Closed Bug 350460 Opened 18 years ago Closed 18 years ago

Crash [@ DoDeletingFrameSubtree] after reloading a xul page a few times with display: -moz-popup and menuitem

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 372576

People

(Reporter: martijn.martijn, Assigned: martijn.martijn)

References

(Depends on 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

(deleted), application/vnd.mozilla.xul+xml
Details
See upcoming testcase, which crashes current 1.8.0.7 builds and current trunk builds when reloading the page a few times. Basically, the page consists of this: <menuitem style="display: -moz-popup;"> <box style="display: -moz-popup;"> <box style="display: -moz-popup;"/> </box> </menuitem> Talkback ID: TB22599290Y DoDeletingFrameSubtree DeletingFrameSubtree nsCSSFrameConstructor::RemoveMappingsForFrameSubtree nsPopupSetFrame::Destroy nsFrameList::DestroyFrames nsFrameList::DestroyFrames nsFrameList::DestroyFrames nsFrameManager::Destroy DocumentViewerImpl::Destroy DocumentViewerImpl::Show nsPresContext::EnsureVisible PresShell::UnsuppressAndInvalidate PresShell::UnsuppressPainting
Attached file testcase (deleted) —
When reloading this page a few times, I crash consistently.
Blocks: 324721
No longer blocks: 324721
Depends on: 324721
I debugged this crash and it's the same as bug 372576.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → DUPLICATE
Perhaps we could tweak the testcase so that it crashes on load and include it in the test suite?
Flags: in-testsuite?
Group: security
Crash Signature: [@ DoDeletingFrameSubtree]
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: