107518 - M17rc1 xul Scrollbar within scrollbox causes crash [@ nsViewManager::UpdateView ][@ nsView::GetDimensions]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Wolfgang Grinfeld]

I do not know if this bug depends on bug 77716 . Just in case, I report this - 
see testcase

Comment 1

[Wolfgang Grinfeld]

Attachment: testcase

Comment 2

[Ashley Bischoff (blog at handcoding.com)]

Confirmed crash with 2001102903 on Win2k; marking NEW.

TB37396568E.

CC: [e-mail], for talkback retrieval, please

-> Critical

Comment 3

[[e-mail] (gone - use [e-mail] instead)]

Incident ID 37396568
Stack Signature nsViewManager::UpdateView 29db35f8
Bug ID
Trigger Time 2001-10-30 07:38:22
Email Address [e-mail]
URL visited Testcase on bug report
User Comments
Build ID 2001102906
Product ID MozillaTrunk
Platform ID Win32
Trigger Reason Access violation
Stack Trace
nsViewManager::UpdateView
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1764]
nsViewManager::MoveViewTo
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2315]
nsContainerFrame::PositionFrameView
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 447]
nsBox::SetBounds [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp,
line 573]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 493]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 611]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1142]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1002]
nsScrollBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsScrollBoxFrame.cpp, line 392]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1002]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 525]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 611]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1142]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1002]
nsStackLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsStackLayout.cpp, line 331]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 611]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1142]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1002]
nsBoxFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 944]
nsRootBoxFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsRootBoxFrame.cpp, line 241]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 737]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 576]
PresShell::InitialReflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2700]
nsXMLContentSink::StartLayout
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLContentSink.cpp, line
1689]
nsXMLContentSink::DidBuildModel
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLContentSink.cpp, line
356]
CWellFormedDTD::DidBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 328]
nsParser::DidBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1384]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 1890]
nsParser::OnStopRequest
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2531]
nsDocumentOpenInfo::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 272]
nsStreamListenerTee::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 25]
nsHttpChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2326]
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 177]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 303]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1315]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1632]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1650]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 4

[Håkan Waara]

I have a 'fix' (well, basically a null-check) that makes the testcase not crash
and actually display correctly besides that the scrollbars are not displayed.

I think we should checkin my fix to fix the crash and keep this bug open for the
real fix.

CC kmcclusk -- this nullcheck is in viewmanager code.

Comment 5

[Håkan Waara]

Attachment: Nullcheck to fix the crash

Kevin, can you review?

Comment 6

[Jay Smith]

If clicking the testcase link in the attachments section above is supposed to
result in a crash, be assured that it still does result in a crash of all
Mozilla windows.

I am on: Mozilla 1.2
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2) Gecko/20021202

Viewing on a Windows 95 PC using VNC to run Mozilla on Red Hat 8 server. If you
need any other info, let me know.

Jay

Comment 7

[Adam Hauner]

Still crashing with 2003090204/trunk/W2K

Comment 8

[Simon Miller]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031007
still

Comment 9

[Kurt Weinschenker]

This also shows up in Camino nightly 2004030908 under Mac OS 10.3.2.  Crash bad
enough to activate Apple's crash reporting system.

Comment 10

[Kurt Weinschenker]

Attachment: Crashlog from testcase

Bug also opened Apple's bug reporting system.

Comment 11

[Kevin Berkheiser]

See TB8506Y

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316

Comment 12

[Asa Dotzler [:asa]]

kevin's stack:

