93564 - Crash upon loading of page when stylesheet dynamically added and select list cleared

Status: RESOLVED WORKSFORME

(Core :: DOM: CSS Object Model, defect)

Description

[Ryan]

The crash is caused by dynamically adding a stylesheet and then attempting to
clear a non-empty select list in the same thread (flow?) of execution.  If the
select list is empty, crash does not occur.  If the list is cleared with a
button (or the style sheet is added with a button), the crash does not occur. 
Not sure, but this might be related to bug 93106 (sounds at least a little similar).

Comment 1

[Ryan]

Attachment: Main file, just browse to it to crash.

Comment 2

[Ryan]

Attachment: Simple external stylesheet that gets loaded dynamically

Comment 3

[Matthias Versen [:Matti]]

confirming with win2k buiild 20010803..

I got a crash after I reloaded the testcase.

Stack Trace:
nsSupportsArray::Clear(nsSupportsArray * const 0x036ee7f0) line 416 + 36 bytes
nsSupportsArray::DeleteArray() line 141
nsSupportsArray::~nsSupportsArray() line 57
nsSupportsArray::`vector deleting destructor'(unsigned int 1) + 81 bytes
nsSupportsArray::Release(nsSupportsArray * const 0x036ee7f0) line 75 + 130 bytes
StyleSetImpl::~StyleSetImpl() line 312 + 27 bytes
StyleSetImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes
StyleSetImpl::Release(StyleSetImpl * const 0x0366c240) line 324 + 157 bytes
nsCOMPtr<nsIStyleSet>::assign_assuming_AddRef(nsIStyleSet * 0x00000000) line 472
nsCOMPtr<nsIStyleSet>::assign_with_AddRef(nsISupports * 0x00000000) line 964
nsCOMPtr<nsIStyleSet>::operator=(nsIStyleSet * 0x00000000) line 584
PresShell::Destroy(PresShell * const 0x039a8f20) line 1726
DocumentViewerImpl::Destroy(DocumentViewerImpl * const 0x039a8ba8) line 1206
DocumentViewerImpl::Show(DocumentViewerImpl * const 0x039f1670) line 1438
PresShell::UnsuppressAndInvalidate() line 4614
PresShell::ProcessReflowCommands(int 1) line 5997
ReflowEvent::HandleEvent() line 5770
HandlePLEvent(ReflowEvent * 0x03a78e80) line 5784
PL_HandleEvent(PLEvent * 0x03a78e80) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00e990b8) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x000d0602, unsigned int 49416, unsigned int 0, 
long 15306936) line 1071 + 9 bytes
USER32! 77e02e98()
USER32! 77e030e0()
USER32! 77e05824()
nsAppShellService::Run(nsAppShellService * const 0x00f8e750) line 425
main1(int 2, char * * 0x003578d8, nsISupports * 0x00000000) line 1290 + 32 bytes
main(int 2, char * * 0x003578d8) line 1599 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87d08()

Comment 4

[Boris Zbarsky [:bzbarsky]]

I don't see this crash in current builds....

jkeiser, how does your branch do on this testcase?

Comment 5

[John Keiser (jkeiser)]

Attachment: Testcase that loads correct CSS file

Comment 6

[John Keiser (jkeiser)]

Branch is fine.  Can someone confirm that this no longer happens on Windows?

Comment 7

[mike west]

The test case doesn't crash me on windows 2000 running build 2001100103.  Looks
like it's working fine.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Marking worksforme.  Ryan, please reopen if you see this again....