Crash if set div, containing an iframe and div, to display:none from within the iframe

RESOLVED DUPLICATE of bug 235405

Status

()

Firefox
General
--
critical
RESOLVED DUPLICATE of bug 235405
10 years ago
10 years ago

People

(Reporter: Richard, Unassigned)

Tracking

({crash, stackwanted})

2.0 Branch
x86
Windows XP
crash, stackwanted
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

10 years ago
User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9b5) Gecko/2008041514 Firefox/3.0b5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14

When setting a div, which contains another div (as title bar) and below an iframe, to display: none from within the iframe browser crashes. If the title bar div contains no text the browser does not crash.
Example:
this is the main page (FF2_error.htm):
<body>
<!-- div containing the lightbox -->
<div id="lightbox" style="position: fixed;left:100px;top:100px;display:block;background-color:#006700;">
	<!-- div for part above iframe with title and close button -->
	<div id="lightbox_titlebar" style="left:0px;right:0px;">
			Window Title <!-- If this text is not here crash will not occur -->
	</div>
	<!-- content of lightbox -->
	<div id="lightbox_content" style="clear:both;">
		<!-- iframe with other page needs to close lightbox -->
		<iframe id="pop-upframe" style="" src="./FF2_error2.htm"></iframe>
	</div>
</div>
</body>

This is the contents of the iframe (FF2_error2.htm):
<body>
<!-- contents of iframe -->
this is in iframe
<!-- link to re-hide the lightbox -->
<a href="javascript:;" onclick="javascript: window.parent.document.getElementById('lightbox').style.display = 'none';">Close Lightbox</a>
</body>

Save as two separate files in same directory with names written above.

[I will upload these two files if i work out how later]

Reproducible: Always

Steps to Reproduce:
1.Save two separate files above
2.Run first file (FF2_error.htm)
3.Click 'Close Lightbox' within the iframe
Actual Results:  
Browser Crash. Feedback agent appears and windows xp gives option of sending error report ("firefox.exe has encountered a problem and needs to close.  We are sorry for the inconvenience.")

Expected Results:  
The outer most div should have gone to display:none state and not been viewable, in the above example the page should have been blank.

This has been reproducible on two xp machines running FF 2.0.0.14 FF3 is ok in Ubuntu Linux as well as FF2.0.0.12 on a Debian Linux.

about:buildconfig

Build platform
target
i586-pc-msvc

Build tools
Compiler 	Version 	Compiler flags
$(CYGWIN_WRAPPER) cl 	12.00.8804 	-TC -nologo -W3 -Gy -Fd$(PDBFILE)
$(CYGWIN_WRAPPER) cl 	12.00.8804 	-TP -nologo -W3 -Gy -Fd$(PDBFILE)

Configure arguments
--enable-application=browser --enable-update-channel=release --enable-official-branding --enable-optimize --disable-debug --disable-tests --enable-static --disable-shared --enable-svg --enable-canvas --enable-update-packaging
(Reporter)

Comment 1

10 years ago
Created attachment 319195 [details]
1st page required to re-create crash (FF2_error.htm)
(Reporter)

Comment 2

10 years ago
Created attachment 319196 [details]
2nd page to recreate error (FF2_error2.htm)
(Reporter)

Updated

10 years ago
Attachment #319195 - Attachment description: 1st page required to re-create crash → 1st page required to re-create crash (FF2_error.htm)
(Reporter)

Updated

10 years ago
Attachment #319196 - Attachment description: 1nd page to recreate error → 2nd page to recreate error (FF2_error2.htm)

Comment 3

10 years ago
please either install talkback (windows/linux) and report an incident id

or for windows you can use:
http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg
!analyze -v -f (attach the output)

note that since this works on trunk it's unlikely to be fixed unless this was a regression from an earlier version of firefox 2.0
Severity: normal → critical
Keywords: crash, stackwanted
Version: unspecified → 2.0 Branch
(Reporter)

Comment 4

10 years ago
Created attachment 319261 [details]
Talkback output
(Reporter)

Comment 5

10 years ago
Talkback ID for example above:TB44715001H

Sorry the attachment might not be as required

Comment 6

10 years ago
the attachment is indeed useless, but the incident id makes up for it, thanks.

Incident ID: 44715001
Stack Signature	GetFrameFromLine 7bb7d7fb
Product ID	Firefox2
Build ID	2008040413
Trigger Time	2008-05-04 03:25:07.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (002d67d5)
URL visited	
User Comments	See bugzilla bug 432041
Since Last Crash	338 sec
Total Uptime	5726 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6898
Stack Trace 	
GetFrameFromLine  [mozilla/layout/generic/nsBlockFrame.cpp, line 6898]
nsBlockFrame::GetFrameForPointUsing  [mozilla/layout/generic/nsBlockFrame.cpp, line 6973]
nsBlockFrame::GetFrameForPoint  [mozilla/layout/generic/nsBlockFrame.cpp, line 7009]
PresShell::HandleEvent  [mozilla/layout/base/nsPresShell.cpp, line 6302]
nsViewManager::HandleEvent  [mozilla/view/src/nsViewManager.cpp, line 2521]
nsViewManager::DispatchEvent  [mozilla/view/src/nsViewManager.cpp, line 2253]
HandleEvent  [mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 1319]
nsWindow::DispatchFocus  [mozilla/widget/src/windows/nsWindow.cpp, line 6515]
nsWindow::ProcessMessage  [mozilla/widget/src/windows/nsWindow.cpp, line 5034]
nsWindow::WindowProc  [mozilla/widget/src/windows/nsWindow.cpp, line 1507]
USER32.dll + 0x8734 (0x7e418734)
USER32.dll + 0x8816 (0x7e418816)
USER32.dll + 0xb4c0 (0x7e41b4c0)
USER32.dll + 0xb50c (0x7e41b50c)
ntdll.dll + 0xeae3 (0x7c90eae3)
nsView::~nsView  [mozilla/view/src/nsView.cpp, line 268]
nsSubDocumentFrame::Destroy  [mozilla/layout/generic/nsFrameFrame.cpp, line 626]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsLineBox::DeleteLineList  [mozilla/layout/generic/nsLineBox.cpp, line 325]
nsFrameList::DestroyFrame  [mozilla/layout/generic/nsFrameList.cpp, line 234]
nsCSSFrameConstructor::ContentRemoved  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10125]
nsCSSFrameConstructor::RecreateFramesForContent  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12076]
nsCSSFrameConstructor::RestyleElement  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10593]
nsCSSFrameConstructor::ProcessOneRestyle  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14153]
nsCSSFrameConstructor::ProcessPendingRestyles  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14206]
nsCSSFrameConstructor::RestyleEvent::HandleEvent  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14277]
HandleRestyleEvent  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14287]
0x778b0c24
0x0020006c
0x388366ff
Status: UNCONFIRMED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 235405
You need to log in before you can comment on or make changes to this bug.