www/73026: firefox crashes on iframe

[Dennis]

>Number:         73026
>Category:       www
>Synopsis:       firefox crashes on iframe
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-www
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Oct 23 03:30:25 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Dennis
>Release:        5.2.1
>Organization:
>Environment:
FreeBSD burr1to.br.no.cox.net 5.2.1-RELEASE FreeBSD 5.2.1-RELEASE #2: Sat Jul 24 00:13:24 CDT 2004     shrek at blah:/usr/obj/usr/src/sys/KERNEL072304  i386
>Description:
Mozilla Firefox 0.10.1 crashes when loading a html file with <IFRAME HEIGHT="33333333">

here is a gdb bt one the core:
#0  0x2892ef09 in _spinlock () from /usr/lib/libc_r.so.5
#1  0x28abb2d0 in malloc () from /lib/libc.so.5
#2  0x288b6697 in g_malloc () from /usr/local/lib/libglib-2.0.so.400
#3  0x285e9290 in gdk_region_intersect () from /usr/X11R6/lib/libgdk-x11-2.0.so.400
#4  0x285e9e48 in gdk_region_subtract () from /usr/X11R6/lib/libgdk-x11-2.0.so.400
#5  0x286073b2 in gdk_window_scroll () from /usr/X11R6/lib/libgdk-x11-2.0.so.400
#6  0x286066e5 in gdk_window_scroll () from /usr/X11R6/lib/libgdk-x11-2.0.so.400
#7  0x286060d4 in gdk_window_scroll () from /usr/X11R6/lib/libgdk-x11-2.0.so.400
#8  0x28614749 in gdk_window_resize () from /usr/X11R6/lib/libgdk-x11-2.0.so.400
#9  0x28c06d56 in moz_drawingarea_resize ()
   from /usr/X11R6/lib/firefox/lib/firefox-0.10.1/components/libwidget_gtk2.so
#10 0x28c0c75f in nsWindow::NativeResize(int, int, int) ()
   from /usr/X11R6/lib/firefox/lib/firefox-0.10.1/components/libwidget_gtk2.so
#11 0x28c12690 in nsCommonWidget::DispatchResizeEvent(nsRect&, nsEventStatus&) ()
   from /usr/X11R6/lib/firefox/lib/firefox-0.10.1/components/libwidget_gtk2.so
#12 0x294575e0 in nsView::SetDimensions(nsRect const&, int) ()
   from /usr/X11R6/lib/firefox/lib/firefox-0.10.1/components/libgklayout.so
#13 0x2945a82e in nsViewManager::CreateRegion(nsIRegion**) ()
   from /usr/X11R6/lib/firefox/lib/firefox-0.10.1/components/libgklayout.so
#14 0x2945d850 in nsViewManager::UpdateViews(nsView*, unsigned) ()
   from /usr/X11R6/lib/firefox/lib/firefox-0.10.1/components/libgklayout.so

>How-To-Repeat:
put <IFRAME HEIGHT="33333333"> into a html file and open it up with firefox
>Fix:
      
>Release-Note:
>Audit-Trail:
>Unformatted: