Build: 2001111303 Win32 Talkback: TB38048606Y Situation: Browsing with image confirmation, visit a site that uses popups. Close the popup window before accepting or denying the images associated with it. Then accept the image. Result: Browser crashes Expected result: Browser doesn't crash. Preferred result: Closing the popup would kill the confirmation. Please do not make the confirmations modal!

CC: stephend@netscape.com for talkback retrieval, please (TB38048606Y)

Stack Signature nsRuleNode::ComputeBackgroundData 1966eea0 Bug ID Trigger Time 2001-11-15 07:16:51 Email Address mythdraug@pobox.com URL visited cnn.com User Comments Closed popup while image confirmation for that window was open Build ID 2001111309 Product ID MozillaTrunk Platform Operating System Win32 Module Trigger Reason Access violation Stack Trace nsRuleNode::ComputeBackgroundData [d:\builds\seamonkey\mozilla\content\base\src\nsRuleNode.cpp, line 2954] nsRuleNode::WalkRuleTree [d:\builds\seamonkey\mozilla\content\base\src\nsRuleNode.cpp, line 1457] nsRuleNode::GetBackgroundData [d:\builds\seamonkey\mozilla\content\base\src\nsRuleNode.cpp, line 1195] nsRuleNode::GetStyleData [d:\builds\seamonkey\mozilla\content\base\src\nsRuleNode.cpp, line 4315] nsStyleContext::GetStyleData [d:\builds\seamonkey\mozilla\content\base\src\nsStyleContext.cpp, line 380] nsHTMLContainerFrame::CreateViewForFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line 469] nsCSSFrameConstructor::ConstructFrameByTag [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 4748] nsCSSFrameConstructor::ConstructFrameInternal [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 7038] nsCSSFrameConstructor::ConstructFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6948] nsCSSFrameConstructor::ProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 11569] nsCSSFrameConstructor::ConstructTableCellFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2772] nsCSSFrameConstructor::TableProcessChild [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 3042] nsCSSFrameConstructor::TableProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2953] nsCSSFrameConstructor::ConstructTableRowFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2643] nsCSSFrameConstructor::ConstructFrameByDisplayType [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6400] nsCSSFrameConstructor::ConstructFrameInternal [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 7077] nsCSSFrameConstructor::ConstructFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6948] nsCSSFrameConstructor::ContentAppended [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 8115] StyleSetImpl::ContentAppended [d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1412] PresShell::ContentAppended [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5114] nsDocument::ContentAppended [d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1684] nsHTMLDocument::ContentAppended [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line 1128] HTMLContentSink::NotifyAppend [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 4782] SinkContext::CloseContainer [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 1628] HTMLContentSink::CloseContainer [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 3459] CNavDTD::CloseContainer [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3528] CNavDTD::CloseContainersTo [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3563] CNavDTD::CloseContainersTo [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3747] CNavDTD::HandleEndToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1988] CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 881] CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 526] nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1983] nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1847] nsParser::ContinueParsing [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1499] nsParserContinueEvent::HandleEvent [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 232] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 524] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1072] nsAppShellService::Run [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303] main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1316] main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1633] WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1651] WinMainCRTStartup() KERNEL32.DLL + 0x17d08 (0x77e97d08)

Marking NEW and -> Style System Dupe of bug 92368?

Is this a recent regression?

David: Since this occured with Tuesday's build, my guess would be "yes". That, and when I searched query.cgi for dupes, I included bugs of all Status on the chance that I could reopen an old bug.

It's crashing on the first of the following lines with |parentBG| as null: else if (SetColor(colorData.mBackColor, parentBG->mBackgroundColor, mPresContext, bg->mBackgroundColor, inherited)) { bg->mBackgroundFlags &= ~NS_STYLE_BG_COLOR_TRANSPARENT; }

Such a crash would require that a GetStyleData call returned null. That shouldn't happen.

Related to bug 110112?

This is still a valid crasher.. Talkback for build 2002011604 is TB1998154X CCing stephend for extract of this talkback

