Last Comment Bug 691 - removeChild() causes crash
: removeChild() causes crash
Status: VERIFIED FIXED
:
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: x86 Windows NT
: P1 critical (vote)
: ---
Assigned To: buster
: rubydoo123
: Andrew Overholt [:overholt]
Mentors:
http://www.mozilla.org/nglayout/testc...
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 1998-08-26 07:00 PDT by Angus Davis
Modified: 2006-10-29 11:24 PST (History)
4 users (show)
sayrer: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Angus Davis 1998-08-26 07:00:00 PDT
See URL for test case. Partial stack trace:

nsCSSBlockFrame::FrameDeletedReflow(nsCSSBlockReflowState & {...}) line 1889 + 3
bytes
nsCSSBlockFrame::ReflowAround(nsCSSBlockFrame * const 0x010ba6a0, nsIPresContext
& {...}, nsISpaceManager * 0x010b7d00, nsReflowMetrics & {...}, const
nsReflowState & {...}, nsRect & {...}, unsigned int & 1073741824) line 1309 + 18
bytes
nsCSSBlockFrame::ReflowBlockFrame(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0, nsIFrame * 0x010ba650, unsigned int & 16640) line 2313 + 47 bytes
nsCSSBlockFrame::ReflowLine(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0, unsigned int & 16640) line 2087 + 24 bytes
nsCSSBlockFrame::ReflowLinesAt(nsCSSBlockReflowState & {...}, LineData *
0x010ba6e0) line 1959 + 20 bytes
nsCSSBlockFrame::ChildIncrementalReflow(nsCSSBlockReflowState & {...}) line 1928
+ 19 bytes
nsCSSBlockFrame::ReflowAround(nsCSSBlockFrame * const 0x010b7e80, nsIPresContext
& {...}, nsISpaceManager * 0x010b7d00, nsReflowMetrics & {...}, const
nsReflowState & {...}, nsRect & {...}, unsigned int & 0) line 1321 + 18 bytes
nsBodyFrame::Reflow(nsBodyFrame * const 0x010b7c70, nsIPresContext & {...},
nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 222
nsContainerFrame::ReflowChild(nsIFrame * 0x010b7c70, nsIPresContext *
0x0109c3c0, nsReflowMetrics & {...}, const nsReflowState & {...}) line 495
RootContentFrame::Reflow(RootContentFrame * const 0x010b79e0, nsIPresContext &
{...}, nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0)
line 324 + 27 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x010b79e0, nsIPresContext *
0x0109c3c0, nsReflowMetrics & {...}, const nsReflowState & {...}) line 495
RootFrame::Reflow(RootFrame * const 0x010b7960, nsIPresContext & {...},
nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 132
+ 27 bytes
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x010cc320,
nsIPresContext & {...}, nsReflowMetrics & {...}, const nsSize & {...}) line 133
PresShell::ProcessReflowCommands() line 569
PresShell::ContentHasBeenRemoved(PresShell * const 0x0109d864, nsIDocument *
0x0109b340, nsIContent * 0x010ba1b0, nsIContent * 0x010ba2f0, int 0) line 738
nsDocument::ContentHasBeenRemoved(nsIContent * 0x010ba1b0, nsIContent *
0x010ba2f0, int 0) line 558
nsHTMLContainer::RemoveChildAt(nsHTMLContainer * const 0x010ba1b0, int 0, int 1)
line 222
nsHTMLContainer::RemoveChild(nsHTMLContainer * const 0x010ba1b4, nsIDOMNode *
0x010ba2f4, nsIDOMNode * * 0x0012e7b8) line 1068 + 22 bytes
NodeRemoveChild(JSContext * 0x0109f420, JSObject * 0x01474970, unsigned int 1,
long * 0x014700b4, long * 0x0012e84c) line 669 + 25 bytes
js_Invoke(JSContext * 0x0109f420, unsigned int 1, int 0) line 630 + 26 bytes
Comment 1 Angus Davis 1998-09-20 21:38:59 PDT
pushing test case to mozilla.org and updating URL field
Comment 2 Angus Davis 1998-10-22 17:27:59 PDT
I think this is vidur's bug, but not sure. reassigning.
Comment 3 Angus Davis 1998-11-07 20:26:59 PST
Can someone take a look into this bug please? It's still there, and since
replaceChild doesn't work either, this is making it very hard to demo this sort
of feature.
Comment 4 Angus Davis 1998-11-11 08:32:59 PST
Adding Kipp and Nisheeth to cc: list.
Comment 5 joki (gone) 1998-11-13 12:50:59 PST
I don't know if this one is troy's or kipp's but its not vidur's.  We're
crashing on a null LineData pointer in FrameRemovedReflow.  Angus seems to be
getting anxious.  You guys want to look at this?
Comment 6 troy 1998-11-13 13:08:59 PST
Block frame code so I'm reassigning to Kipp
Comment 7 rubydoo123 1999-02-01 14:22:59 PST
who resolved this bug? how did it get resolved -- did you check in code?
Comment 8 rubydoo123 1999-02-09 09:10:59 PST
does not crash on win95, Phillip checking on WinNT
Comment 9 phillip 1999-02-09 09:44:59 PST
this works on nt4,macos851,redhat52i386 on the 04.Feb.1999 builds,
so i'm verifying fixed.

it doesn't crash anymore, but the testcase is
broken because it incorrectly uses the DOM Level 1 Core method
(of the Element Object). "setDOMAttribute" should be changed to
"setAttribute". Any ideas of who i can contact about updating the
testcase? ( i have a working copy at
http://wetnap.mcom.com/seamonkey/bugs/bug691.html ) -- it adds an image
on mouseover and removes it on mouse out....
Comment 10 Robert Sayre 2006-10-29 11:24:26 PST
RCS file: /cvsroot/mozilla/testing/mochitest/tests/test_bug691.html,v
done
Checking in tests/test_bug691.html;
/cvsroot/mozilla/testing/mochitest/tests/test_bug691.html,v  <--  test_bug691.html
initial revision: 1.1
done

Note You need to log in before you can comment on or make changes to this bug.