Closed
Bug 42372
Opened 24 years ago
Closed 24 years ago
crash during frame destruction code while leaving page
Categories
(Core :: Layout, defect, P1)
Tracking
()
VERIFIED
FIXED
M18
People
(Reporter: joki, Assigned: buster)
References
()
Details
(Keywords: crash, helpwanted, Whiteboard: [nsbeta3+])
Attachments
(5 files)
4.51 KB,
text/plain
|
Details | |
2.82 KB,
text/plain
|
Details | |
68 bytes,
text/html
|
Details | |
9.70 KB,
patch
|
Details | Diff | Splinter Review | |
1.94 KB,
patch
|
Details | Diff | Splinter Review |
This is a test case from bug #22636, an event handling bug of mine. We had a lot of problems getting the parsing and event handling of this test case correct. Now that all of them seem to work I'm getting a crash here. However, at the time the parsing and event handling changes were made a month and a half back the test case still worked so I don't think the changes made to fix the bug are at issue. Anyway, while attempting to verfiy I started running into a reproducible crash while clicking on the link in the test case running WinNT. I'll attach a stack trace as well.
Reporter | ||
Comment 1•24 years ago
|
||
frame parentage issues can be tricky. this is a pretty obscure case, an absolutely positioned element inside of a relatively positioned element. could be a simple error, so it's worth a quick look. but if it's not quick, I'd suggest *not* holding beta2 for this one, and fixing this for beta3 (when I get back.) cc-ing waterson and karnaze in case either wants to look into it. marking "helpwanted" because it would be great if someone could build a little test suite of various combinations of positioned elements inside each other, to make sure we catch all the cases.
Keywords: nsbeta3
Updated•24 years ago
|
Keywords: helpwanted
Comment 5•24 years ago
|
||
Crasher. PDT team please approve.
Comment 8•24 years ago
|
||
Taking a stab at prioritizing buster's nsbeta3 bugs...
Whiteboard: [nsbeta3+]
Comment 10•24 years ago
|
||
This crash occurs on www.crn.com, and the page layout is really awful too (tabbed DIV contents are not contained correctly, general mucking up of abs and rel positioning) - see bug 47200.
Comment 11•24 years ago
|
||
*** Bug 45842 has been marked as a duplicate of this bug. ***
Assignee | ||
Comment 12•24 years ago
|
||
staring at the code....
Severity: normal → critical
Status: NEW → ASSIGNED
Target Milestone: --- → M18
Assignee | ||
Comment 13•24 years ago
|
||
Interesting....this only happens if the outer tag is an inline. Some block-in-inline badness, no doubt. Still researching....
Assignee | ||
Comment 14•24 years ago
|
||
I think I have this fixed. Patch coming soon. There were 2 basic problems. First, the frame and view trees were not being updated together when a frame was reparented. Second, a subtle bug in the use of a stack-based variable was causing the frame parentage to be wrong in some cases, when the variable's destructor was prematurely fired.
Whiteboard: [nsbeta3+] → [nsbeta3+] [fix in hand]
Assignee | ||
Comment 15•24 years ago
|
||
Comment 16•24 years ago
|
||
Which code is relevant to this bug in the patch you've attached? (This patch also appears to include some image debugging printf's and the text edit initial reflow stuff...)
Comment 17•24 years ago
|
||
From Steve's email it looks like nsCSSFrameConstructor.cpp and nsHTMLReflowState.cpp are the changes for this bug. If those are the important changes, then they look reasonable to my (bloodshot) eyes, but I have not run 'em.
Assignee | ||
Comment 18•24 years ago
|
||
damn, sorry, I attached the wrong patch file. I had hand-edited a concise patch file, but that one didn't make it. When I get to the office, I'll do it right.
Assignee | ||
Comment 19•24 years ago
|
||
*** Bug 46356 has been marked as a duplicate of this bug. ***
Assignee | ||
Comment 20•24 years ago
|
||
Assignee | ||
Comment 21•24 years ago
|
||
turns out the part of the fix for the view tree was a red herring. with the other part of the fix (in nsCSSFrameConstructor::ConstructInline()), the view tree stays in synch without the additional code. However, I think that code could be useful, if only I could find a test case that triggers the problem! So, I'm commenting it out but leaving it in the file with a comment about what to look for and how it could be useful.
Assignee | ||
Comment 22•24 years ago
|
||
r=waterson
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
Whiteboard: [nsbeta3+] [fix in hand] → [nsbeta3+]
Comment 23•24 years ago
|
||
Steve, What's the best way I can verify this problem has been fixed ?
Assignee | ||
Comment 24•24 years ago
|
||
to verify: 1. load the test case 2. load any other page, or just hit reload 3. if you crash, it ain't fixed
Comment 25•24 years ago
|
||
No longer crashing. Tested with the Aug 24th build.
Status: RESOLVED → VERIFIED
Assignee | ||
Comment 26•24 years ago
|
||
*** Bug 50831 has been marked as a duplicate of this bug. ***
You need to log in
before you can comment on or make changes to this bug.
Description
•