The testcase that I will attach crashes my 2004-12-21 trunk build of Firefox. 1. Hover over the select drop down list. 2. Click on 'Option 2' Result:crash Talkback ID: http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2704126Y nsTableRowFrame::IR_TargetIsChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp, line 1193] nsTableRowFrame::IncrementalReflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp, line 1119] nsTableRowFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowFrame.cpp, line 1418] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsTableRowGroupFrame::IR_TargetIsChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp, line 1646] nsTableRowGroupFrame::IncrementalReflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp, line 1324] nsTableRowGroupFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableRowGroupFrame.cpp, line 1230] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsTableFrame::IR_TargetIsChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp, line 2978] nsTableFrame::IncrementalReflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp, line 2687] nsTableFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableFrame.cpp, line 1947] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] nsTableOuterFrame::OuterReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1329] nsTableOuterFrame::IR_InnerTableReflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1689] nsTableOuterFrame::IR_TargetIsInnerTableFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1443] nsTableOuterFrame::IR_TargetIsChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1425] nsTableOuterFrame::IncrementalReflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1394] nsTableOuterFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1953] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp, line 547] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3427] nsBlockFrame::ReflowLine [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2604] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2234] nsBlockFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 835] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockReflowContext.cpp, line 547] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 3427] nsBlockFrame::ReflowLine [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2604] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 2234] nsBlockFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsBlockFrame.cpp, line 835] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] CanvasFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLFrame.cpp, line 549] nsFrame::BoxReflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp, line 5355] nsFrame::DoLayout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp, line 5095] nsIFrame::Layout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp, line 805] nsIFrame::Layout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp, line 805] nsGfxScrollFrameInner::LayoutBox [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 1666] nsXULScrollFrame::DoLayout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 580] nsIFrame::Layout [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp, line 805] nsXULScrollFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 1031] nsContainerFrame::ReflowChild [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp, line 972] ViewportFrame::Reflow [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/generic/nsViewportFrame.cpp, line 249] IncrementalReflow::Dispatch [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 908] PresShell::ProcessReflowCommands [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6254] PresShell::FlushPendingNotifications [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 4972] nsDocument::FlushPendingNotifications [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp, line 4055] nsHTMLDocument::FlushPendingNotifications [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLDocument.cpp, line 1260] nsComboboxControlFrame::ShowList [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/forms/nsComboboxControlFrame.cpp, line 586] nsComboboxControlFrame::RollupFromList [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/forms/nsComboboxControlFrame.cpp, line 2256] nsListControlFrame::MouseUp [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/forms/nsListControlFrame.cpp, line 2476] nsListEventListener::MouseUp [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/forms/nsListControlFrame.cpp, line 3236] nsEventListenerManager::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1604] nsGenericElement::HandleDOMEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2000] nsHTMLSelectElement::HandleDOMEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLSelectElement.cpp, line 1793] nsGenericElement::HandleDOMEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2029] PresShell::HandleEventInternal [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5917] PresShell::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5772] nsViewManager::HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2404] nsViewManager::DispatchEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2129] HandleEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 174] nsWindow::DispatchEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1102] nsWindow::DispatchMouseEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5387] ChildWindow::DispatchMouseEvent [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5638] nsWindow::WindowProc [c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1383] USER32.dll + 0x27b17 (0x77d37b17) USER32.dll + 0x2cdce (0x77d3cdce)

The patch in bug 269566 may well fix this... (or at least it will fix this exact crash, but there may be more crashes around after that).

The patch in bug 269566 fixed the crash that was reported here, but exposed another one. This testcase will recurse to death when it's loaded.

The problem was that while constructing anon kids we processed pseudo frames, which stuck the pseudo cell frame we had wrapped around ourselves in our own child list. Then when we tried to restore state, we recursed to death.

Fixed.

Both testcases at https://bugzilla.mozilla.org/attachment.cgi?id=169411 and https://bugzilla.mozilla.org/attachment.cgi?id=172376 work fine for me now with build 2005-02-02 on Windows XP, Seamonkey trunk. Verified FIXED

Checked in a crashtest for this.