82926 - [PATCH] crash [@ gklayout::NS_NewFrameManager]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Howard Harris]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (OS/2; U; Warp 4.5; en-US; rv:0.9+) Gecko/20010525
BuildID:    2001052506

JavaScript popup window remains blank for a few seconds
and then browser crashes, leaving following in
popuplog.os2

05-27-2001  10:16:09  SYS3175  PID 001b  TID 0001  Slot 0052
D:\WARPZILLA\BIN\MOZILLA.EXE
c0000005
00000000
P1=00000001  P2=00000000  P3=XXXXXXXX  P4=XXXXXXXX  
EAX=024d60ec  EBX=024d66b4  ECX=00000000  EDX=0103cc5c
ESI=00000000  EDI=00000000  
DS=0053  DSACC=f0f3  DSLIM=ffffffff  
ES=0053  ESACC=f0f3  ESLIM=ffffffff  
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:00000000  CSACC=f0df  CSLIM=ffffffff
SS:ESP=0053:0103cacc  SSACC=f0f3  SSLIM=ffffffff
EBP=0103cc70  FLG=00012202


Reproducible: Always
Steps to Reproduce:
1. connect to http://www.novatech.co.uk/NOVATECH/Home.html
2. wait for page to load
3. wait for popup window to appear

Actual Results:  Mozilla crashed leaving the following entry in popuplog.os2

05-27-2001  10:16:09  SYS3175  PID 001b  TID 0001  Slot 0052
D:\WARPZILLA\BIN\MOZILLA.EXE
c0000005
00000000
P1=00000001  P2=00000000  P3=XXXXXXXX  P4=XXXXXXXX  
EAX=024d60ec  EBX=024d66b4  ECX=00000000  EDX=0103cc5c
ESI=00000000  EDI=00000000  
DS=0053  DSACC=f0f3  DSLIM=ffffffff  
ES=0053  ESACC=f0f3  ESLIM=ffffffff  
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:00000000  CSACC=f0df  CSLIM=ffffffff
SS:ESP=0053:0103cacc  SSACC=f0f3  SSLIM=ffffffff
EBP=0103cc70  FLG=00012202


Expected Results:  Display contents of popup window

Comment 1

[doctor__j]

Attachment: Testcase

Comment 2

[doctor__j]

The testcase is reduced from the URL of the pop-up:
http://www.novatech.co.uk/NOVATECH/CompetitionEntry2.html

Crashed on Win32 build 2001052608.

Comment 3

[Oliver Klee]

Attachment: Dr. Watson log for this crash on Win2k

Comment 4

[Oliver Klee]

Changing summary from "Bad: JavaScript popup window crashes Mozilla" to "crash
[@ gklayout::NS_NewFrameManager]", adding crash keyword, setting OS=All.

Comment 5

[Oliver Klee]

Over to Layout.

Comment 6

[Jens-Uwe]

confirming crash under linux (2001052621) for the test case.

Comment 7

[Bernd]

It crashed already with 2001-04-20 and does not crash with 2001-04-09.

Comment 8

[Bernd]

Attachment: stack trace crash in CSSFrameConstructor

Comment 9

[Bernd]

probably a dupe of bug 77713

Comment 10

[Oliver Klee]

Nope, I get a completely different stack trace with 77713 with a crash in
nsGetInterface::operator= .

Comment 11

[karnaze (gone)]

Moving to m0.9.2.

Comment 12

[karnaze (gone)]

Attachment: patch to prevent notifying img request proxy when it is being cancelled

Comment 13

[karnaze (gone)]

Reassigning to attinasi, since he came up with the patch.

Comment 14

[Marc Attinasi]

Pavlov, the change is to null out the listener before removing the proxy because
if we do not, then we can get called back into the frame that is trying to
cancel the notifications! This results in a crash because the frames are only
partly destroyed, and the DOMEvent winds up walking over the partially torn-down
frames.

I think that it is very wrong to notify an observer while they are canceling
their notification registration...

review please?

Comment 15

[Chris Waterson]

sr=waterson

Comment 16

[Stuart Parmenter]

I'm looking at this to see if it will break anything.

Comment 17

[karnaze (gone)]

*** Bug 77713 has been marked as a duplicate of this bug. ***

Comment 18

[Marc Attinasi]

Graffiti tagging

Comment 19

[Stuart Parmenter]

r=pavlov

Comment 20

[Marc Attinasi]

waiting on approval for 0.9.2 landing

Comment 21

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to the trunk.
(on behalf of drivers)

Comment 22

[Marc Attinasi]

Checking in imgRequestProxy.cpp;
/cvsroot/mozilla/modules/libpr0n/src/imgRequestProxy.cpp,v  <--  imgRequestProxy
.cpp
new revision: 1.25; previous revision: 1.24

Comment 23

[Chris Petersen]

Marking verified in the June 27th branch build.