62470 - Crash visiting openprojects.nu [@nsHTMLContainerFrame::ReparentFrameViewList]

Status: VERIFIED FIXED

(Core :: Web Painting, defect, P3)

Description

[Sebastian Späth]

Win98, build 12/09:
100% reproducable crash in gkhtml.dll when visiting http://openprojects.nu.
Just downloading talkback build (BTW: 15MB is way too big!), will attach
talkback id, when finished.
This is a regression, it used to work earlier.

Comment 1

[Sebastian Späth]

Well, I couldn't open talkback to get the incident id's but I just sent 10 
minutes ago two incidents with my mail address [e-mail] as sender. 
You'll need to dig them yourselves out. These are about this crash.
Adding crash and regression keywords

Comment 2

[hirata masakazu]

reproducible in Mac build MTrunk2000112804.
Changing Platform and OS to all.

Comment 3

[Blake Ross]

I assert when going there:

###!!! ASSERTION: didn't find view: 'aOldParentFrame && aNewParentFrame', file C
:\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line 356

with this stack trace:

nsHTMLContainerFrame::ReparentFrameViewList(nsIPresContext * 0x03c3b0a0, 
nsIFrame * 0x00e7bcd8, nsIFrame * 0x0187c648, nsIFrame * 0x00000000) line 365 + 
11 bytes
MoveChildrenTo(nsIPresContext * 0x03c3b0a0, nsIStyleContext * 0x03c20780, 
nsIFrame * 0x00e7bd84, nsIFrame * 0x00e7bcd8) line 432 + 21 bytes
nsCSSFrameConstructor::SplitToContainingBlock(nsIPresContext * 0x03c3b0a0, 
nsFrameConstructorState & {...}, nsIFrame * 0x0187c744, nsIFrame * 0x00e7bb78, 
nsIFrame * 0x00e7bcd8, nsIFrame * 0x00e7bd4c, int 0) line 13140 + 26 bytes
nsCSSFrameConstructor::CantRenderReplacedElement(nsCSSFrameConstructor * const 
0x03beb5a0, nsIPresShell * 0x03c074b0, nsIPresContext * 0x03c3b0a0, nsIFrame * 
0x0187c744) line 10737
StyleSetImpl::CantRenderReplacedElement(StyleSetImpl * const 0x03beb660, 
nsIPresContext * 0x03c3b0a0, nsIFrame * 0x0187c744) line 1247 + 35 bytes
FrameManager::HandlePLEvent(CantRenderReplacedElementEvent * 0x03c47c30) line 
917
PL_HandleEvent(PLEvent * 0x03c47c30) line 576 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00fd7c30) line 509 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x000007d0, unsigned int 56962, unsigned int 0, 
long 16612400) line 1054 + 9 bytes
KERNEL32! bff63613()
KERNEL32! bff848f7()
007

This is troy's stuff, but he's gone.

Comment 4

[Blake Ross]

Attachment: minimized testcase

Comment 5

[Blake Ross]

Attachment: minimized testcase [last attachment had incorrect mimetype]

Comment 6

[Blake Ross]

Code that's crashing is:

<A href="about.html">
<OBJECT>
<H2>About</H2>
</OBJECT>
</A>

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This is a crash resulting from the combination of the frame construction code to
handle blocks within inlines and dealing with OBJECT/APPLET elements whose
alternate text is displayed (or something like that).

*** This bug has been marked as a duplicate of 59426 ***

Comment 8

[Sebastian Späth]

Reopening bug! This was marked dupe of a bug that (itself marked dupe now) is 
supposed to be fixed. It is not! This crasher still occurs with 01/11 build.

Comment 9

[Loco]

Crashes my Win NT build 01-11-04, but not my Mac 01-11-04.  Go figure.  Thanks
for catching this Sebastian...

Comment 10

[hirata masakazu]

*** Bug 65252 has been marked as a duplicate of this bug. ***

Comment 11

[Asa Dotzler [:asa]]

*** Bug 65367 has been marked as a duplicate of this bug. ***

Comment 12

[Sebastian Späth]

Reported crash does not longer occur, feel free to close this bug now
(Win98, nightly 01/22)

Comment 13

[Jonathan S Abrams]

Anyone test this on the other Windows OS's?

Comment 14

[buster]

this WFM on a 1/18/00 build on WinNT.  same for the bug marked a dup of this bug.

Comment 15

[Jonathan S Abrams]

Marking resolved.

Comment 16

[timeless]

*** Bug 66892 has been marked as a duplicate of this bug. ***

Comment 17

[Chris Petersen]

Works fine in the March 1 build. Marking verifed fixed.