Talkback isn't firing when I crash.

Soyapi, does Talkback fire when you crash? If so, please paste the ID here. http://kb.mozillazine.org/Talkback

Comment 3

[[:Aleksej]]

Crash confirmed on
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061107 BonEcho/2.0
not on trunk.

Comment 4

[Adam Guthrie]

The crash is due to infinite recursion. Here's a snippet from the stack:

#1287 0xb5952874 in nsGridRowLeafLayout::GetMaxSize (this=0x9177a68, aBox=0x91762d0, aState=@0xbff91a14, aSize=@0xbf7a8250) at /moz/branch/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp:128
#1288 0xb5678e55 in nsBoxFrame::GetMaxSize (this=0x91762d0, aBoxLayoutState=@0xbff91a14, aSize=@0xbf7a8250) at /moz/branch/mozilla/layout/xul/base/src/nsBoxFrame.cpp:1063
#1289 0xb595812b in nsGridCell::GetMaxSize (this=0x9177b2c, aState=@0xbff91a14, aMax=@0xbf7a8294) at /moz/branch/mozilla/layout/xul/base/src/grid/nsGridCell.cpp:149
#1290 0xb5956cc2 in nsGrid::GetMaxRowHeight (this=0x91754d0, aState=@0xbff91a14, aIndex=0, aSize=@0xbf7a8310, aIsHorizontal=1) at /moz/branch/mozilla/layout/xul/base/src/grid/nsGrid.cpp:1180
#1291 0xb5956e3a in nsGrid::GetMaxRowSize (this=0x91754d0, aState=@0xbff91a14, aRowIndex=0, aSize=@0xbf7a83a0, aIsHorizontal=1) at /moz/branch/mozilla/layout/xul/base/src/grid/nsGrid.cpp:622

Basically the same issue as bug 322759.

Comment 5

[Adam Guthrie]

*** This bug has been marked as a duplicate of 322759 ***

Comment 6

[Adam Guthrie]

Reopening. Martijn says he still crashes on trunk when viewing the testcase in bug 322759, but doesn't crash when viewing this case on trunk (using Windows), so this is probably a different bug.

Comment 7

[Martijn Wargers (dead)]

The testcase does crash with a 2005-11-20 build, but not anymore with a 2005-11-22 build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-11-20+06&maxdate=2005-11-22+13&cvsroot=%2Fcvsroot
It seems to me this was fixed with the fix for bug 306911.

Comment 8

[Martijn Wargers (dead)]

Yeah, the same bug as bug 306911, the testcase in that bug is the same.

*** This bug has been marked as a duplicate of 306911 ***