54454 - [FIX IN HAND,R=,A=] ASSERTION in FrameManager::ReResolveStyleContext

Status: VERIFIED FIXED

(Core :: Layout: Images, Video, and HTML Frames, defect, P3)

Description

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Open URL http://www.physik.fu-berlin.de/~fsi/statistik.html and move the mouse 
around. You will hit this assertion:

      NS_ASSERTION(localContent, "non pseudo-element frame without content 
node");

Stack trace:

NTDLL! 77f7629c()
nsDebug::Assertion(const char * 0x023e2b68, const char * 0x023e2b58, const char 
* 0x023e2b24, int 0x000005d1) line 256 + 13 bytes
FrameManager::ReResolveStyleContext(nsIPresContext * 0x02eecb70, nsIFrame * 
0x00f29ef8, nsIStyleContext * 0x0303e030, nsIContent * 0x02fc0d88, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000005) line 1489 + 32 bytes
FrameManager::ReResolveStyleContext(nsIPresContext * 0x02eecb70, nsIFrame * 
0x00eaed24, nsIStyleContext * 0x03039c10, nsIContent * 0x02fc20b8, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1643
FrameManager::ReResolveStyleContext(nsIPresContext * 0x02eecb70, nsIFrame * 
0x00eaebd4, nsIStyleContext * 0x02ef6120, nsIContent * 0x02fc20b8, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1643
FrameManager::ReResolveStyleContext(nsIPresContext * 0x02eecb70, nsIFrame * 
0x00eaeb80, nsIStyleContext * 0x00000000, nsIContent * 0x032e8918, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1466
FrameManager::ReResolveStyleContext(nsIPresContext * 0x02eecb70, nsIFrame * 
0x00fe7f18, nsIStyleContext * 0x02ef78a0, nsIContent * 0x00000000, int 
0xffffffff, nsIAtom * 0x00000000 {???}, nsStyleChangeList & {...}, int 
0x00000000, int & 0x00000000) line 1643
FrameManager::ComputeStyleChangeFor(FrameManager * const 0x02edcc90, 
nsIPresContext * 0x02eecb70, nsIFrame * 0x00fe7f18, int 0xffffffff, nsIAtom * 
0x00000000 {???}, nsStyleChangeList & {...}, int 0x00000000, int & 0x00000000) 
line 1884
nsCSSFrameConstructor::ContentStatesChanged(nsCSSFrameConstructor * const 
0x02ede620, nsIPresContext * 0x02eecb70, nsIContent * 0x02effa38, nsIContent * 
0x032e8918) line 9887
StyleSetImpl::ContentStatesChanged(StyleSetImpl * const 0x02ede6e0, 
nsIPresContext * 0x02eecb70, nsIContent * 0x02effa38, nsIContent * 0x032e8918) 
line 1183
PresShell::ContentStatesChanged(PresShell * const 0x02edc3b8, nsIDocument * 
0x03381e80, nsIContent * 0x02effa38, nsIContent * 0x032e8918) line 3618 + 49 
bytes
nsDocument::ContentStatesChanged(nsDocument * const 0x03381e80, nsIContent * 
0x02effa38, nsIContent * 0x032e8918) line 1863
nsEventStateManager::SetContentState(nsEventStateManager * const 0x0336e228, 
nsIContent * 0x02eff4f8, int 0x00000004) line 2568
nsEventStateManager::GenerateMouseEnterExit(nsIPresContext * 0x02eecb70, 
nsGUIEvent * 0x0012f8c8) line 1523
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x0336e228, 
nsIPresContext * 0x02eecb70, nsEvent * 0x0012f8c8, nsIFrame * 0x00f1b9ac, 
nsEventStatus * 0x0012f7b8, nsIView * 0x02ef0f80) line 306
PresShell::HandleEventInternal(nsEvent * 0x0012f8c8, nsIView * 0x02ef0f80, 
unsigned int 0x00000001, nsEventStatus * 0x0012f7b8) line 4249 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x02edc3b4, nsIView * 0x02ef0f80, 
nsGUIEvent * 0x0012f8c8, nsEventStatus * 0x0012f7b8, int 0x00000000, int & 
0x00000001) line 4190 + 25 bytes
nsView::HandleEvent(nsView * const 0x02ef0f80, nsGUIEvent * 0x0012f8c8, unsigned 
int 0x00000008, nsEventStatus * 0x0012f7b8, int 0x00000000, int & 0x00000001) 
line 379
nsView::HandleEvent(nsView * const 0x02ee24a0, nsGUIEvent * 0x0012f8c8, unsigned 
int 0x00000008, nsEventStatus * 0x0012f7b8, int 0x00000000, int & 0x00000001) 
line 352
nsView::HandleEvent(nsView * const 0x02ede940, nsGUIEvent * 0x0012f8c8, unsigned 
int 0x0000001c, nsEventStatus * 0x0012f7b8, int 0x00000001, int & 0x00000001) 
line 352
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x02edeb20, nsGUIEvent * 
0x0012f8c8, nsEventStatus * 0x0012f7b8) line 1439
HandleEvent(nsGUIEvent * 0x0012f8c8) line 68
nsWindow::DispatchEvent(nsWindow * const 0x02ee2364, nsGUIEvent * 0x0012f8c8, 
nsEventStatus & nsEventStatus_eIgnore) line 681 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f8c8) line 702
nsWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000) line 
3890 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 0x0000012c, nsPoint * 0x00000000) 
line 4100
nsWindow::ProcessMessage(unsigned int 0x00000200, unsigned int 0x00000000, long 
0x00d10119, long * 0x0012fc44) line 2937 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x000a0584, unsigned int 0x00000200, unsigned int 
0x00000000, long 0x00d10119) line 950 + 27 bytes
USER32!

Comment 1

[Marc Attinasi]

Thanks Heikki - I'll investigate.

Comment 2

[Marc Attinasi]

I have a reduced testcase, I'll attach it. It appears that a <COL> element is
causing problems...

Comment 3

[Marc Attinasi]

Attachment: Reduced testcase

Comment 4

[Marc Attinasi]

The problem is that <COL span='n'> causes a ColFrame to be created with no parent.

I have a patch to nsTableFrame::CreateAnonymousColFrames that fixes this, I'll
attach it. Basically, it just gets the content from the previous ColFrame.

Comment 5

[Marc Attinasi]

Attachment: Patch to fix the colframe that had no content.

Comment 6

[Marc Attinasi]

I am nominating this for RTM for the following reasons:
1) the fix is very simple and no-risk
2) although the error does not cause a crash in this testcase, it is unknown
what badness can result from a frame with no content - many places assume that a
frame has content

Chris K., can you please review the patch and either '+' or '-' this bug?

Comment 7

[karnaze (gone)]

Thanks, r=karnaze, marking rtm+.

Comment 8

[Phil Peterson]

PDT marking [rtm need info] since a super review is needed

Comment 9

[buster]

add a comment to your change citing the bug number, and you get a=buster.

Comment 10

[Marc Attinasi]

Commented. Thanks, Steve.

Comment 11

[Marc Attinasi]

Have r=a and a=, remarking rtm+ and waiting for PDT approval

Comment 12

[Phil Peterson]

PDT marking [rtm++]

Comment 13

[Marc Attinasi]

Fix checked into branch and trunk (nsTableFrame.cpp)

Comment 14

[Keyser Sose]

Works for me:
Platform: PC
OS: Windows 98
Mozilla Build #: 2000100508