Closed Bug 1941 Opened 26 years ago Closed 26 years ago

removeChild causes a crash

Categories

(Core :: DOM: Core & HTML, defect, P2)

x86
Windows 98
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: gdavis, Assigned: buster)

References

()

Details

(Whiteboard: mar 26 - investigating new problems with demo.)

When using the xmlbooks demo, any attempt to sort causes a crash.
Assignee: vidur → kipp
Summary: xmlbooks demo crash on dom access → removeChild causes a crash
In the books example, try to do a sort. The resultant crash yields the following stack: nsBlockFrame::RenumberLists(nsBlockReflowState & {...}) line 4298 + 15 bytes nsBlockFrame::PrepareFrameRemovedReflow(nsBlockReflowState & {...}) line 4615 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x0143ff84, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 18026572) line 648 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x0143ff84, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 18026572) line 4253 + 25 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x0143ff80, const nsRect & {...}, int 0, unsigned int & 18026572) line 153 + 33 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x01460380, int & 1) line 2190 + 41 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01460380, int & 1) line 1651 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1380 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4627 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x0143a704, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 2) line 676 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x0143a704, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 2) line 4253 + 25 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x0143a700, const nsRect & {...}, int 1, unsigned int & 2) line 153 + 33 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x014602a0, int & 1) line 2190 + 41 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x014602a0, int & 1) line 1651 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1380 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4627 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x0143ab94, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 676 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x0143ab94, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4253 + 25 bytes nsBodyFrame::Reflow(nsBodyFrame * const 0x0143ab94, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 259 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x0143ab90, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 392 + 28 bytes nsScrollFrame::Reflow(nsScrollFrame * const 0x01439524, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 392 nsContainerFrame::ReflowChild(nsIFrame * 0x01439520, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 392 + 28 bytes RootFrame::Reflow(RootFrame * const 0x00f62254, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 209 nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x01460120, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 163 PresShell::ProcessReflowCommands() line 861 PresShell::ExitReflowLock(PresShell * const 0x01434270) line 522 PresShell::ContentRemoved(PresShell * const 0x01434278, nsIDocument * 0x0145c6c0, nsIContent * 0x00f1d8ec, nsIContent * 0x00f20d4c, int 3) line 1051 nsDocument::ContentRemoved(nsDocument * const 0x0145c6c0, nsIContent * 0x00f1d8ec, nsIContent * 0x00f20d4c, int 3) line 932 nsGenericContainerElement::RemoveChildAt(int 3, int 1) line 2088 nsGenericContainerElement::RemoveChild(nsIDOMNode * 0x00f20d40, nsIDOMNode * * 0x0012e990) line 1749 + 14 bytes nsXMLElement::RemoveChild(nsXMLElement * const 0x00f1d8e0, nsIDOMNode * 0x00f20d40, nsIDOMNode * * 0x0012e990) line 49 + 22 bytes NodeRemoveChild(JSContext * 0x00f348a0, JSObject * 0x010f1c68, unsigned int 1, long * 0x010eaf5c, long * 0x0012ea4c) line 420 + 25 bytes js_Invoke(JSContext * 0x00f348a0, unsigned int 1, int 0) line 650 + 26 bytes js_Interpret(JSContext * 0x00f348a0, long * 0x0012f224) line 2183 + 15 bytes js_Invoke(JSContext * 0x00f348a0, unsigned int 2, int 0) line 666 + 13 bytes js_Interpret(JSContext * 0x00f348a0, long * 0x0012f9b8) line 2183 + 15 bytes js_Invoke(JSContext * 0x00f348a0, unsigned int 1, int 0) line 666 + 13 bytes js_CallFunctionValue(JSContext * 0x00f348a0, JSObject * 0x010f1ad8, long 17767144, unsigned int 1, long * 0x0012fad4, long * 0x0012fadc) line 735 + 15 bytes JS_CallFunctionValue(JSContext * 0x00f348a0, JSObject * 0x010f1ad8, long 17767144, unsigned int 1, long * 0x0012fad4, long * 0x0012fadc) line 2370 + 29 bytes nsJSEventListener::ProcessEvent(nsIDOMEvent * 0x01460250) line 97 + 34 bytes nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012fbf0, nsIDOMEvent * * 0x0012fba4, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 320 + 17 bytes ....
Status: NEW → ASSIGNED
Priority: P2 → P1
*** Bug 1974 has been marked as a duplicate of this bug. ***
The crash is fixed, but the test is still broken.
Priority: P1 → P2
Setting all current Open/Normal to M4.
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Fixed -- the crash is gone; however the test is pretty slow so I suspect some incremental performance work is necessary (I already have bugs open on that).
QA Contact: 4015
gerardok as QA contact
QA Contact: 4015 → 4078
removeChild is a property of Node. Phillip please verify. Thanks.
as of the am build on 09.March.1999, the demo does not work at all. it just displays a bunch of unformatted text. i'm going to look through bugzilla to see if there is another bug on the xml issue. if not, i'm going to have to leave this as unresolved and do some homework. (incidentally, removeChild is the subject of bug 691, which is fixed.)
ok. i've tried this on: redhat5.2 build 99030908 winnt4.0 build 99030910 win95 build 99030910 with the same results: ------------------------------------------------------------------------------- Sort by: Amazon.com Search Results for: the keywords include "Road" Kerouac, Jack 0140042598 On The Road, the most famous of Jack Kerouac's works, is not only the soul of the Beat movement and literature, but one of the most important ------------------------------------------------------------------------------- and so on. just a bunch of text. and to prove it to myself the the XML is ok, i opened up the demo ( also located within the firewall at http://wetnap.mcom.com/seamonkey/xmldemo/books.xml) in MultiDocZilla Preview 2 (available at http://www.doczilla.com) and it works fine there. so here's how it goes: 1. i give myself 48 hours to find a bug that says xml is broken in gecko. 2. either way, this bug won't be verified until xml works enough for me to give it a whirl
ok. too late. i'm not verifying this bug until xml works again, and i'm opening up a bug on xml...
Whiteboard: mar 26 - investigating new problems with demo.
ok, so my server was incorrectly configured for xml. it is ok, but the sorting still doesn't work. i'm looking to see if there is an open javascript/DOM bug for this sort of thing. i might just close this bug and open up a new one when i figure out what's wrong.
Status: RESOLVED → VERIFIED
This is fixed as of the AM builds: 1999-04-16-08 Win98 i386 1999-04-16-08 WinNT 4.0 i386 1999-04-16-08 RedHat 5.2 i386 1999-04-16-08 MacOS 8.51 ppc
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.