Closed Bug 86723 Opened 23 years ago Closed 23 years ago

preference dialog crashes

Categories

(SeaMonkey :: Preferences, defect)

defect
Not set
critical

Tracking

(Not tracked)

VERIFIED FIXED
mozilla0.9.8

People

(Reporter: cmeyer, Assigned: janv)

References

Details

(Keywords: crash, regression, topcrash, Whiteboard: [@ 0xffc10000 | 0x00000000 | 0x00000005 | 0x00000009 | 0x000000017 | 0x0000000a - 0x003b008c - nsCSSFrameConstructor::ProcessRestyledFrames | nsCSSFrameConstructor::StyleChangeReflow])

Attachments

(3 files)

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.1+) Gecko/
BuildID:    2001061314



Reproducible: Always
Steps to Reproduce:
1.Open Preferences
2.Click each twist down for the panels once, starting from the bottom (Debug)
towards the top (Appearance)
3.CRASH when you click on the Appearance twist down

Actual Results:  CRASH

Expected Results:  Not a crash... Also scroll bars should appear when list grows
beyond size that will fit in its area.

I noticed this because the scroll bars don't appear always -- this crash seems
to happen if the scroll bars are not appearing...
yow! i can repro this on Mac 9.0x, 2001.06.19.08 comm bits.

confirming. stack coming soon...
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash
this also occurs on linux and winnt.

who should get this?

[not sure if it's worth using nsbeta1 at this point --strangely, i still others
using it.]
OS: MacOS X → All
Hardware: Macintosh → All
winnt stack trace, talkback #31923803:



0x03cf9ee6 
nsCSSFrameConstructor::StyleChangeReflow
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 9515] 
nsCSSFrameConstructor::ProcessRestyledFrames
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 9641] 
nsCSSFrameConstructor::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 10036] 
StyleSetImpl::AttributeChanged
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1154] 
PresShell::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4823] 
nsXULDocument::AttributeChanged
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 1624] 
nsXULElement::UnsetAttribute
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3312] 
nsXULElement::RemoveAttribute
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 1436] 
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 139] 
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1883] 
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1253] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2703] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3322] 
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 938] 
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140] 
nsXBLPrototypeHandler::ExecuteHandler
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp, line 430] 
DoMouse [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLDragHandler.cpp, line 99] 
nsXBLMouseHandler::MouseClick
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseHandler.cpp, line 118] 
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1217] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3631] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3650] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3650] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3650] 
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3650] 
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5519] 
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5491] 
nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2450] 
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1536] 
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5540] 
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5446] 
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 377] 
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2051] 
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68] 
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 719] 
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 736] 
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4225] 
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4470] 
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3224] 
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 984] 
USER32.dll + 0x1820 (0x77e71820) 
no talkback avail with my linux verif build, but i'll see if my debug from 6/14 
exhibits this.

here's a Macsbug trace:

 Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  04F5A950  
  06B7EF80    PPC  04F46120  main+00130
  06B7EF20    PPC  04F45540  main1(int, char**, nsISupports*)+009A0
  06B7EC40    PPC  04D66F80  nsAppShellService::Run()+00018
  06B7EC00    PPC  04D27894  nsAppShell::Run()+00048
  06B7EBB0    PPC  04D282E4  nsMacMessagePump::DoMessagePump()+0003C
  06B7EB60    PPC  04D288D0  nsMacMessagePump::DispatchEvent(int, EventRecord*)+
0005C
  06B7EB10    PPC  04D28C20  nsMacMessagePump::DoMouseDown(EventRecord&)+00100
  06B7EA10    PPC  04D29680  nsMacMessagePump::DoMenu(EventRecord&, long)+00084
  06B7E8C0    PPC  04D2997C  
nsMacMessagePump::DispatchMenuCommandToRaptor(EventRecord&, long
)+00054
  06B7E870    PPC  04D24F6C  nsMacMessageSink::DispatchMenuCommand(EventRecord&, 
long, GrafPo
rt*)+00040
  06B7E820    PPC  04D1FD8C  nsMacWindow::HandleMenuCommand(EventRecord&, long)+
00020
  06B7E7E0    PPC  04D20EF8  nsMacEventHandler::HandleMenuCommand(EventRecord&, 
long)+000D0
  06B7E730    PPC  04D126D8  nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018
  06B7E6F0    PPC  04D125E8  nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&
)+00078
  06B7E6A0    PPC  04D41250  nsMenuBar::MenuSelected(const nsMenuEvent&)+000BC
  06B7E5B0    PPC  04D46768  nsMenu::MenuItemSelected(const nsMenuEvent&)+00838
  06B7DFE0    PPC  04D4AFEC  nsMenuItem::MenuItemSelected(const nsMenuEvent&)+
00088
  06B7DFA0    PPC  04D4B488  nsMenuItem::DoCommand()+00268
  06B7DD90    PPC  049D9EDC  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEv
ent**, unsigned int, nsEventStatus*)+00D88
  06B7D7F0    PPC  047C249C  nsEventListenerManager::HandleEvent(nsIPresContext*, 
nsEvent*, n
sIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*)+02214
  06B7D400    PPC  047C0000  
nsEventListenerManager::HandleEventSubType(nsListenerStruct*, ns
IDOMEvent*, nsIDOMEventTarget*, unsigned int, unsigned int)+00258
  06B7D280    PPC  044F00A8  nsJSEventListener::HandleEvent(nsIDOMEvent*)+00478
  06B7D110    PPC  044D675C  nsJSContext::CallEventHandler(void*, void*, unsigned 
int, void*,
 int*, int)+001BC
  06B7D050    PPC  04DF75A4  JS_CallFunctionValue+00028
  06B7D010    PPC  04E14404  js_InternalInvoke+000BC
  06B7CF50    PPC  04E141C8  js_Invoke+00694
  06B7CE40    PPC  04E1C110  js_Interpret+07218
  06B7CB80    PPC  04E14170  js_Invoke+0063C
  06B7CA70    PPC  04DB7520  XPC_WN_CallMethod(JSContext*, JSObject*, unsigned 
int, long*, lo
ng*)+00138
  06B7C9A0    PPC  04DB1AAC  XPCWrappedNative::CallMethod(XPCCallContext&, 
XPCWrappedNative::
CallMode)+00AFC
  06B7C650    PPC  04EB6BF4  XPTC_InvokeByIndex+0000C
  06B7C610    PPC  04EB6CFC  _XPTC_InvokeByIndex+000C8
  06B7C568    PPC  044E4A48  GlobalWindowImpl::OpenDialog(nsIDOMWindow**)+0020C
  06B7C318    PPC  044E8790  GlobalWindowImpl::OpenInternal(const nsAString&, 
const nsAString
&, const nsAString&, int, long*, unsigned int, nsISupports*, nsIDOMWindow**)+
0048C
  06B7BF78    PPC  07537BD0  nsWindowWatcher::OpenWindowJS(nsIDOMWindow*, const 
char*, const 
char*, const char*, int, unsigned int, long*, nsIDOMWindow**)+010D0
  06B7BA38    PPC  04D72374  nsContentTreeOwner::ShowAsModal()+00018
  06B7B9F8    PPC  04D61984  nsWebShellWindow::ShowModal()+0000C
  06B7B9B8    PPC  04D74A84  nsXULWindow::ShowModal()+0022C
  06B7B918    PPC  04D27FD0  nsAppShell::DispatchNativeEvent(int, void*)+00024
  06B7B8D8    PPC  04D288E4  nsMacMessagePump::DispatchEvent(int, EventRecord*)+
00070
  06B7B888    PPC  04D29328  nsMacMessagePump::DoMouseUp(EventRecord&)+0004C
  06B7B838    PPC  04D298AC  
nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort
*)+00040
  06B7B7E8    PPC  04D24EB8  nsMacMessageSink::DispatchOSEvent(EventRecord&, 
GrafPort*)+00038
  06B7B7A8    PPC  04D1FD0C  nsMacWindow::HandleOSEvent(EventRecord&)+00020
  06B7B768    PPC  04D20CE4  nsMacEventHandler::HandleOSEvent(EventRecord&)+000CC
  06B7B718    PPC  04D22748  nsMacEventHandler::HandleMouseUpEvent(EventRecord&)+
00048
  06B7B688    PPC  04D1281C  nsWindow::DispatchMouseEvent(nsMouseEvent&)+00054
  06B7B628    PPC  04D126D8  nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018
  06B7B5E8    PPC  04D12604  nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&
