496366 - Crash [@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal] with frameset in binding and onerror removing window

Status: RESOLVED DUPLICATE of bug 531176

(Core :: DOM: Events, defect)

Description

[Martijn Wargers (dead)]

Attachment: zipped up testcase

See zipped up testcase. To reproduce the crash, open the file named 'parentframe3.htm' and wait 1 second.

http://crash-stats.mozilla.com/report/index/63bb7fb1-c9b4-4ea4-bb2e-88dbc2090604?p=1
0  	xul.dll  	nsCSSFrameConstructor::AddFrameConstructionItemsInternal  	 layout/base/nsCSSFrameConstructor.cpp:5296
1 	xul.dll 	nsCSSFrameConstructor::AddFrameConstructionItems 	layout/base/nsCSSFrameConstructor.cpp:5199
2 	xul.dll 	nsCSSFrameConstructor::ContentInserted 	layout/base/nsCSSFrameConstructor.cpp:6571
3 	xul.dll 	nsCSSFrameConstructor::RecreateFramesForContent 	layout/base/nsCSSFrameConstructor.cpp:8866
4 	xul.dll 	nsCSSFrameConstructor::ProcessRestyledFrames 	layout/base/nsCSSFrameConstructor.cpp:7522
5 	xul.dll 	PresShell::RecreateFramesFor 	layout/base/nsPresShell.cpp:3667
6 	xul.dll 	PresShell::GetPrimaryFrameFor 	layout/base/nsPresShell.cpp:5218
7 	xul.dll 	nsXBLStreamListener::Load

This also crashes Firefox 3.0.x:
http://crash-stats.mozilla.com/report/index/f48f0e4c-2a5a-4c2d-be4f-dfc3d2090604
0  	xul.dll  	nsCSSFrameConstructor::AdjustParentFrame  	 mozilla/layout/base/nsCSSFrameConstructor.cpp:3524
1 	xul.dll 	nsCSSFrameConstructor::ConstructFrameInternal 	mozilla/layout/base/nsCSSFrameConstructor.cpp:7668
2 	xul.dll 	nsCSSFrameConstructor::ConstructFrame 	mozilla/layout/base/nsCSSFrameConstructor.cpp:7580
3 	xul.dll 	nsCSSFrameConstructor::ContentInserted 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9152
4 	xul.dll 	nsCSSFrameConstructor::RecreateFramesForContent 	mozilla/layout/base/nsCSSFrameConstructor.cpp:11315
5 	xul.dll 	nsCSSFrameConstructor::ProcessRestyledFrames 	mozilla/layout/base/nsCSSFrameConstructor.cpp:10048
6 	xul.dll 	PresShell::RecreateFramesFor 	mozilla/layout/base/nsPresShell.cpp:3377
7 	xul.dll 	PresShell::GetPrimaryFrameFor 	mozilla/layout/base/nsPresShell.cpp:4840
8 	xul.dll 	nsXBLBindingRequest::DocumentLoaded 	mozilla/content/xbl/src/nsXBLService.cpp:235

Perhaps that stack is related to bug 468211?

The xmlhttprequest thing needed for the crash reminds me of bug 494617.

Comment 1

[Samuel Sidler (old account; do not CC)]

dbaron: I think this is your realm, but if not, please assign to someone who can work on this.

Comment 2

[Brandon Sterne (:bsterne)]

dbaron, can we get some help on this one?

The testcase does not crash trunk, but does crash all older branches:

Firefox 3.6:
3ce26dc1-7e1f-4791-b46a-4bb9d2100202

Firefox 3.5:
a92ed011-36a8-4f17-ae88-bbf8a2100202

Firefox 3:
322e38ac-e89d-4fe2-b630-a20c82100202

Comment 3

[Timothy Nikkel (:tnikkel)]

Fixed by something in this range
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=58359ad70d1b&tochange=f6f1982d758d

Which I think is probably http://hg.mozilla.org/mozilla-central/rev/e58c2ef1d65b or bug 531176.

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Sorry, I didn't see that this got assigned to me.

Yes, almost definitely looks like that's what fixed it.

Comment 5

[Johnny Stenback (:jst)]

Olli, can you have a look here? Seems like it might be a simple matter of backporting the fix for bug 531176 to 1.9.1...

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

The branch patches in Bug 531176 fixes this one.