8469 - Colors page on preferences dialog crashes RAPTORHTML

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[Andrew Niese]

Clicking "Colors" on preferences dialog causes crash in RAPTORHTML.DLL using
Win32 build 1999061708


Machine information
--------------------

Running Windows 98 on 128 MB machine, pentium II 300



Steps to reproduce
-------------------

1) Click [Edit] menu
2) Click [Preferences]
3) Click [Colors], the subitem under [Navigator] on the left side.
4) Crash




Last few lines of apprunner:
------------------------------

Doing Top startup...
Looking up prefwindow object...
Creating prefwindow object...
Loading chrome://pref/content/pref-colors.xul...
Looking up prefwindow object...
Creating prefwindow object......created
Loading  url chrome://pref/content/pref-colors.xul in WEbshell 5291e50





Crash stuff:
--------------

APPRUNNER caused an invalid page fault in
module RAPTORHTML.DLL at 0177:00dd1a09.
Registers:
EAX=052c2650 CS=0177 EIP=00dd1a09 EFLGS=00010206
EBX=049b30f0 SS=017f ESP=0076eed8 EBP=0076ef10
ECX=0076ef20 DS=017f ESI=00000000 FS=45af
EDX=009567c0 ES=017f EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 51 56 89 75 d8 89 7d e4 ff 50 20 8d 4d e8
Stack dump:
00931760 0076ef60 00d736d8 04aa0f10 00000024 00000000 052c2650 00000024 7800136c
78034108 0076ef84 78001417 00000000 009567c0 0076ef84 00d73701

Comment 1

[rickg]

This does indeed crash. Peter, please take a quick look, and if it's XUL related
pass this to Hyatt. I'm starting with you because ResolveStyleContextFor() is on
the top of the stack. It could easily be XUL related.

nsDebug::Assertion(const char * 0x015c36ac, const char * 0x015c36a0, const char
* 0x015c3674, int 517) line 150 + 13 bytes
StyleSetImpl::ResolveStyleFor(nsIPresContext * 0x04190b90, nsIContent *
0x00000000, nsIStyleContext * 0x00000000, int 0) line 517 + 32 bytes
nsPresContext::ResolveStyleContextFor(nsPresContext * const 0x04190b90,
nsIContent * 0x00000000, nsIStyleContext * 0x00000000, int 0, nsIStyleContext *
* 0x0012e034) line 369 + 38 bytes
XULDocumentImpl::StartLayout() line 3909 + 66 bytes
XULDocumentImpl::EndLoad(XULDocumentImpl * const 0x04145330) line 1831
XULContentSinkImpl::DidBuildModel(XULContentSinkImpl * const 0x04108a50, int 1)
line 508
CWellFormedDTD::DidBuildModel(CWellFormedDTD * const 0x0417ccd0, unsigned int 0,
int 1, nsIParser * 0x041048b0, nsIContentSink * 0x04108a50) line 286 + 20 bytes
nsParser::DidBuildModel(unsigned int 0) line 507 + 55 bytes
nsParser::ResumeParse(nsIDTD * 0x00000000) line 855
nsParser::OnDataAvailable(nsParser * const 0x041048b4, nsIURL * 0x0418f270,
nsIInputStream * 0x04146f80, unsigned int 2211) line 1071 + 17 bytes
nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x0418f2f0,
nsIURL * 0x0418f270, nsIInputStream * 0x04146f80, unsigned int 2211) line 1504 +
24 bytes
OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const
0x04145560) line 634
StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x04145564) line 473 + 12
bytes
PL_HandleEvent(PLEvent * 0x04145564) line 491 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00c35280) line 452 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00670544, unsigned int 49311, unsigned int 0,
long 12800640) line 877 + 9 bytes
USER32! 77e71250()
00c35280()

Comment 2

[Peter Linss]

nsXULDocument is tripping a precondition in the style set by attempting to
resolve style for a nsnull content node (mRootContent)

Comment 3

[David Hyatt]

This occurs whenever the XUL document is malformed, i.e., when it's malformed no
root gets made.

There must be an error in the XUL file somewhere.

Comment 4

[mcmullen]

I fixed the content problem, which is bug 7902, Please refer to that bug for
several examples of malformed XUL which cause hard crashes.

Comment 5

[Peter Linss]

*** Bug 8838 has been marked as a duplicate of this bug. ***

Comment 6

[David Hyatt]

Fixed.

Comment 7

[Chris Petersen]

I would like to verify this fix but can't find "color" option in the Preference
dialog. I'm using Apprunner July 1 build (1999070108) under Win 98.

Comment 8

[Chris Petersen]

Fixed in the July 6th build.

Comment 9

[leger]

BULK MOVE: Changing component from XUL to XP Toolkit/Widgets: XUL.  XUL 
component will be deleted.