Towards the bottom right hand corner of this page there is a search box. If you hover over the box a grey plugin box will briefly appear and disappear. However, if you click on this grey box, Mozilla crashes. I have seen the grey plugin window before (www.discovery.com) but clicking on has not crashed Moz. I'm not sure whether this is duplicate of bug 18205 (I couln't even bring the page up in Moz) but if in case it isn't I'm listing it here. Expected: Nothing. Result: Crash System: 1999120208 WinNT 4 SP 6.

Changing component to Plug-Ins and reassigning.

...and reassigning.

This has nothing to do with plugins. I do not see any difference in beh wehther I have a plugin or not, and stack trace does not indicate the plugin stuff is involved. To me it looks like layout problem. I could not crash the page on debug build but it broke on asserion with the following call stack nsDebug::Assertion(const char * 0x01d38ba8, const char * 0x01d38b40, const char * 0x01d38b0c, int 1761) line 284 + 13 bytes UndisplayedMap::AppendNodeFor(UndisplayedNode * 0x07e73e80, nsIContent * 0x07f1aa6c) line 1761 + 60 bytes UndisplayedMap::AddNodeFor(nsIContent * 0x07f1aa6c, nsIContent * 0x07f1a21c, nsIStyleContext * 0x07f39250) line 1783 FrameManager::SetUndisplayedContent(FrameManager * const 0x078eb1a0, nsIContent * 0x07f1a21c, nsIStyleContext * 0x07f39250) line 542 + 23 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresContext * 0x07c4dc80, nsFrameConstructorState & {...}, nsIContent * 0x07f1a21c, nsIFrame * 0x07e74c30, nsFrameItems & {...}) line 5050 nsCSSFrameConstructor::ProcessInlineChildren(nsIPresContext * 0x07c4dc80, nsFrameConstructorState & {...}, nsIContent * 0x07f1aa6c, nsIFrame * 0x07e74c30, int 1, nsFrameItems & {...}, int * 0x0012fab4) line 9571 + 33 bytes nsCSSFrameConstructor::ConstructInline(nsIPresContext * 0x07c4dc80, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x07f27ca4, nsIContent * 0x07f1aa6c, nsIFrame * 0x07e5d900, nsIStyleContext * 0x07f27a80, nsIFrame * 0x07e74c30, nsIFrame * * 0x0012fc84, nsIFrame * * 0x0012fc60) line 9436 + 34 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresContext * 0x07c4dc80, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x07f27ca4, nsIContent * 0x07f1aa6c, nsIFrame * 0x07e5d900, nsIStyleContext * 0x07f27a80, nsFrameItems & {...}) line 4587 + 47 bytes nsCSSFrameConstructor::CantRenderReplacedElement(nsCSSFrameConstructor * const 0x078eae90, nsIPresContext * 0x07c4dc80, nsIFrame * 0x07e5d880) line 7462 + 46 bytes StyleSetImpl::CantRenderReplacedElement(StyleSetImpl * const 0x078eb780, nsIPresContext * 0x07c4dc80, nsIFrame * 0x07e5d880) line 1028 FrameManager::HandlePLEvent(CantRenderReplacedElementEvent * 0x07e63b60) line 759 PL_HandleEvent(PLEvent * 0x07e63b60) line 537 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x01082c50) line 498 + 9 bytes If to keep going (like hitting OK and F5 thirty times) it eventually breaks out and reflows. At this point you will see layout problems -- multiple search boxes are displayed instead of one. Resizing the page is even more amazing. Reassingning to troy for further investigation.

Asserts in UndisplayedMap code

This is the same problem as bug 15630 where peterl wrote "This is caused by double notifications from the content sink. This should go away with Vidur's fixes". Bug 15630 was indeed fixed about a month ago but the page above still shows the problem. Changing the title to "Double notifications from content sink" and reassigning to Vidur.

Updating QA Contact.

In an attempt to get my bug list in order again, marking all the bugs I have currently as ASSIGNED.

I tried it on today's build and do not see original problem, neither crash nor that gray box appearing. The search box flashes strangely when the page is being resized but finaly paints itself fine. Vidur if can confirm this I don't any reason to keep this one open.

Double notifications definitely don't happen anymore. I can't see the grey box described or reproduce the crash. Since av@netscape.com agrees, I'm going to mark this one fixed.

With the Dec 9th build, this problem has been fixed.