91431 - crash, onMouseOver altering element.style.display

Status: RESOLVED WORKSFORME

(Core :: DOM: CSS Object Model, defect)

Description

[Dave Nichols]

The left hand side navigation menus use onMouseOver JS to 
display subsections. Doing this several times corrupts the 
menus and eventually crashes Mozilla.

NT4 (SP6), 0.9.2+, 20010716

This has been happening for a while, e.g. Talkback IDs include:
TB32984257Z, TB32984219Z

Sometimes this doesn't happen the first few times after restarting 
the computer but eventually re-appears.

This website is a major UK newspaper.

I have reduced the page to a testcase, which I will attach.

Notably, if the line 
position : absolute;
is removed from the testcase CSS then the crash disppears.

Comment 1

[Dave Nichols]

Attachment: testcase - reduced from www.independent.co.uk

Comment 2

[Dave Nichols]

Talkback ID TB33075067E
derives from the reduced testcase, rather than the URL

Comment 3

[hirata masakazu]

Confirming and All/All
2001071809 trunk for MacOS crashed with the testcase.

Comment 4

[Asa Dotzler [:asa]]

Incident ID 33075067
Stack Signature 0x00000000 f3948eb8
Bug ID
Trigger Time 2001-07-18 22:31:21
User Comments
Build ID 2001071607
Product ID MozillaTrunk
Platform ID Win32
Stack Trace
0x00000000
nsCSSFrameConstructor::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 9972]
StyleSetImpl::AttributeChanged
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1156]
PresShell::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4937]
nsDocument::AttributeChanged
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1695]
nsHTMLDocument::AttributeChanged
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line
1285]
nsDOMCSSAttributeDeclaration::ParseDeclaration
[d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp,
line 346]
nsDOMCSSDeclaration::SetProperty
[d:\builds\seamonkey\mozilla\content\html\style\src\nsDOMCSSDeclaration.cpp,
line 208]
nsDOMCSSDeclaration::SetDisplay
[d:\builds\seamonkey\mozilla\content\html\style\src\nsDOMCSSDeclaration.cpp,
line 736]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 139]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1883]
XPC_WN_GetterSetter
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1277]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897]
js_SetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2556]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2549]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3322]
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 945]
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140]
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1162]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1332]
nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericElement.cpp, line 1675]
nsGenericHTMLElement::HandleDOMEventForAnchors
[d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp,
line 1247]
nsHTMLLinkElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLLinkElement.cpp,
line 297]
nsGenericDOMDataNode::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsGenericDOMDataNode.cpp, line 678]
nsTextNode::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\base\src\nsTextNode.cpp, line 249]
nsEventStateManager::GenerateMouseEnterExit
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2118]
nsEventStateManager::PreHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 355]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5628]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5560]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 377]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 350]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 350]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2057]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 725]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 742]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4243]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4490]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3234]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 990]
USER32.dll + 0x124c (0x77e7124c)

Comment 5

[Doron Rosenberg (IBM)]

really moving

Comment 6

[Boris Zbarsky [:bzbarsky]]

Looks like a dup of worksforme bug 99059

Comment 7

[Dave Nichols]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.4+) Gecko/20011008

now works fine with my testcase and the URL. Something checked in 
since the last milestone has fixed this. 
should be --> Worksforme

(my previous milestone didn't crash on bug 99059, 
so these 2 might not be dups, but at least 
they both work now)