Closed Bug 399013 Opened 16 years ago Closed 15 years ago

Crash [@ UpdateViewsForTree] with popop stuff onoverflow/onunderflow and changing styles


(Core :: XUL, defect)

Windows XP
Not set





(Reporter: martijn.martijn, Assigned: enndeakin)



(Keywords: crash, regression, testcase)

Crash Data


(1 file, 1 obsolete file)

Attached file testcase
See testcase, which crashes after reload (happens automatically).

This seems to have regressed somehow between 2007-07-04 and 2007-07-05:
I guess somehow a regression from bug 279703.
0  	UpdateViewsForTree  	 mozilla/layout/base/nsCSSFrameConstructor.cpp:9625
1 	DoApplyRenderingChangeToTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9657
2 	ApplyRenderingChangeToTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9705
3 	nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList&) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9918
4 	nsCSSFrameConstructor::ProcessOneRestyle(nsIContent*, nsReStyleHint, nsChangeHint) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:13008
5 	nsCSSFrameConstructor::ProcessPendingRestyles() 	mozilla/layout/base/nsCSSFrameConstructor.cpp:13054
6 	PresShell::DoFlushPendingNotifications(mozFlushType, int) 	mozilla/layout/base/nsPresShell.cpp:4443
7 	PresShell::FlushPendingNotifications(mozFlushType) 	mozilla/layout/base/nsPresShell.cpp:4407
8 	nsCSSFrameConstructor::RestyleEvent::Run() 	mozilla/layout/base/nsCSSFrameConstructor.cpp:13110
9 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:490
10 	NS_ProcessNextEvent_P(nsIThread*, int) 	nsThreadUtils.cpp:227
11 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
12 	nsAppStartup::Run() 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
13 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3142
14 	main 	mozilla/browser/app/nsBrowserApp.cpp:153
15 	WinMain 	mozilla/browser/app/nsBrowserApp.cpp:166
16 	__tmainCRTStartup 	crtexe.c:589
A simpler testcase has:

  <menupopup id="a"/>

document.getElementById('a').setAttribute('style', 'display: block;');

The menulist initially has the <panel> in its popupList. The menupopup is the first child frame of the menulist.

When the menupopup is changed to use a block frame, the menulist's childlist is emptied, and the new block frame is appended as a sibling of the <panel>'s frame. That is, it is incorrectly placed as a sibling of the <panel> frame rather than as the first child of the menulist.

I think this is caused because nsCSSFrameConstructor::FindPreviousSibling doesn't account for the popup frames being in a different list.
Attached patch skip popups in the popup list (obsolete) — Splinter Review
Assignee: nobody → enndeakin
Attachment #284003 - Attachment is obsolete: true
Attachment #284628 - Flags: superreview?(bzbarsky)
Attachment #284628 - Flags: review?(bzbarsky)
Does the patch in bug 386642 fix this?  Or does the popup logic need to be exactly what it is in this patch?
Attachment #284003 - Attachment is obsolete: false
Comment on attachment 284628 [details] [diff] [review]
skip popups in the popup list

Hmmm. I thought this bug sounded familiar. bz, your patch does indeed fix this bug, so let's ignore the patch here.
Attachment #284628 - Attachment is obsolete: true
Attachment #284628 - Flags: superreview?(bzbarsky)
Attachment #284628 - Flags: review?(bzbarsky)
Depends on: 386642
FYI, I can't reproduce the crash from the testcase anymore with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007102105 Minefield/3.0a9pre
I cannot reproduce either on Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9a9pre) Gecko/2007102105 Minefield/3.0a9pre ID:2007102105
Fixed by checkin for bug 386642, right?
Closed: 15 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b2pre) Gecko/2007110805 Minefield/3.0b2pre
Component: XP Toolkit/Widgets: Menus → XUL
QA Contact: xptoolkit.menus → xptoolkit.widgets
Crash Signature: [@ UpdateViewsForTree]
You need to log in before you can comment on or make changes to this bug.