nsView::GetDimensions [/mozilla/view/src/nsView.h]
nsView::GetClippedRect [/mozilla/view/src/nsView.cpp, line 841]
nsViewManager::UpdateView [/mozilla/view/src/nsViewManager.cpp, line 1734]
nsViewManager::MoveViewTo [/mozilla/view/src/nsViewManager.cpp, line 2562]
nsContainerFrame::PositionFrameView
[/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 483]
nsBox::SetBounds [/mozilla/layout/xul/base/src/nsBox.cpp, line 584]
nsSprocketLayout::Layout [/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 484]
nsContainerBox::DoLayout [/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 612]
nsBox::Layout [/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsScrollBoxFrame::DoLayout [/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp,
line 337]
nsBox::Layout [/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsSprocketLayout::Layout [/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 520]
nsContainerBox::DoLayout [/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 612]
nsBox::Layout [/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsStackLayout::Layout [/mozilla/layout/xul/base/src/nsStackLayout.cpp, line 322]
nsContainerBox::DoLayout [/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 612]
nsBox::Layout [/mozilla/layout/xul/base/src/nsBox.cpp, line 994]
nsBoxFrame::Reflow [/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 868]
nsRootBoxFrame::Reflow [/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 240]
nsContainerFrame::ReflowChild
[/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 950]
ViewportFrame::Reflow [/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 249]
PresShell::InitialReflow [/mozilla/layout/html/base/src/nsPresShell.cpp, line 2813]
nsContentSink::StartLayout [/mozilla/content/base/src/nsContentSink.cpp, line 962]
nsXMLContentSink::StartLayout
[/mozilla/content/xml/document/src/nsXMLContentSink.cpp, line 830]
nsXMLContentSink::DidBuildModel
[/mozilla/content/xml/document/src/nsXMLContentSink.cpp, line 278]
nsExpatDriver::DidBuildModel [/mozilla/htmlparser/src/nsExpatDriver.cpp, line 1059]
nsParser::DidBuildModel [/mozilla/htmlparser/src/nsParser.cpp, line 1248]
nsParser::ResumeParse [/mozilla/htmlparser/src/nsParser.cpp, line 1820]
nsParser::ContinueParsing [/mozilla/htmlparser/src/nsParser.cpp, line 1361]
gkparser.dll + 0x29364 (0x604d9364)
nsExpatDriver::AddRef [/mozilla/htmlparser/src/nsExpatDriver.cpp, line 306]
0x8556104d

Comment 13

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I'm pretty sure this is the same underlying problem as bug 165469, in which case
this patch is wallpaper at best.

Comment 14

[Asa Dotzler [:asa]]

*** Bug 224659 has been marked as a duplicate of this bug. ***

Comment 15

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 62280 [details] [diff] [review]
Nullcheck to fix the crash

I think we need to fix this for real.

Comment 16

[Jay Patel [:jay]]

Adding M17beta to summary and topcrash keyword.  This is a topcrasher for
Mozilla 1.7beta.

Comment 17

[Jay Patel [:jay]]

*** Bug 165469 has been marked as a duplicate of this bug. ***

Comment 18

[chris hofmann]

will http://bugzilla.mozilla.org/attachment.cgi?id=62280&action=view fix this?

let's get it reviewed and checked in for 1.7 if it will help..

Comment 19

[Robert O'Callahan (:roc) (email my personal email if necessary)]

No, that won't really help.

I can fix this soon, a couple of steps along my view system changes in bug
233441. Probably too big a change for 1.7. If we *really* need a fix just for
1.7 I can probably do one but it will be extra work,

Comment 20

[Jay Patel [:jay]]

This crash is towards the bottom end of the topcrash list for Mozilla 1.7rc1,
but it would still be nice to get in if we can find a fix before 1.7 final.

Comment 21

[Robert O'Callahan (:roc) (email my personal email if necessary)]

OK, I have the fix.

Comment 22

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

This patch fixes this testcase and all the testcases in bugs dependent on this
bug.

See bug 35299 for the explanation of what this patch does.

Now that I've written it, I'm embarrassed at how simple it turned out to be.

Comment 23

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 148380 [details] [diff] [review]
fix

another simple fix.

Note that with this fix, plus a little more work, it would be possible to
create a view for any frame in response to a style change without having to do
frame reconstruction.

Comment 24

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in.

This could conceivably be checked into 1.7, but I'm a bit wary of possible
regressions. I think we should see how things go in 1.8 and possibly backport it
to 1.7.1 (such backporting would be easy, it's a tiny patch).

Comment 25

[Robert O'Callahan (:roc) (email my personal email if necessary)]

*** Bug 107520 has been marked as a duplicate of this bug. ***

Comment 26

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/54417ebbaea2