281743 - crash loading hyatt's weblog [@ nsWindow::SetZIndex]

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I crash loading http://weblogs.mozillazine.org/hyatt/

#5  <signal handler called>
#6  0x04ad6f97 in nsWindow::SetZIndex (this=0x8f4c0a8, aZIndex=100)
    at /builds/trunk/mozilla/widget/src/gtk2/nsWindow.cpp:551
#7  0x01527563 in UpdateNativeWidgetZIndexes (aView=0x8fa9778, aZIndex=100)
    at /builds/trunk/mozilla/view/src/nsView.cpp:574
#8  0x01527889 in nsIView::CreateWidget (this=0x8fa9778,
    aWindowIID=@0x16e1010, aWidgetInitData=0xbff0832c, aNative=0x0,
    aEnableDragDrop=1, aResetVisibility=1, aContentType=eContentTypeInherit)
    at /builds/trunk/mozilla/view/src/nsView.cpp:657
#9  0x011b7a69 in nsHTMLContainerFrame::CreateViewForFrame (aFrame=0x8fca08c,
    aContentParentFrame=0x8fc9e58, aForce=0)
    at /builds/trunk/mozilla/layout/generic/nsHTMLContainerFrame.cpp:584
#10 0x01110325 in nsCSSFrameConstructor::ConstructBlock (this=0x8f739d0,
    aPresShell=0x8f79040, aPresContext=0x8f74390, aState=@0xbff087ac,
    aDisplay=0x902152c, aContent=0x8fcbe60, aParentFrame=0x8fa7b0c,
    aContentParentFrame=0x8fc9e58, aStyleContext=0x902017c,
    aNewFrame=0xbff08554, aFrameItems=@0xbff0878c, aAbsPosContainer=1)
    at /builds/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp:12905
#11 0x01102a3f in nsCSSFrameConstructor::ConstructFrameByDisplayType (
    this=0x8f739d0, aPresShell=0x8f79040, aPresContext=0x8f74390,
    aState=@0xbff087ac, aDisplay=0x902152c, aContent=0x8fcbe60,
    aNameSpaceID=0, aTag=0x86fc9a8, aParentFrame=0x8fc9e58,
    aStyleContext=0x902017c, aFrameItems=@0xbff0878c, aHasPseudoParent=0)
    at /builds/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp:6556
(More stack frames follow...)
(gdb) frame 6
#6  0x04ad6f97 in nsWindow::SetZIndex (this=0x8f4c0a8, aZIndex=100)
    at /builds/trunk/mozilla/widget/src/gtk2/nsWindow.cpp:551
551                 gdk_window_lower(w->mDrawingarea->clip_window);
(gdb) p w
$3 = (nsWindow *) 0x8fe2430
(gdb) p w->mDrawingarea
$4 = (MozDrawingarea *) 0x0

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: partly simplified testcase

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: simplified testcase

Comment 3

[Mats Palmgren (inactive)]

Regression window: 2005-01-25-02 -- 2005-01-28-02  (bug 261238?)
Seems to be GTK2 only.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: bulletproof GTK2 SetZIndex

Comment 5

[Christopher Blizzard (:blizzard)]

Comment on attachment 173927 [details] [diff] [review]
bulletproof GTK2 SetZIndex

>+        if (mDrawingarea) {
>+            gdk_window_raise(mDrawingarea->clip_window);
>+        }

Extra braces here (I never use braces with one line unless it's an else and the
if had braces, too.)

Comment 6

[Christopher Blizzard (:blizzard)]

Oh, but if you fix that it's r/sr+ on the patch.  No need to ping me again.

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 173927 [details] [diff] [review]
bulletproof GTK2 SetZIndex

I'll make those brace changes.

Requesting 1.8b approval --- this is a recent crash regression and the fix is
extremely low risk

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in

Comment 9

[Bob Clary [:bc] (inactive)]

view/crashtests/281743-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3