691 - removeChild() causes crash

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Angus Davis]

See URL for test case. Partial stack trace:

nsCSSBlockFrame::FrameDeletedReflow(nsCSSBlockReflowState & {...}) line 1889 + 3
bytes
nsCSSBlockFrame::ReflowAround(nsCSSBlockFrame * const 0x010ba6a0, nsIPresContext
& {...}, nsISpaceManager * 0x010b7d00, nsReflowMetrics & {...}, const
nsReflowState & {...}, nsRect & {...}, unsigned int & 1073741824) line 1309 + 18
bytes
nsCSSBlockFrame::ReflowBlockFrame(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0, nsIFrame * 0x010ba650, unsigned int & 16640) line 2313 + 47 bytes
nsCSSBlockFrame::ReflowLine(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0, unsigned int & 16640) line 2087 + 24 bytes
nsCSSBlockFrame::ReflowLinesAt(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0) line 1959 + 20 bytes
nsCSSBlockFrame::ChildIncrementalReflow(nsCSSBlockReflowState & {...}) line 1928
+ 19 bytes
nsCSSBlockFrame::ReflowAround(nsCSSBlockFrame * const 0x010b7e80, nsIPresContext
& {...}, nsISpaceManager * 0x010b7d00, nsReflowMetrics & {...}, const
nsReflowState & {...}, nsRect & {...}, unsigned int & 0) line 1321 + 18 bytes
nsBodyFrame::Reflow(nsBodyFrame * const 0x010b7c70, nsIPresContext & {...},
nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 222
nsContainerFrame::ReflowChild(nsIFrame * 0x010b7c70, nsIPresContext *
0x0109c3c0, nsReflowMetrics & {...}, const nsReflowState & {...}) line 495
RootContentFrame::Reflow(RootContentFrame * const 0x010b79e0, nsIPresContext &
{...}, nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0)
line 324 + 27 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x010b79e0, nsIPresContext *
0x0109c3c0, nsReflowMetrics & {...}, const nsReflowState & {...}) line 495
RootFrame::Reflow(RootFrame * const 0x010b7960, nsIPresContext & {...},
nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 132
+ 27 bytes
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x010cc320,
nsIPresContext & {...}, nsReflowMetrics & {...}, const nsSize & {...}) line 133
PresShell::ProcessReflowCommands() line 569
PresShell::ContentHasBeenRemoved(PresShell * const 0x0109d864, nsIDocument *
0x0109b340, nsIContent * 0x010ba1b0, nsIContent * 0x010ba2f0, int 0) line 738
nsDocument::ContentHasBeenRemoved(nsIContent * 0x010ba1b0, nsIContent *
0x010ba2f0, int 0) line 558
nsHTMLContainer::RemoveChildAt(nsHTMLContainer * const 0x010ba1b0, int 0, int 1)
line 222
nsHTMLContainer::RemoveChild(nsHTMLContainer * const 0x010ba1b4, nsIDOMNode *
0x010ba2f4, nsIDOMNode * * 0x0012e7b8) line 1068 + 22 bytes
NodeRemoveChild(JSContext * 0x0109f420, JSObject * 0x01474970, unsigned int 1,
long * 0x014700b4, long * 0x0012e84c) line 669 + 25 bytes
js_Invoke(JSContext * 0x0109f420, unsigned int 1, int 0) line 630 + 26 bytes

Comment 1

[Angus Davis]

pushing test case to mozilla.org and updating URL field

Comment 2

[Angus Davis]

I think this is vidur's bug, but not sure. reassigning.

Comment 3

[Angus Davis]

Can someone take a look into this bug please? It's still there, and since
replaceChild doesn't work either, this is making it very hard to demo this sort
of feature.

Comment 4

[Angus Davis]

Adding Kipp and Nisheeth to cc: list.

Comment 5

[joki (gone)]

I don't know if this one is troy's or kipp's but its not vidur's.  We're
crashing on a null LineData pointer in FrameRemovedReflow.  Angus seems to be
getting anxious.  You guys want to look at this?

Comment 6

[troy]

Block frame code so I'm reassigning to Kipp

Comment 7

[rubydoo123]

who resolved this bug? how did it get resolved -- did you check in code?

Comment 8

[rubydoo123]

does not crash on win95, Phillip checking on WinNT

Comment 9

[phillip]

this works on nt4,macos851,redhat52i386 on the 04.Feb.1999 builds,
so i'm verifying fixed.

it doesn't crash anymore, but the testcase is
broken because it incorrectly uses the DOM Level 1 Core method
(of the Element Object). "setDOMAttribute" should be changed to
"setAttribute". Any ideas of who i can contact about updating the
testcase? ( i have a working copy at
http://wetnap.mcom.com/seamonkey/bugs/bug691.html ) -- it adds an image
on mouseover and removes it on mouse out....

Comment 10

[Robert Sayre]

RCS file: /cvsroot/mozilla/testing/mochitest/tests/test_bug691.html,v
done
Checking in tests/test_bug691.html;
/cvsroot/mozilla/testing/mochitest/tests/test_bug691.html,v  <--  test_bug691.html
initial revision: 1.1
done