See URL for test case. Partial stack trace: nsCSSBlockFrame::FrameDeletedReflow(nsCSSBlockReflowState & {...}) line 1889 + 3 bytes nsCSSBlockFrame::ReflowAround(nsCSSBlockFrame * const 0x010ba6a0, nsIPresContext & {...}, nsISpaceManager * 0x010b7d00, nsReflowMetrics & {...}, const nsReflowState & {...}, nsRect & {...}, unsigned int & 1073741824) line 1309 + 18 bytes nsCSSBlockFrame::ReflowBlockFrame(nsCSSBlockReflowState & {...}, LineData * 0x010ba6e0, nsIFrame * 0x010ba650, unsigned int & 16640) line 2313 + 47 bytes nsCSSBlockFrame::ReflowLine(nsCSSBlockReflowState & {...}, LineData * 0x010ba6e0, unsigned int & 16640) line 2087 + 24 bytes nsCSSBlockFrame::ReflowLinesAt(nsCSSBlockReflowState & {...}, LineData * 0x010ba6e0) line 1959 + 20 bytes nsCSSBlockFrame::ChildIncrementalReflow(nsCSSBlockReflowState & {...}) line 1928 + 19 bytes nsCSSBlockFrame::ReflowAround(nsCSSBlockFrame * const 0x010b7e80, nsIPresContext & {...}, nsISpaceManager * 0x010b7d00, nsReflowMetrics & {...}, const nsReflowState & {...}, nsRect & {...}, unsigned int & 0) line 1321 + 18 bytes nsBodyFrame::Reflow(nsBodyFrame * const 0x010b7c70, nsIPresContext & {...}, nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 222 nsContainerFrame::ReflowChild(nsIFrame * 0x010b7c70, nsIPresContext * 0x0109c3c0, nsReflowMetrics & {...}, const nsReflowState & {...}) line 495 RootContentFrame::Reflow(RootContentFrame * const 0x010b79e0, nsIPresContext & {...}, nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 324 + 27 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x010b79e0, nsIPresContext * 0x0109c3c0, nsReflowMetrics & {...}, const nsReflowState & {...}) line 495 RootFrame::Reflow(RootFrame * const 0x010b7960, nsIPresContext & {...}, nsReflowMetrics & {...}, const nsReflowState & {...}, unsigned int & 0) line 132 + 27 bytes nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x010cc320, nsIPresContext & {...}, nsReflowMetrics & {...}, const nsSize & {...}) line 133 PresShell::ProcessReflowCommands() line 569 PresShell::ContentHasBeenRemoved(PresShell * const 0x0109d864, nsIDocument * 0x0109b340, nsIContent * 0x010ba1b0, nsIContent * 0x010ba2f0, int 0) line 738 nsDocument::ContentHasBeenRemoved(nsIContent * 0x010ba1b0, nsIContent * 0x010ba2f0, int 0) line 558 nsHTMLContainer::RemoveChildAt(nsHTMLContainer * const 0x010ba1b0, int 0, int 1) line 222 nsHTMLContainer::RemoveChild(nsHTMLContainer * const 0x010ba1b4, nsIDOMNode * 0x010ba2f4, nsIDOMNode * * 0x0012e7b8) line 1068 + 22 bytes NodeRemoveChild(JSContext * 0x0109f420, JSObject * 0x01474970, unsigned int 1, long * 0x014700b4, long * 0x0012e84c) line 669 + 25 bytes js_Invoke(JSContext * 0x0109f420, unsigned int 1, int 0) line 630 + 26 bytes

pushing test case to mozilla.org and updating URL field

I think this is vidur's bug, but not sure. reassigning.

Can someone take a look into this bug please? It's still there, and since replaceChild doesn't work either, this is making it very hard to demo this sort of feature.

Adding Kipp and Nisheeth to cc: list.

I don't know if this one is troy's or kipp's but its not vidur's. We're crashing on a null LineData pointer in FrameRemovedReflow. Angus seems to be getting anxious. You guys want to look at this?

Block frame code so I'm reassigning to Kipp

who resolved this bug? how did it get resolved -- did you check in code?

does not crash on win95, Phillip checking on WinNT

this works on nt4,macos851,redhat52i386 on the 04.Feb.1999 builds, so i'm verifying fixed. it doesn't crash anymore, but the testcase is broken because it incorrectly uses the DOM Level 1 Core method (of the Element Object). "setDOMAttribute" should be changed to "setAttribute". Any ideas of who i can contact about updating the testcase? ( i have a working copy at http://wetnap.mcom.com/seamonkey/bugs/bug691.html ) -- it adds an image on mouseover and removes it on mouse out....

RCS file: /cvsroot/mozilla/testing/mochitest/tests/test_bug691.html,v done Checking in tests/test_bug691.html; /cvsroot/mozilla/testing/mochitest/tests/test_bug691.html,v <-- test_bug691.html initial revision: 1.1 done