User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030515 Mozilla Firebird/0.6 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030515 Mozilla Firebird/0.6 Firebird and Mozilla crashes when trying to visit the General KISS Discussion forum on this page. This is probably a dupe but has been 100 % reproducible for a long time. Talkback ID: TB20204024H Reproducible: Always Steps to Reproduce: 1. Go to http://www.kissonline.com/bbs 2. Click "General KISS Discussion" Actual Results: Crash

00000384() nsContainerFrame::Destroy(nsContainerFrame * const 0x06420d68, nsIPresContext * 0x063f00b8) line 140 nsLineBox::DeleteLineList(nsIPresContext * 0x063f00b8, nsLineList & {...}) line 306 + 10 bytes nsBlockFrame::Destroy(nsBlockFrame * const 0x063455b4, nsIPresContext * 0x063f00b8) line 423 + 10 bytes nsLineBox::DeleteLineList(nsIPresContext * 0x063f00b8, nsLineList & {...}) line 306 + 10 bytes nsBlockFrame::Destroy(nsBlockFrame * const 0x063458fc, nsIPresContext * 0x063f00b8) line 423 + 10 bytes nsLineBox::DeleteLineList(nsIPresContext * 0x063f00b8, nsLineList & {...}) line 306 + 10 bytes nsBlockFrame::Destroy(nsBlockFrame * const 0x063450ec, nsIPresContext * 0x063f00b8) line 423 + 10 bytes nsLineBox::DeleteLineList(nsIPresContext * 0x063f00b8, nsLineList & {...}) line 306 + 10 bytes nsBlockFrame::Destroy(nsBlockFrame * const 0x06344ee8, nsIPresContext * 0x063f00b8) line 423 + 10 bytes nsFrameList::DestroyFrames(nsFrameList * const 0x047dd008, nsIPresContext * 0x063f00b8) line 130 + 13 bytes nsContainerFrame::Destroy(nsContainerFrame * const 0x06343318, nsIPresContext * 0x063f00b8) line 143 CanvasFrame::Destroy(CanvasFrame * const 0x064828a8, nsIPresContext * 0x063f00b8) line 252 + 9 bytes nsFrameList::DestroyFrames(nsFrameList * const 0x047dd008, nsIPresContext * 0x063f00b8) line 130 + 13 bytes nsContainerFrame::Destroy(nsContainerFrame * const 0x064cf758, nsIPresContext * 0x063f00b8) line 143 nsBoxFrame::Destroy(nsBoxFrame * const 0x06482ca8, nsIPresContext * 0x063f00b8) line 1103 + 9 bytes nsFrameList::DestroyFrames(nsFrameList * const 0x047dd008, nsIPresContext * 0x063f00b8) line 130 + 13 bytes nsContainerFrame::Destroy(nsContainerFrame * const 0x00000000, nsIPresContext * 0x063f00b8) line 143 nsBoxFrame::Destroy(nsBoxFrame * const 0x06482b94, nsIPresContext * 0x063f00b8) line 1103 + 9 bytes nsGfxScrollFrame::Destroy(nsGfxScrollFrame * const 0x06482b94, nsIPresContext * 0x063f00b8) line 459 + 10 bytes nsFrameList::DestroyFrames(nsFrameList * const 0x047dd008, nsIPresContext * 0x063f00b8) line 130 + 13 bytes nsContainerFrame::Destroy(nsContainerFrame * const 0x06440c00, nsIPresContext * 0x063f00b8) line 143 ViewportFrame::Destroy(ViewportFrame * const 0x064827a0, nsIPresContext * 0x063f00b8) line 67 + 10 bytes FrameManager::Destroy(FrameManager * const 0x06416a88) line 517 PresShell::Destroy(PresShell * const 0x00000000) line 1843 DocumentViewerImpl::Destroy(DocumentViewerImpl * const 0x0637ac24) line 1135 DocumentViewerImpl::Show(DocumentViewerImpl * const 0x063fed08) line 1368 PresShell::UnsuppressAndInvalidate(PresShell * const 0x047dd008) line 4946 PresShell::UnsuppressPainting(PresShell * const 0x061eabf8) line 4991 + 7 bytes PresShell::sPaintSuppressionCallback(nsITimer * 0x0488f5e0, void * 0x061eabf8) line 2948 nsTimerImpl::Fire(nsTimerImpl * const 0x047dd008) line 382 + 7 bytes PL_HandleEvent(PLEvent * 0x0614ca88) line 660 PL_ProcessPendingEvents(PLEventQueue * 0x1002bfa2) line 592 + 6 bytes _md_EventReceiverProc(HWND__ * 0x00df43a0, unsigned int 4202193, unsigned int 14594248, long -2147483648) line 1396 nsAppShellService::Run(nsAppShellService * const 0x00deb0c8) line 479 main1(int 0, char * * 0x00243e00, nsISupports * 0x00000000) line 1268 + 9 bytes main(int 3, char * * 0x00243e00) line 1647 + 22 bytes WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x001334ee, HINSTANCE__ * 0x00400000) line 1671 + 23 bytes MOZILLA! WinMainCRTStartup + 308 bytes KERNEL32! 77e9847c() *** This bug has been marked as a duplicate of 156982 ***

Reopening because I have a fix for this bug and I'm not sure it fixes the thing it was duped to.

There's a longstanding bug here about odd situations where an inline frame has a view, it's found to contain a block, and for some reason the block (or following inlines) don't get a view even though they should have the same style context.

We need to reparent views for the children of the anonymous block and trailing inline container even if those frames don't themselves have a view. In particular the leading inline container can have a view, in which case children with views will have that view as their parent and we break that relationship when we reparent those child frames.

Comment on attachment 123666 [details] [diff] [review] fix r+sr=dbaron, but how about adding an inline nsIFrame::HasView() that just checks the NS_FRAME_HAS_VIEW bit so that we don't waste time actually getting the view from the frame manager's property table?

That's actually in my nsIFrame fixup patch.

Comment on attachment 123666 [details] [diff] [review] fix a=asa (on behalf of drivers) for checkin to 1.4

Fix checked in.

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040120 Firebird/0.8.0+ -> verified.