363280 - Firefox crashes from alert dialog [@ nsFrameList::InsertFrames]

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[alex]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

I have made a small extension that demonstrates the crash. You have to customize your toolbar to inclcude the new button, after that press it and you will get the crash.

Reproducible: Always

Steps to Reproduce:
1.Install the test extension
2.customize the toolbar to include the new button
3.press the button and see the crash

Actual Results:  
Firefox crashes

Expected Results:  
Firefox should not crash. Even if the stuff that is done in the extension is not entirely correct, it should produce an error but it shouldn't crash.

Comment 1

[alex]

Attachment: The test extension that produces the crash

Comment 2

[Ria Klaassen (not reading all bugmail)]

I see this crash in the latest windows branch build but not in trunk.

TB27106440M  TB27106419Y  TB27106414Z

Incident ID: 27106440
Stack Signature	nsFrameList::InsertFrames b61af703
Product ID	Firefox2
Build ID	2006120904
Trigger Time	2006-12-09 12:06:25.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (002538db)
URL visited	
User Comments	
Since Last Crash	15 sec
Total Uptime	31 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/generic/nsFrameList.cpp, line 275
Stack Trace 	
nsFrameList::InsertFrames  [mozilla/layout/generic/nsFrameList.cpp, line 275]
nsBoxFrame::InsertFrames  [mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1196]
nsFrameManager::InsertFrames  [mozilla/layout/base/nsFrameManager.cpp, line 688]
nsCSSFrameConstructor::ContentAppended  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 8693]
PresShell::ContentAppended  [mozilla/layout/base/nsPresShell.cpp, line 5518]
nsXULDocument::ContentAppended  [mozilla/content/xul/document/src/nsXULDocument.cpp, line 1165]
nsXULElement::InsertChildAt  [mozilla/content/xul/content/src/nsXULElement.cpp, line 1128]
nsGenericElement::doReplaceOrInsertBefore  [mozilla/content/base/src/nsGenericElement.cpp, line 3619]
nsGenericElement::InsertBefore  [mozilla/content/base/src/nsGenericElement.cpp, line 3068]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1396]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3950]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1415]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1490]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4359]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]
nsJSEventListener::HandleEvent  [mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2229]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2035]
PresShell::HandleDOMEventWithTarget  [mozilla/layout/base/nsPresShell.cpp, line 6524]
nsButtonBoxFrame::DoMouseClick  [mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp, line 182]
nsButtonBoxFrame::MouseClicked  [mozilla/layout/xul/base/src/nsButtonBoxFrame.h, line 61]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6466]
PresShell::HandleEventWithTarget  [mozilla/layout/base/nsPresShell.cpp, line 6323]
nsEventStateManager::CheckForAndDispatchClick  [mozilla/content/events/src/nsEventStateManager.cpp, line 3207]
nsEventStateManager::PostHandleEvent  [mozilla/content/events/src/nsEventStateManager.cpp, line 2170]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6497]
PresShell::HandleEvent  [mozilla/layout/base/nsPresShell.cpp, line 6261]
nsViewManager::HandleEvent  [mozilla/view/src/nsViewManager.cpp, line 2559]
nsViewManager::DispatchEvent  [mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 1389]
nsWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 6433]
ChildWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 6680]
nsWindow::WindowProc  [mozilla/widget/src/windows/nsWindow.cpp, line 1577]
USER32.dll + 0x8734 (0x77d18734)
USER32.dll + 0x8816 (0x77d18816)
USER32.dll + 0x89cd (0x77d189cd)
USER32.dll + 0x8a10 (0x77d18a10)
nsAppShell::Run  [mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16fd7 (0x7c816fd7)

Comment 3

[Ria Klaassen (not reading all bugmail)]

Fixed on trunk somewhere in October 2006.

Comment 4

[Mats Palmgren (inactive)]

Fixed between:  2006-10-05-04 -- 2006-10-06-04
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-10-05+03%3A00&maxdate=2006-10-06+05%3A00&cvsroot=%2Fcvsroot
Maybe bug 52209 fixed this?

Comment 5

[Mats Palmgren (inactive)]

Attachment: Debug data

Crash on using a free'd nsFrame :-(

Comment 6

[Boris Zbarsky [:bzbarsky]]

Possible.  But in general, this is just another symptom of bug 267833

Comment 7

[Nickolay_Ponomarev]

Should this be closed then?

Comment 8

[Mats Palmgren (inactive)]

(In reply to comment #7)
> Should this be closed then?

No, not until we have a fix for bug 267833 that we can confirm also fixes
this crash.

Comment 9

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to comment #8)
> (In reply to comment #7)
> > Should this be closed then?
> 
> No, not until we have a fix for bug 267833 that we can confirm also fixes
> this crash.

So is this crash still reproducible?

Comment 10

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Does not crash for me anymore with Minefield or Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729) ID:20090624025744.

Marking as WFM. If anyone can still reproduce this crash feel free to reopen.