)+00094
  06B7B598    PPC  043C2350  HandleEvent(nsGUIEvent*)+00058
  06B7B548    PPC  043D3EB0  nsViewManager::DispatchEvent(nsGUIEvent*, 
nsEventStatus*)+0061C
  06B7B418    PPC  043C2F58  nsView::HandleEvent(nsGUIEvent*, unsigned int, 
nsEventStatus*, i
nt, int&)+00248
  06B7B378    PPC  0454DA1C  PresShell::HandleEvent(nsIView*, nsGUIEvent*, 
nsEventStatus*, in
t, int&)+0027C
  06B7B308    PPC  0454DDB0  PresShell::HandleEventInternal(nsEvent*, nsIView*, 
unsigned int,
 nsEventStatus*)+00218
  06B7B2A8    PPC  047C9AD4  nsEventStateManager::PostHandleEvent(nsIPresContext*
, nsEvent*, 
nsIFrame*, nsEventStatus*, nsIView*)+00534
  06B7B098    PPC  047CBAD8  
nsEventStateManager::CheckForAndDispatchClick(nsIPresContext*, n
sMouseEvent*, nsEventStatus*)+0015C
  06B7AF68    PPC  0454DB08  PresShell::HandleEventWithTarget(nsEvent*, nsIFrame*
, nsIContent
*, unsigned int, nsEventStatus*)+00040
  06B7AF18    PPC  0454DCA4  PresShell::HandleEventInternal(nsEvent*, nsIView*, 
unsigned int,
 nsEventStatus*)+0010C
  06B7AEB8    PPC  049D9FD8  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEv
ent**, unsigned int, nsEventStatus*)+00E84
  06B7A918    PPC  049D9FD8  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEv
ent**, unsigned int, nsEventStatus*)+00E84
  06B7A378    PPC  049D9FD8  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEv
ent**, unsigned int, nsEventStatus*)+00E84
  06B79DD8    PPC  049D9FD8  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEv
ent**, unsigned int, nsEventStatus*)+00E84
  06B79838    PPC  049D9EDC  nsXULElement::HandleDOMEvent(nsIPresContext*, 
nsEvent*, nsIDOMEv
ent**, unsigned int, nsEventStatus*)+00D88
  06B79298    PPC  047C06B8  nsEventListenerManager::HandleEvent(nsIPresContext*, 
nsEvent*, n
sIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*)+00430
  06B78EA8    PPC  04961FFC  nsXBLMouseHandler::MouseClick(nsIDOMEvent*)+000B4
  06B78E38    PPC  0495B284  
nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventReceiver*, nsID
OMEvent*)+016A4
  06B78598    PPC  044F00A8  nsJSEventListener::HandleEvent(nsIDOMEvent*)+00478
  06B78428    PPC  044D675C  nsJSContext::CallEventHandler(void*, void*, unsigned 
int, void*,
 int*, int)+001BC
  06B78368    PPC  04DF75A4  JS_CallFunctionValue+00028
  06B78328    PPC  04E14404  js_InternalInvoke+000BC
  06B78268    PPC  04E141C8  js_Invoke+00694
  06B78158    PPC  04E1C110  js_Interpret+07218
  06B77E98    PPC  04E14170  js_Invoke+0063C
  06B77D88    PPC  04DB7520  XPC_WN_CallMethod(JSContext*, JSObject*, unsigned 
int, long*, lo
ng*)+00138
  06B77CB8    PPC  04DB1AAC  XPCWrappedNative::CallMethod(XPCCallContext&, 
XPCWrappedNative::
CallMode)+00AFC
  06B77968    PPC  04EB6BF4  XPTC_InvokeByIndex+0000C
  06B77928    PPC  04EB6CFC  _XPTC_InvokeByIndex+000C8
  06B77880    PPC  049D20B8  nsXULElement::RemoveAttribute(const nsAString&)+
000B0
  06B777F0    PPC  049D8990  nsXULElement::UnsetAttribute(int, nsIAtom*, int)+
00B78
  06B771C0    PPC  04995A9C  nsXULDocument::AttributeChanged(nsIContent*, int, 
nsIAtom*, int)
+000DC
  06B77020    PPC  0454C038  PresShell::AttributeChanged(nsIDocument*, 
nsIContent*, int, nsIA
tom*, int)+0004C
  06B76FD0    PPC  04752024  StyleSetImpl::AttributeChanged(nsIPresContext*, 
nsIContent*, int
, nsIAtom*, int)+00018
  06B76F90    PPC  046187B8  
nsCSSFrameConstructor::AttributeChanged(nsIPresContext*, nsICont
ent*, int, nsIAtom*, int)+009C4
  06B76C20    PPC  046176D8  
nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList&,
 nsIPresContext*)+000A0
  06B76BC0    PPC  046171B4  
nsCSSFrameConstructor::StyleChangeReflow(nsIPresContext*, nsIFra
me*, nsIAtom*)+00060
  06B76B00    PPC  04E82110  nsCOMPtr_base::assign_from_helper(const 
nsCOMPtr_helper&, const 
nsID&)+00028
  06B76AB0    PPC  04E81FDC  nsCOMPtr_base::~nsCOMPtr_base()+00030
 Closing log
updating summary to reflect what was done to incur crash.
Summary: Preference dialog crashes when changing panels → Preference dialog crashes when changing category twisties w/mouse
Crashing in nsCSSFrameConstructor::StyleChangeReflow(), so -> attinasi
Assignee: asa → attinasi
this also occurs if i just use the keyboard [arrow keys] to go thru and expand/
collapse the twisties.

