47200 - www.crn.com crash

Status: VERIFIED DUPLICATE of bug 42372

(Core :: Layout, defect, P2)

Description

[Jon Granrose]

Reported on n.p.m.general:

Noticed this in the past few builds, ever since CRN updated their
website:

<http://www.crn.com/Sections/BreakingNews/default.asp>  Click on any news link,
instant crash.

What is causing this?

-----------------------
Scott I. Remick                    [e-mail]
Network and Information [phone] ext. 236
Systems Manager                    FAX:[phone]
Computer Alternatives, Inc.        http://www.computeralt.com


==============================================

Verified this crash exists on both the M17 branch and on the trunk.  Something
very weird going on with their site when mousing over links.  But even so, we
shouldn't crash on it.  Filed a talkback report, will attach when available.

Comment 1

[Jon Granrose]

Steps to reproduce:

1 - go to http://www.crn.com/sections/BreakingNews/default.asp
2 - click on any link in the middle news section.
3 - crash.

URL at the top of the news section right now is
http://www.crn.com/sections/BreakingNews/dailyarchives.asp?ArticleID=18911

Comment 2

[Jon Granrose]

Talkback stack trace is rather large, so I won't paste it here, but it's at
http://climate.mcom.com/reports/incidenttemplate.CFM?reportID=1129&style=0&tc=19&cp=2&bbid=15123584
and here's the first few lines:


0x00000004


nsFrameList::DestroyFrames

[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 35]

nsAbsoluteContainingBlock::DestroyFrames

[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp,
line 365]

nsPositionedInlineFrame::Destroy

[d:\builds\seamonkey\mozilla\layout\html\base\src\nsInlineFrame.cpp, line 945]

nsFrameList::DestroyFrames

[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsContainerFrame::Destroy

[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]

nsLineBox::DeleteLineList

[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineBox.cpp, line 252]

nsBlockFrame::Destroy

[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1222]

nsFrameList::DestroyFrames

[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsContainerFrame::Destroy

[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]

nsFrameList::DestroyFrames

[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsContainerFrame::Destroy

[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]

nsFrameList::DestroyFrames

[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsContainerFrame::Destroy

[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]

nsFrameList::DestroyFrames

[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

Comment 3

[Asa Dotzler [:asa]]

over to layout. 

Comment 4

[Andreas Franke (gone)]

OS=All. Seen on PC/Linux 2000080113-M18.

Comment 5

[Suresh Duddi (gone)]

Let me alternate betn. Marc and Nisheeth. :-)

Comment 6

[Nisheeth Ranjan]

Marc, layout issue.

Comment 7

[Marc Attinasi]

Scroll down and you see that the layout is all mesed up too... I'll investigate 
further, especially the ReflowState assertions (18 of them) when just loading 
the page.

Comment 8

[Marc Attinasi]

I could really really use some help narrowing this down. The page is huge and 
very complicated. I have narrowed down the style rules to one rule that will 
make this crash or not: 
#AIRboxwrapper  {visibility: visible; padding: 0px; 
                 border-width: 0px; border-style: none; 
                 margin: 0px; position: 
                 absolute; top: -405px; left: -55px; width: 155px;}

I have removed all other style rules and the LINK'd stylesheet and it still 
crashes. Also, I have removed large parts of the page (from the BODY to the 
table with the MAP) and it still crashes. There is lots of embedded script that 
makes it harder still to narrow down - please help if you can.

Approving for beta3+ since it is a crash in layout, apparently related to 
absolute positioning (though the exact nature of the crash is not yet known). 
Note that without being able to narrow this down it will probably nt get fixed, 
so your help is very much needed!

Comment 9

[Marc Attinasi]

I don't know how relevant this is, but the attachment 
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=12899 results in the 
same assertion, and it crashes on unload the same way too...

Comment 10

[Marc Attinasi]

After three days of debugging I found out it's a dup of another bug, marked 
beta3+ also, in Buster's queue (bug 42372).

This is a problem of frame parentage of relative and absolutely positioned 
elements...

*** This bug has been marked as a duplicate of 42372 ***

Comment 11

[Stephen Koren]

vrfy dupe