nsRuleNode::ComputePositionData [d:\builds\seamonkey\mozilla\content\base\src\nsRuleNode.cpp, line 3854] nsRuleNode::WalkRuleTree [d:\builds\seamonkey\mozilla\content\base\src\nsRuleNode.cpp, line 1579] nsRuleNode::GetPositionData [d:\builds\seamonkey\mozilla\content\base\src\nsRuleNode.cpp, line 1366] nsRuleNode::GetStyleData [d:\builds\seamonkey\mozilla\content\base\src\nsRuleNode.cpp, line 4728] nsStyleContext::GetStyleData [d:\builds\seamonkey\mozilla\content\base\src\nsStyleContext.cpp, line 366] nsHTMLContainerFrame::CreateViewForFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line 465] nsCSSFrameConstructor::ConstructHTMLFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 4627] nsCSSFrameConstructor::ConstructFrameInternal [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6993] nsCSSFrameConstructor::ConstructFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6888] nsCSSFrameConstructor::ProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 11907] nsCSSFrameConstructor::ConstructTableCellFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2650] nsCSSFrameConstructor::TableProcessChild [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2920] nsCSSFrameConstructor::TableProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2831] nsCSSFrameConstructor::ConstructTableRowFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2521] nsCSSFrameConstructor::TableProcessChild [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2906] nsCSSFrameConstructor::TableProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2831] nsCSSFrameConstructor::ConstructTableRowGroupFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2412] nsCSSFrameConstructor::TableProcessChild [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2900] nsCSSFrameConstructor::TableProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2831] nsCSSFrameConstructor::ConstructTableFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2293] nsCSSFrameConstructor::ConstructFrameByDisplayType [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6240] nsCSSFrameConstructor::ConstructFrameInternal [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 7032] nsCSSFrameConstructor::ConstructFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6888] nsCSSFrameConstructor::ProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 11907] nsCSSFrameConstructor::ConstructTableCellFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2650] nsCSSFrameConstructor::TableProcessChild [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2920] nsCSSFrameConstructor::TableProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2831] nsCSSFrameConstructor::ConstructTableRowFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2521] nsCSSFrameConstructor::TableProcessChild [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2906] nsCSSFrameConstructor::TableProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2831] nsCSSFrameConstructor::ConstructTableRowGroupFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2412] nsCSSFrameConstructor::TableProcessChild [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2900] nsCSSFrameConstructor::TableProcessChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2831] nsCSSFrameConstructor::ConstructTableFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 2293] nsCSSFrameConstructor::ConstructFrameByDisplayType [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6240] nsCSSFrameConstructor::ConstructFrameInternal [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 7032] nsCSSFrameConstructor::ConstructFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6888] nsCSSFrameConstructor::ProcessInlineChildren [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 13470] nsCSSFrameConstructor::ConstructInline [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 13253] nsCSSFrameConstructor::ConstructFrameByDisplayType [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6200] nsCSSFrameConstructor::ConstructFrameInternal [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 7032] nsCSSFrameConstructor::ConstructFrame [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 6888] nsCSSFrameConstructor::ContentAppended [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 8090] StyleSetImpl::ContentAppended [d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1436] PresShell::ContentAppended [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5143] nsDocument::ContentAppended [d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 1865] nsHTMLDocument::ContentAppended [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line 1234] HTMLContentSink::NotifyAppend [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 4745] SinkContext::FlushTags [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 2151] HTMLContentSink::OpenHead [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 3085] CNavDTD::OpenHead [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3103] CNavDTD::AddHeadLeaf [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3843] CNavDTD::HandleStartToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1735] CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 909] CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 534] nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1985] nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1849] nsParser::ContinueParsing [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1497] HTMLContentSink::ScriptEvaluated [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 4988] nsScriptLoader::FireScriptEvaluated [d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 538] nsScriptLoader::ProcessRequest [d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 497] nsScriptLoader::OnStreamComplete [d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 782] nsStreamLoader::OnStopRequest [d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 163] nsStreamListenerTee::OnStopRequest [d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 25]

Did someone make the dialog modal? It certainly seems modal for me on Linux. It would be nice if someone who has access to Windows (glazman?) could have a look at this. The Image Confirmation pref is "Edit | Preferences | Privacy & Security | Images | Ask me before downloading an image". Sorry I didn't look at this bug sooner.

*** Bug 128727 has been marked as a duplicate of this bug. ***

Please change this bug to include OS X, possibly All. Note that bug 128727 found this crash to happen when going Back quickly rather than closing a popup quickly. The commonality is that the user left an unfinished page before the image permission dialog could display. BTW, yes, the dialog is modal.

Changed OS/Platform to all/all. I'll retract my initial request about modality if the alert only affects the window that spawned the alert. (Which I believe is actually the case now.)

Any requests about modality should be in a different bug. This bug is about a crash.

How to use this testcase (crashes for me on Linux): 1. Enable image confirmation (Edit | Prefs | Privacy & Security | Images | Ask me before downloading an image) 2. Clear your disk cache (Edit | Prefs | Advanced | Cache | Clear disk cache now) 3. click on the link to the testcase 4. As it loads, click "Yes" as quickly as possible to the image confirmation dialog. 5. You'll end up back at the page before it in the history. Enter the URL to the testcase **in the URL bar** (can use copy/paste) and hit enter. 6. As it loads, click "Yes" to the image confirmation dialog as quickly as possible. 7. A *second* image confirmation dialog will appear. Click "Yes" for that dialog as well. ==> CRASH

Well, it worked for me twice, but I can't get it to crash anymore... Maybe it's easier when I use http://www.people.fas.harvard.edu/~dbaron/tmp/img-conf

Actually, I just forgot what I did. Instead of clicking "Yes", I always clicked "No". That crashed.

I wasn't able to reproduce with a debug build, but I caught it in the debugger in an optimized build, once, and it looked like the problem was that it was trying to initialize an nsStyleDisplay (from ComputeDisplayData) at address null. If the pres context was disconnected from the pres shell, that could happen at a random address, which could be null.

Crash with 2002041617/RC1build/Win2K -> TB5290215H, TB5290273G

*** Bug 142213 has been marked as a duplicate of this bug. ***

This bug should be closed. The entire image confirmation system was killed (removed from game, actually) at the end of bug 110112. When an equivalent feature is re-created in some distant future (see bug 146513 and bug 145690), it will not behave like this.

*** This bug has been marked as a duplicate of 110112 ***

Verifying DUP as it is pretty obvious.

Fair enough.