457213 - Crash [@ nsCSSFrameConstructor::ConstructXULFrame] with setting display: table on root and showPopup

Status: RESOLVED DUPLICATE of bug 454751

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build after 500ms.

This regressed when bug 243519 got fixed. I guess this could be fixed by bug 455063.

http://crash-stats.mozilla.com/report/index/2e7ac387-8bbe-11dd-b2de-001cc45a2c28?p=1
0  	xul.dll  	nsBoxFrame::Init  	 layout/xul/base/src/nsBoxFrame.cpp:206
1 	xul.dll 	nsMenuPopupFrame::Init 	layout/xul/base/src/nsMenuPopupFrame.cpp:136
2 	xul.dll 	nsCSSFrameConstructor::ConstructXULFrame 	layout/base/nsCSSFrameConstructor.cpp:6118
3 	xul.dll 	nsCSSFrameConstructor::ConstructFrameInternal 	layout/base/nsCSSFrameConstructor.cpp:7519
4 	xul.dll 	nsCSSFrameConstructor::ConstructFrame 	layout/base/nsCSSFrameConstructor.cpp:7379
5 	xul.dll 	nsCSSFrameConstructor::ProcessChildren 	layout/base/nsCSSFrameConstructor.cpp:11243
6 	xul.dll 	nsCSSFrameConstructor::ConstructTableFrame 	layout/base/nsCSSFrameConstructor.cpp:3540
7 	xul.dll 	xul.dll@0x305395 	
8 	xul.dll 	nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal 	layout/base/nsCSSFrameConstructor.cpp:7666
9 	xul.dll 	nsCSSFrameConstructor::RecreateFramesForContent 	layout/base/nsCSSFrameConstructor.cpp:11091
10 	xul.dll 	nsCSSFrameConstructor::ProcessRestyledFrames 	layout/base/nsCSSFrameConstructor.cpp:9824
11 	xul.dll 	nsCSSFrameConstructor::RestyleElement 	layout/base/nsCSSFrameConstructor.cpp:9893
12 	xul.dll 	nsCSSFrameConstructor::ProcessOneRestyle 	layout/base/nsCSSFrameConstructor.cpp:13217
13 	xul.dll 	nsCSSFrameConstructor::ProcessPendingRestyles 	layout/base/nsCSSFrameConstructor.cpp:13311
14 	xul.dll 	PresShell::DoFlushPendingNotifications 	layout/base/nsPresShell.cpp:4538
15 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4502
16 	xul.dll 	nsCSSFrameConstructor::RestyleEvent::Run 	layout/base/nsCSSFrameConstructor.cpp:13384
17 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
18 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
19 	nspr4.dll 	PR_GetEnv 	
20 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:87
21 	firefox.exe 	firefox.exe@0x2197 	
22 	kernel32.dll 	BaseProcessStart 	

In a debug build, I'm also seeing this assertion:
###!!! ASSERTION: Popup containing block is missing: '!aState.mRootBox', file c:
/mozilla-build-1.3/mozilla-central/layout/base/nsCSSFrameConstructor.cpp, line 6
040

Comment 1

[Serge Gautherie (:sgautherie)]

(In reply to comment #0)

> I guess this could be fixed by bug 455063.

Did that bug fix this one ?

Comment 2

[Martijn Wargers (dead)]

No, still crashes in current trunk build.

Comment 3

[Bernd]

this triggers the assert at nsCSSFrameContructor::ConstructXULFrame line 6060.


#ifdef NS_DEBUG
          NS_ASSERTION(aState.mPopupItems.containingBlock->GetType() ==
                       nsGkAtoms::popupSetFrame,
                       "Popup containing block isn't a nsIPopupSetFrame");
#endif

The problem is that containingBlock refers to deleted content

Boris do you know deals with that (not asking you I know your items list)

Comment 4

[Boris Zbarsky [:bzbarsky]]

Looks to me similar to bug 454751 (like "probably duplicate" similar).

Comment 5

[Martijn Wargers (dead)]

Yes, this is worksforme now in current trunk build.