was able to crash using the linux 6/14 debug...just waiting for gdb to respond...
Summary: Preference dialog crashes when changing category twisties w/mouse → Preference dialog crashes when changing category twisties
trace from linux mozilla debug of 6/14:

#0  0x156 in ?? ()
#1  0x415ad52a in nsCOMPtr<nsIBox>::assign_from_helper (this=0xbfffd2cc, 
    helper=@0xbfffd2d0, aIID=@0x41640990)
    at ../../../dist/include/nsCOMPtr.h:971
#2  0x414b979b in nsCSSFrameConstructor::StyleChangeReflow (this=0x87ce4f8, 
    aPresContext=0x87cdc98, aFrame=0x8821e8c, aAttribute=0x0)
    at ../../../../dist/include/nsCOMPtr.h:564
#3  0x414ba117 in nsCSSFrameConstructor::ProcessRestyledFrames (
    this=0x87ce4f8, aChangeList=@0xbfffd488, aPresContext=0x87cdc98)
    at nsCSSFrameConstructor.cpp:9626
#4  0x414bc69e in nsCSSFrameConstructor::AttributeChanged (this=0x87ce4f8, 
    aPresContext=0x87cdc98, aContent=0x87f5058, aNameSpaceID=0, 
    aAttribute=0x8195010, aHint=3) at nsCSSFrameConstructor.cpp:10021
#5  0x4115affd in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so
#6  0x41421e75 in PresShell::AttributeChanged (this=0x87ce590, 
    aDocument=0x87cca70, aContent=0x87f5058, aNameSpaceID=0, 
    aAttribute=0x8195010, aHint=-1) at nsPresShell.cpp:4821
#7  0x4102b00c in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so
#8  0x4100736f in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so
#9  0x40ffd5ef in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so
#10 0x4011a061 in ?? () from /builds/sairuh/mozilla/dist/bin/libxpcom.so
#11 0x407816b9 in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libxpconnect.so
#12 0x40789da2 in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libxpconnect.so
#13 0x401b0fd6 in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so
#14 0x401bb0a2 in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so
#15 0x401b1033 in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so
#16 0x401b125c in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so
#17 0x401927bf in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so
#18 0x4168ed93 in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libjsdom.so
#19 0x416d4796 in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libjsdom.so
#20 0x410ac530 in ?? ()
   from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so

It looks like the primary frame for a XULElement is invalid and is causing the
crash when it is QI'd. The content element is valid in
CSSFrameConstructor::AttributeChanged, but the primaryFrame retrieved from
GetPrimaryFrame comes back looking invalid (or corrupted).

