Closed Bug 46356 Opened 25 years ago Closed 24 years ago

crash when leaving page with CSS-positioned elements

Categories

(Core :: Layout, defect, P1)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
VERIFIED DUPLICATE of bug 42372

People

(Reporter: jlb-bugz, Assigned: waterson)

References

(
URL
)

Details

(Keywords: crash, testcase, Whiteboard: [nsbeta3+])

Attachments

(1 file)

Minimal testcase for crasher
(deleted), text/html
Details 
Build ID: 2000072008
Platform: NT 4

It crashed on every link I tried which included at least DOWNLOADS, SCREENSHOTS
and some of the listed download items.

This site has a really obnoxious pop-up alert for Netscape 4.x users which says
"Please come back with a CSS-compliant browser, such as IE or Netscape 6 (or
Lynx)" so I am guessing they are doing some moby css stuff and that might be the
problem.
sure enough. Crashed hitting "Downloads" link. talkback stac trace below.

nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 35]

nsAbsoluteContainingBlock::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp, 
line 365]

nsPositionedInlineFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsInlineFrame.cpp, line 945]

nsLineBox::DeleteLineList 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineBox.cpp, line 252]

nsBlockFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1222]

nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsAbsoluteContainingBlock::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp, 
line 365]

nsBlockFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1213]

nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsAbsoluteContainingBlock::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp, 
line 365]

nsBlockFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1213]

nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]

nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]

nsBoxFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 932]

nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]

nsBoxFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 932]

nsGfxScrollFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
431]

nsFrameList::DestroyFrames 
[d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36]

nsContainerFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98]

ViewportFrame::Destroy 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 144]

FrameManager::~FrameManager 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 383]

FrameManager::`scalar deleting destructor' 


FrameManager::Release 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 365]

PresShell::~PresShell 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1124]

PresShell::`scalar deleting destructor' 


nsTextInputListener::Release 
[d:\builds\seamonkey\mozilla\layout\html\forms\src\nsGfxTextControlFrame2.cpp, 
line 223]

nsCOMPtr_base::~nsCOMPtr_base 
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 50]

DocumentViewerImpl::~DocumentViewerImpl 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocumentViewer.cpp]

DocumentViewerImpl::`scalar deleting
destructor' 


DocumentViewerImpl::Release 
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocumentViewer.cpp, line 352]

nsCOMPtr_base::assign_with_AddRef 
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 59]

nsWebShell::SetupNewViewer 
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 389]

nsWebShell::SetupNewViewer 
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 389]

nsDocShell::Embed 
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 2249]

nsWebShell::Embed 
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 413]

nsDocShell::CreateContentViewer 
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 2407]

nsDSURIContentListener::DoContent 
[d:\builds\seamonkey\mozilla\docshell\base\nsDSURIContentListener.cpp, line 101]

nsDocumentOpenInfo::DispatchContent 
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 362]

nsDocumentOpenInfo::OnStartRequest 
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 234]

nsHTTPFinalListener::OnStartRequest 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p, line 1153]

InterceptStreamListener::OnStartRequest 
[d:\builds\seamonkey\mozilla\netwerk\cache\mgr\nsCachedNetData.cpp, line 1151]

nsHTTPServerListener::FinishedResponseHeaders
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p, line 1091]

nsHTTPServerListener::OnDataAvailable 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p, line 428]

nsOnDataAvailableEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
407]

nsStreamListenerEvent::HandlePLEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 
106]

PL_HandleEvent 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 588]

PL_ProcessPendingEvents 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 547]

_md_EventReceiverProc 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1045]

USER32.dll + 0x1820 (0x77e71820)
Status: UNCONFIRMED → NEW
Ever confirmed: true
over to Layout
Assignee: asa → clayton
Component: Browser-General → Layout
QA Contact: doronr → petersen
*** Bug 46389 has been marked as a duplicate of this bug. ***
Aye, it crashes here on Linux 2000072408, also.  Changing opsys.
Keywords: crash
OS: Windows NT → All
Hardware: PC → All
adding spam
Triaging clayton's list:
-------------------------

I see the crash too.  Over to wateron [ our layout guru :) ].
CCing nisheeth.
Assignee: clayton → waterson
I testcased this one down to 14 lines.  The crash is occuring upon leaving the
page at http://www.planetquake.com/servers/arena/, not upon loading of any other
page.  The crash seems related to having both absolute and relative positioned
elements on the same page.  Changing them both to the same positioning makes the
crash go away.  Here is the HTML, also attached to this bug:

<HTML>
    <HEAD>
        <title>Crash Mozilla!</title>
        <STYLE TYPE="text/css"><!--
        .one {position: absolute;}
        .two {position: relative;}
        -->
        </STYLE>
    </HEAD>
    <BODY>
        <a class="one" href="">Click to crash!</a>
        <a class="two" href=""></a>
    </BODY>
</HTML>
Keywords: testcase
Attached file Minimal testcase for crasher (deleted) — 

  

  



    
  
Summary: crash on most links → crash when leaving page with CSS-positioned elements

    
    

    
  
*** Bug 47540 has been marked as a duplicate of this bug. ***

  

  



    
    

    
  
*** Bug 48063 has been marked as a duplicate of this bug. ***

  

  



    
    

    
  
*** Bug 48196 has been marked as a duplicate of this bug. ***

  

  



    
    

    
  
*** Bug 48871 has been marked as a duplicate of this bug. ***

  

  



    
    

    
  
After seeing this on more pages i am suggesting this could be nsbeta3

QA NOTE: Also check this page as a test case
http://www.brainjar.com/

  

  


Keywords: nsbeta3

    
    

    
  
hmmm, is this a dupe of bug 42372 ?

  

  



    
    

    
  
crasher. cc'ing buster: is this a dup of one you're looking at?

  

  


Status: NEW → ASSIGNED
Whiteboard: [nsbeta3+]
Target Milestone: --- → M18

    
  
Priority: P3 → P1

    
  
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → DUPLICATE

    
    

    
  

*** This bug has been marked as a duplicate of 42372 ***

  

  



    
    

    
  
Verified dupe of fixed bug 42372: "crash during frame destruction code while
leaving page"
Tested with linux 2000090908.

  

  


Status: RESOLVED → VERIFIED

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: