Closed Bug 360339 Opened 14 years ago Closed 14 years ago
Crash [@ Do
Deleting Frame Subtree] [@ ns Frame::Box Reflow] with float, menulist, menupopup
348 bytes, application/vnd.mozilla.xul+xml
484 bytes, application/vnd.mozilla.xul+xml
I'm about to attach two related testcases. One makes Firefox crash [@ DoDeletingFrameSubtree] and the other makes it crash [@ nsFrame::BoxReflow]. Both crashes appear to be null derefs in both opt and debug builds. This might be related to bug 350460. Tested with non-Cocoa builds. ###!!! ASSERTION: wrong kind of child frame: 'aIsBlock == f->GetStyleDisplay()->IsBlockLevel()', file /Users/admin/trunk/mozilla/layout/generic/nsLineBox.cpp, line 73 ###!!! ASSERTION: How'd we get a floated inline frame? The frame ctor should've dealt with this.: 'aReflowState.mStyleDisplay->mFloats == NS_STYLE_FLOAT_NONE', file /Users/admin/trunk/mozilla/layout/generic/nsLineLayout.cpp, line 1236 ###!!! ASSERTION: Must be a box frame!: 'mScrollCornerBox->IsBoxFrame()', file /Users/admin/trunk/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2460 ###!!! ASSERTION: A box layout method was called but InitBoxMetrics was never called: 'metrics', file /Users/admin/trunk/mozilla/layout/generic/nsFrame.cpp, line 6166 ###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file /Users/admin/trunk/mozilla/layout/base/../generic/nsPlaceholderFrame.h, line 164
There is a similar Sunbird crash on Windows after problems with xul popup menus, see Bug 364034. Duplicate?
For both testcases we get calls to RemoveMappingsForFrameSubtree from nsMenuFrame::DestroyPopupFrames while the pres shell is destroying so I'm pretty sure this is the same underlying cause as bug 372576. Neither testcase crashes trunk builds on Linux for some reason... they do crash Firefox 2.x and 1.5.x though.
Depends on: 372576
WFM on trunk both before and after the patch for bug 372576.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
Crashtests checked in.
Component: XP Toolkit/Widgets: Menus → XUL
QA Contact: xptoolkit.menus → xptoolkit.widgets
Crash Signature: [@ DoDeletingFrameSubtree] [@ nsFrame::BoxReflow]
You need to log in before you can comment on or make changes to this bug.