Hyatt, could you take a look? Assign it back if you think it should be mine...
Assignee: attinasi → hyatt
I believe I just had this happen 3 times.

TB32146423H
TB32146407Q
TB32146034X

Build 2001062420 Win2k.
janc, could you tell how often this crash is occurring? thx!
Keywords: nsBranch
Target Milestone: --- → mozilla0.9.3
*** Bug 88383 has been marked as a duplicate of this bug. ***
Yup, got a crash, linux 2001062814
Talkback id: TB32338411Q
I can repro this bug with moz0.9.2/linux every time with the testcase given by
the original reporter. However, only closing the TOP twisty crashes for me, and
even that doesn't every time if the ones below it are opened in some orders.
However, going top-to-bottom opening each one, then closing the top one, crashes
EVERY time for me.
I can't check the database for crashes right now (db access problems,) but it's
not showing up at all on the top40 talkback analysis reports for M092 or trunk
today.
Whoever is working on this bug want to take a look at bug 88652 and figure out
if that bug is a duplicate of this bug?
*** Bug 88652 has been marked as a duplicate of this bug. ***
Attached file Short Mac stack trace
This one is showing up in as many as 15 incidents in the M092 build scattered 
across Mac and Linux. It hides under module level signatures 0x0000007f & 
0xc04a5efc in the Talkback data. (That's why janc didn't find any top40 
incidents on 7/2.) The stack is similar to sairuh's Linux stack of 6/19. (See 
above attachment)

However, it does qualify as a topcrasher. Adding topcrash keyword.
Keywords: topcrash
I see this one in a slightly modified form on Win32, Linux and Mac.

Since the Appearance section is already open, I actually see this when I click
from top to bottom, then close the Appearance section. Scrollbars will briefly
appear, and the *poof*.
Actually, when I first close the Appearance section, then move upward opening
all sections, everything's "fine" (still no scrollbars), but at least I don't
crash. I'm looking at this in a debugger now.
I worked with this some last week and found the following on win32:

If I open all the trees (up to Composer) I do not get a scroll bar.  However, if 
I close the Composer tree... in the DOS box I get 
   frame: box (02BF1558) style: 02BF029C {}
   Wrong parent style context: style: 02BCFE20{}
   should be using: style: 02C118F0 {}

this is found in nsFrameManager.cpp line 1225

This happens after aParentContext != actualParentContext (line 1219).

All continues to work ok... and I get a scroll bar.
I can even continue up to the Appearance twist down and work correctly (allbeit 
continue to get this "Wrong parent style" message).

Yet... if I close out the preference dialog and reopening (following the steps 
above).... I get the same basic message.

Not sure if this helps

However....  
There is a rendering problem in the preferences tree, that I guess leads to the
crash in this bug. To see it (I use win98): click on "Privacy and security" to
open it, and then click on "Mail and newsgroups" to open it. If you will look
closely you'll see that the "Mail and newsgroups" subtree that opens hides or
"overrides" the "Privacy and Security" tree, instead of 
the "Privacy and Security" tree moving lower when the "Mail and newsgroups" tree
opens. Now, If you click on "Appearance" mozilla crashes.

