M5 build Goto page click on frame none button This sets the display style to none crashes nsView::HandleEvent(nsView * const 0x01d8ab70, nsGUIEvent * 0x0012fcbc, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 796 + 7 bytes nsView::HandleEvent(nsView * const 0x01d89690, nsGUIEvent * 0x0012fcbc, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 810 nsView::HandleEvent(nsView * const 0x01d895c0, nsGUIEvent * 0x0012fcbc, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 810 nsScrollingView::HandleEvent(nsScrollingView * const 0x01d895c0, nsGUIEvent * 0x0012fcbc, unsigned int 8, nsEventStatus & nsEventStatus_eIgnore) line 871 nsView::HandleEvent(nsView * const 0x01d69c80, nsGUIEvent * 0x0012fcbc, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore) line 810 nsViewManager::DispatchEvent(nsViewManager * const 0x01d69850, nsGUIEvent * 0x0012fcbc, nsEventStatus & nsEventStatus_eIgnore) line 1723 HandleEvent(nsGUIEvent * 0x0012fcbc) line 67 nsWindow::DispatchEvent(nsWindow * const 0x01c80e84, nsGUIEvent * 0x0012fcbc, nsEventStatus & nsEventStatus_eIgnore) line 414 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fcbc) line 435 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 2890 + 15 bytes nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 524369, long * 0x0012fe38) line 2256 + 24 bytes nsWindow::WindowProc(void * 0x03700dfe, unsigned int 514, unsigned int 0, long 524369) line 478 + 27 bytes USER32!

In nsView's HandleEvent method, it enumerates it's children, then gets the bounds for each. If the event occured within the bounds for a child, it is handed off for processing. Problem is, in this case, GetChild(cng, pKid) returns null. Crashes when trying to get the bounds... Since there is no child there, it obviously can't handle the event so the fix seems to be to simply check for a null value returned: RCS file: /cvsroot/mozilla/view/src/nsView.cpp,v retrieving revision 3.92 diff -c -w -r3.92 nsView.cpp *** nsView.cpp 1999/05/04 23:23:35 3.92 --- nsView.cpp 1999/05/15 00:09:54 *************** *** 801,806 **** --- 801,807 ---- nsIView *pKid; GetChild(cnt, pKid); + if (pKid) { pKid->GetBounds(trect); if (trect.Contains(x, y)) *************** *** 820,825 **** --- 821,827 ---- if (aStatus != nsEventStatus_eIgnore) break; + } } } } OK to check this in?

This was caused by a child being deleted 'under from our feet' while recursively traversing the tree, and we're using a cached number of children. Another solution: use mNumKids instead of numkids. I checked in this crasher fix, but it is a stopgap measure. This problem remains. As in this case, say we have 3 children A, B, and C. We get child at index 0. this is A The event occurs within A, and causes A to be deleted. Next time through the loop we get child at index 1, this is C. We have effectively skipped child B, and may loose an event.

Mass-moving bugs out of M15 that I won't get to. Will refit individual milestones after moving them.

Bulk prioritizing bugs for correct milestones.

nominating for nsbeta2 based on: - visibility - event handling functionality broken

Am investigating...

Another miracle of time. Wait long enough and they fix themselves! The frame none and frame block buttons work great. This actually isn't really a miracle fix. The entire view event dispatch system was rewritten. This just got caught on the way I guess.

Marking VERIFED WORKSFORME on: - MacOS9 2000-06-05-08-M16 Commercial Build - Linux6 2000-06-05-08-M16 Commercial Build - Win98 2000-06-05-08-M16 Commercial Build