The default bug view has changed. See this FAQ.

removeChild() causes crash

VERIFIED FIXED

Status

()

Core
DOM
P1
critical
VERIFIED FIXED
19 years ago
11 years ago

People

(Reporter: Angus Davis, Assigned: buster)

Tracking

Trunk
x86
Windows NT
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(URL)

(Reporter)

Description

19 years ago
See URL for test case. Partial stack trace:

nsCSSBlockFrame::FrameDeletedReflow(nsCSSBlockReflowState & {...}) line 1889 + 3
bytes
nsCSSBlockFrame::ReflowAround(nsCSSBlockFrame * const 0x010ba6a0, nsIPresContext
& {...}, nsISpaceManager * 0x010b7d00, nsReflowMetrics & {...}, const
nsReflowState & {...}, nsRect & {...}, unsigned int & 1073741824) line 1309 + 18
bytes
nsCSSBlockFrame::ReflowBlockFrame(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0, nsIFrame * 0x010ba650, unsigned int & 16640) line 2313 + 47 bytes
nsCSSBlockFrame::ReflowLine(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0, unsigned int & 16640) line 2087 + 24 bytes
nsCSSBlockFrame::ReflowLinesAt(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0) line 1959 + 20 bytes
nsCSSBlockFrame::ChildIncrementalReflow(nsCSSBlockReflowState & {...}) line 1928
+ 19 bytes
nsCSSBlockFrame::ReflowAround(nsCSSBlockFrame * const 0x010b7e80, nsIPresContext
& {...}, nsISpaceManager * 0x010b7d00, nsReflowMetrics & {...}, const
nsReflowState & {...}, nsRect & {...}, unsigned int & 0) line 1321 + 18 bytes
nsBodyFrame::Reflow(nsBodyFrame * const 0x010b7c70, nsIPresContext & {...},
nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 222
nsContainerFrame::ReflowChild(nsIFrame * 0x010b7c70, nsIPresContext *
0x0109c3c0, nsReflowMetrics & {...}, const nsReflowState & {...}) line 495
RootContentFrame::Reflow(RootContentFrame * const 0x010b79e0, nsIPresContext &
{...}, nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0)
line 324 + 27 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x010b79e0, nsIPresContext *
0x0109c3c0, nsReflowMetrics & {...}, const nsReflowState & {...}) line 495
RootFrame::Reflow(RootFrame * const 0x010b7960, nsIPresContext & {...},
nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 132
+ 27 bytes
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x010cc320,
nsIPresContext & {...}, nsReflowMetrics & {...}, const nsSize & {...}) line 133
PresShell::ProcessReflowCommands() line 569
PresShell::ContentHasBeenRemoved(PresShell * const 0x0109d864, nsIDocument *
0x0109b340, nsIContent * 0x010ba1b0, nsIContent * 0x010ba2f0, int 0) line 738
nsDocument::ContentHasBeenRemoved(nsIContent * 0x010ba1b0, nsIContent *
0x010ba2f0, int 0) line 558
nsHTMLContainer::RemoveChildAt(nsHTMLContainer * const 0x010ba1b0, int 0, int 1)
line 222
nsHTMLContainer::RemoveChild(nsHTMLContainer * const 0x010ba1b4, nsIDOMNode *
0x010ba2f4, nsIDOMNode * * 0x0012e7b8) line 1068 + 22 bytes
NodeRemoveChild(JSContext * 0x0109f420, JSObject * 0x01474970, unsigned int 1,
long * 0x014700b4, long * 0x0012e84c) line 669 + 25 bytes
js_Invoke(JSContext * 0x0109f420, unsigned int 1, int 0) line 630 + 26 bytes
(Reporter)

Updated

19 years ago
Component: Unknown → DOM
(Reporter)

Updated

19 years ago
(Reporter)

Comment 1

19 years ago
pushing test case to mozilla.org and updating URL field
(Reporter)

Updated

19 years ago
Assignee: joki → vidur
(Reporter)

Comment 2

19 years ago
I think this is vidur's bug, but not sure. reassigning.
(Reporter)

Comment 3

19 years ago
Can someone take a look into this bug please? It's still there, and since
replaceChild doesn't work either, this is making it very hard to demo this sort
of feature.
(Reporter)

Comment 4

19 years ago
Adding Kipp and Nisheeth to cc: list.

Updated

19 years ago
Assignee: vidur → troy

Comment 5

19 years ago
I don't know if this one is troy's or kipp's but its not vidur's.  We're
crashing on a null LineData pointer in FrameRemovedReflow.  Angus seems to be
getting anxious.  You guys want to look at this?

Updated

19 years ago
Assignee: troy → kipp

Comment 6

19 years ago
Block frame code so I'm reassigning to Kipp

Updated

19 years ago
Status: NEW → RESOLVED
Last Resolved: 19 years ago
Resolution: --- → FIXED

Updated

18 years ago
QA Contact: 4141

Comment 7

18 years ago
who resolved this bug? how did it get resolved -- did you check in code?

Updated

18 years ago
QA Contact: 4141 → 3849

Comment 8

18 years ago
does not crash on win95, Phillip checking on WinNT

Updated

18 years ago
Status: RESOLVED → VERIFIED

Comment 9

18 years ago
this works on nt4,macos851,redhat52i386 on the 04.Feb.1999 builds,
so i'm verifying fixed.

it doesn't crash anymore, but the testcase is
broken because it incorrectly uses the DOM Level 1 Core method
(of the Element Object). "setDOMAttribute" should be changed to
"setAttribute". Any ideas of who i can contact about updating the
testcase? ( i have a working copy at
http://wetnap.mcom.com/seamonkey/bugs/bug691.html ) -- it adds an image
on mouseover and removes it on mouse out....

Comment 10

11 years ago
RCS file: /cvsroot/mozilla/testing/mochitest/tests/test_bug691.html,v
done
Checking in tests/test_bug691.html;
/cvsroot/mozilla/testing/mochitest/tests/test_bug691.html,v  <--  test_bug691.html
initial revision: 1.1
done
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.