Notice that if you do it in the reverse order: first open "Mail and newsgroups"
and then "Privacy and security", it doesn't happen.
*** Bug 91766 has been marked as a duplicate of this bug. ***
Target Milestone: mozilla0.9.3 → mozilla0.9.4
Status: NEW → ASSIGNED
Target Milestone: mozilla0.9.4 → mozilla1.0
*** Bug 93373 has been marked as a duplicate of this bug. ***
From bug 93373 here are some more talkback traces (from 0.9.3) and his
reproducable steps:

Mozilla 0.9.3 talkback build -- Talkback Incident IDs TB33678580K, TB33679497Z, 
TB33679580H

Here is how I have fairly consistently reproduced this bug in Mozilla 0.9.3 

1.  I bring up Preferences dialog.
2.  Starting from the top of the "Category" pane, I select and view each and 
every category in turn, expanding each group of categories as needed.
3.  Eventually all following categories will have expanded to off the bottom of 
the "Category" pane -- however, the "Category" pane (fairly consistently) does 
not show a scrollbar so that I can scroll down to see them.  [Note: it is 
important to view  each category in turn, not just to expand each group of 
categories.]
4.  I collapse the topmost group of categories, named "Appearance".
5.  At this point, Mozilla 0.9.3 crashes (fairly consistently).

NB: If the scrollbar appears correctly in #3 above, then the crash seems to be 
less likely to occur.
*** Bug 93597 has been marked as a duplicate of this bug. ***
When the scrollbar appears, it is too small and you cant reach the menuitems at
the bottom
*** Bug 97022 has been marked as a duplicate of this bug. ***
Roy Voortman experienced this Bug on build 2001082608 with TB34710445X
(full report can be found here : Bug 59180 - posted 2001-08-30 00:31)
Markus made a typo in the  bug nr. 
The full report can be found in Bug 59108.
I was just able to repro with today's MozillaTrunk build 2001090408 on WinNT. 
Here's my incident:

Incident ID 34953337
Stack Signature 0x00000012 aa427aab
Bug ID
Trigger Time 2001-09-04 19:25:48
Email Address jpatel@netscape.com
User Comments in prefs, expanded as many sections as possible and then collapsed
the top one...reproducing bug 86723
Build ID 2001090410
Product ID MozillaTrunk
Platform ID Win32
Trigger Reason Access violation
Stack Trace
0x00000012
nsCSSFrameConstructor::StyleChangeReflow
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 9735]
nsCSSFrameConstructor::ProcessRestyledFrames
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 9871]
nsCSSFrameConstructor::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 10245]
StyleSetImpl::AttributeChanged
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1230]
PresShell::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4962]
nsXULDocument::AttributeChanged
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 1742]
nsXULElement::UnsetAttr
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3349]
nsXULElement::RemoveAttribute
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 1458]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 139]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1954]
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1263]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2720]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 900]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3362]
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 956]
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140]
nsXBLPrototypeHandler::ExecuteHandler
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp, line 433]
DoMouse
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseMotionHandler.cpp, line 87]
nsXBLMouseHandler::MouseClick
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseHandler.cpp, line 118]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1296]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3711]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5664]
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5634]
nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2466]
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1552]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5685]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5589]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 377]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2058]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 732]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 749]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4264]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4514]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3251]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 997]
USER32.dll + 0x1820 (0x77e71820) 

It's look like we have a reproducible test base and plenty of stack traces...so
if you need any more info from Talkback, let me know.
Summary: Preference dialog crashes when changing category twisties → Preference dialog crashes when changing category twisties - Trunk [@ nsCSSFrameConstructor::StyleChangeReflow]
*** Bug 98331 has been marked as a duplicate of this bug. ***
take a look at bug 98548. It deals with categories in the new Mozillazine
Sidebar which also exhibits this behavior. It might be that any XUL tree is
setting this off (not just preferences).
Blocks: 99227
*** Bug 99882 has been marked as a duplicate of this bug. ***
*** Bug 99902 has been marked as a duplicate of this bug. ***
Hyatt says it is a tree widget bug, should be nsbranch-
Keywords: nsbranchnsbranch-
No longer blocks: 99227
This is a topcrasher with M094.  It's showing up under the stack
signatures: 
0xffc10000 86e4b15e for Mac 
0x00000000 for Linux 
and various others for Win32.  

Adding M094 and [@ 0xffc10000 86e4b15e, 0x00000000, 0x00000005, 0x000000017,
0x0000000a  - nsCSSFrameConstructor::ProcessRestyledFrames,
nsCSSFrameConstructor::StyleChangeReflow] to summary for
tracking.

