66141 - scrollbar gets stuck, segmentation fault soon after

Status: VERIFIED DUPLICATE of bug 55334

(Core :: DOM: Core & HTML, defect)

Description

[Rickard Westman]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.14 i586; en-US; m18) Gecko/20010121
BuildID:    2001012106 (as well as mozilla 0.7)

Certain interactions with this page causes a reproducable segmentation fault
(details below.)

Reproducible: Always
Steps to Reproduce:
1. Load problematic URL

2. There is a JPEG picture of a scanned text page below the
   text "Klickbar bild".  Click on it.  (Its URL is  
   http://www.dn.se/DNet/articles/146300-146399/146375/spar-1.jpg 
   and the feedback its feedback string is javascript:NyBild3().)

3. The contents of the frame is replaced with an enlarged version
   of the JPEG picture, and some additional text.  

4. Note that the scrollbar thumb seems to be improperly scaled (to 
   short).

5. Try to scroll the pane using the scrollbar thumb.  It's stuck, but
   you must try to drag it to reproduce the bug.

6. Open a new Navigator window.

7. Close the original window.  


Actual Results:  You get a segmentation fault originating in NSGetModule().  gdb 
backtrace to be attached.

Expected Results:  Mozilla should not have segfaulted.

The URL given is on a newspaper website, and may be somewhat 
ephemeral (might be gone in a week or so.)

Comment 1

[Rickard Westman]

Attachment: gdb backtrace after segfault (produced with mozilla 0.7)

Comment 2

[Doron Rosenberg (IBM)]

i don't get the crash on win98, but do see the wierd frame issue. can anyone get
this crash on a new nightly?

Comment 3

[Håkan Waara]

I don't get a segfault, but rather the bottom-right frame just crashes; i can't
use the scrollbar in it.

Confirming bug.

Comment 4

[Fabian Guisset]

scrollbars -> xptoolkit/widgets for first triage. please reassign if i'm too
silly to figure it out by myself

Comment 5

[John Morrison]

I'm going to assume the crash (which I can't reproduce) is a follow-on to some 
unexpected situation that the browser has gotten into. 

When you click on that link, the JS does one big document.write to create 
the next "page". That seems to screw up the scrollbars. I'll attach a simple
testcase where you get no scrollbars in the new document.

I think this is similar to other js/dom issues with generated content. 
-> jst/DOM0, cc: evaughan if he knows what's up with the scrollbar.

Comment 6

[John Morrison]

Attachment: testcase; click on link does document.write(); no scrollbars on new content

Comment 7

[Johnny Stenback (:jst)]

*** This bug has been marked as a duplicate of 55334 ***

Comment 8

[John Morrison]

Da!