4265 - call attribute-changed after model construction

Status: VERIFIED FIXED

(Core Graveyard :: RDF, defect, P3)

Description

[Mike Pinkerton (not reading bugmail)]

launch linux apprunner. the window draws, lays out, resizes, fixes itself when
the images load, and then crashes.

A stack trace is forthcoming by donm, but it looks like a crash in the attribute
stuff you just changed, Peter. If this isn't your bug, please reassign.

Comment 1

[Mike Pinkerton (not reading bugmail)]

adding sar and donm to cc list

Comment 2

[donm]

I get similar crashes with this morning's build after I removed
components/liblocalmail.so which causes a different crash.
stack trace as follows:
#0  0x40463ddc in nsCSSFrameConstructor::RecreateFramesForContent ()
#1  0x40462bbd in nsCSSFrameConstructor::AttributeChanged ()
#2  0x4039414e in StyleSetImpl::AttributeChanged ()
#3  0x403c39be in PresShell::AttributeChanged ()
#4  0x409fd589 in XULDocumentImpl::AttributeChanged ()
#5  0x409eea7c in RDFElementImpl::SetAttribute ()
#6  0x409faddf in RDFXULBuilderImpl::AddAttribute ()
#7  0x409faa32 in RDFXULBuilderImpl::CreateXULElement ()
#8  0x409f9f73 in RDFXULBuilderImpl::CreateElement ()
#9  0x409f9b69 in RDFXULBuilderImpl::AppendChild ()
#10 0x409f83f4 in RDFXULBuilderImpl::CreateContents ()
#11 0x409fe24f in XULDocumentImpl::CreateContents ()
#12 0x409ef9af in RDFElementImpl::EnsureContentsGenerated ()
#13 0x409edf89 in RDFElementImpl::ChildAt ()
#14 0x409ece49 in RDFElementImpl::GetFirstChild ()
#15 0x40013ba5 in nsWebShellWindow::LoadMenus ()
#16 0x400147c6 in nsWebShellWindow::OnConnectionsComplete ()
#17 0x401eec1d in nsDocLoaderImpl::AreAllConnectionsComplete ()
#18 0x401eeba9 in nsDocLoaderImpl::LoadURLComplete ()
#19 0x401ef718 in nsDocumentBindInfo::OnStopBinding ()
#20 0x401d9ede in stub_complete ()
#21 0x4011bbfb in net_ProcessFile ()
#22 0x401b7ddf in NET_ProcessNet ()
#23 0x401bd3fb in NET_PollSockets ()
#24 0x401d54a1 in nsNetlibService::NetPollSocketsCallback ()
#25 0x400f7cfa in TimerImpl::FireTimeout ()
#26 0x400f8060 in nsTimerExpired ()
#27 0x80dc6b3 in g_timeout_dispatch (source_data=0x8393d20,
    current_time=0xbffffa14, user_data=0x8384730) at gmain.c:1147
#28 0x80dbc38 in g_main_dispatch (current_time=0xbffffa14) at gmain.c:647
#29 0x80dc0b3 in g_main_iterate (block=1, dispatch=1) at gmain.c:854
#30 0x80dc1cd in g_main_run (loop=0x813ad48) at gmain.c:912
#31 0x807f90b in gtk_main () at gtkmain.c:475
#32 0x4006f635 in nsAppShell::Run ()
#33 0x4001254a in nsAppShellService::Run ()
#34 0x8050776 in main ()

Comment 3

[Scott MacGregor]

Just to add another test case when we think this bug is fixed....running the
mailnews app on Win32 crashes in the same spot. nsCSSFrameConstructor. Mailnews
win32 is doa right now because of this....

Comment 4

[Peter Linss]

CSSFrameConstructor no longer crashes there.

The real problems are:
1) AttributeChanged is getting called during model construction, attributes
should be added before the content node is inserted in the tree (adding them
afterwards is causing lots of unneccessary work)
2) the content node in question has no parent pointer, from the stack trace, it
appears to be the child of something
3) that particular attribute is causing a FrameChange response from the style
code - what is the attribute, and is that really what we want?

Comment 5

[Chris Waterson]

Accepted bug to get of terry's spambot.

Comment 6

[Chris Waterson]

Set target milestone to M5.

Comment 7

[Peter Trudelle]

moving to m8

Comment 8

[David Hyatt]

This is fixed.

Comment 9

[Chris Petersen]

Fixed in June 2 Build.