Here is the latest incident from M094 Mac topcrash reports:
Incident ID 35504171
Stack Signature 0xffc10000 86e4b15e
Bug ID
Trigger Time 2001-09-17 11:23:29
Email Address
User Comments editing preferences. collapsing tabs on the left.
Build ID 2001091311
Product ID Netscape6.20
Platform ID MacOS
Trigger Reason Illegal PowerPC instruction
Stack Trace
0xffc10000
nsCSSFrameConstructor::ProcessRestyledFrames() [nsCSSFrameConstructor.cpp, line
9870]
nsCSSFrameConstructor::AttributeChanged() [nsCSSFrameConstructor.cpp, line 10244]
StyleSetImpl::AttributeChanged() [nsStyleSet.cpp, line 1227]
PresShell::AttributeChanged() [nsPresShell.cpp, line 4956]
nsXULDocument::AttributeChanged() [nsXULDocument.cpp, line 1740]
nsXULElement::UnsetAttr() [nsXULElement.cpp, line 3345] 

This is also being reported on Windows and Linux.  There are A LOT of these
crashes in Talkback, but they are distributed across many different stack
signatures like 0x00000000, 0x00000017, 0x0000000a, 0x00000005 and many others.
 I won't bother pasting in all the information, but you can go to 

http://warp/u/talkback/reports/M094/comment/pref-comment.html

and scan through the incidents there, almost all of them are crashes involving
the collapsing of category twisties in the prefs dialog.  Here is just a couple
of those incidents:

Linux:
Incident ID 35554795
Stack Signature 0x00000000 51be58b7
Bug ID
Trigger Time 2001-09-18 11:27:34
Email Address rice_raymond@hotmail.com
User Comments failed while viewing options in edit->preferences. i was closing
the categories
Build ID 2001091311
Product ID Netscape6.20
Platform ID LinuxIntel
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
0x00000000
nsCSSFrameConstructor::ProcessRestyledFrames()
nsCSSFrameConstructor::AttributeChanged()
StyleSetImpl::AttributeChanged()
PresShell::AttributeChanged()
nsXULDocument::AttributeChanged()
nsXULElement::UnsetAttr()
nsXULElement::RemoveAttribute()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
nsJSContext::CallEventHandler()
nsJSEventListener::HandleEvent()
nsXBLPrototypeHandler::ExecuteHandler()
nsXBLMouseHandler::MouseClick()
nsEventListenerManager::HandleEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
nsXULElement::HandleDOMEvent()
PresShell::HandleEventInternal()
PresShell::HandleEventWithTarget()
nsEventStateManager::CheckForAndDispatchClick()
nsEventStateManager::PostHandleEvent()
PresShell::HandleEventInternal()
PresShell::HandleEvent()
nsView::HandleEvent()
nsViewManager::DispatchEvent()
HandleEvent()
nsWidget::DispatchEvent()
nsWidget::DispatchWindowEvent()
nsWidget::DispatchMouseEvent()
nsWidget::OnButtonReleaseSignal()
nsWindow::HandleGDKEvent()
dispatch_superwin_event()
handle_gdk_event()
libgdk-1.2.so.0 + 0x17077 (0x40313077)
libglib-1.2.so.0 + 0xfe62 (0x40342e62)
libglib-1.2.so.0 + 0x104cb (0x403434cb)
libglib-1.2.so.0 + 0x10681 (0x40343681)
libgtk-1.2.so.0 + 0x8e1e7 (0x402661e7)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x18a42 (0x4043ba42) 

Win32:
Incident ID 35556083
Stack Signature 0x00000005 39c91796
Bug ID
Trigger Time 2001-09-18 11:57:39
User Comments Just installed Mozilla 0.9.4 and clicking away in preferences.
Build ID 2001091311
Product ID Netscape6.20
Platform ID Win32
Trigger Reason Access violation
Stack Trace
0x00000005
nsCSSFrameConstructor::StyleChangeReflow
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 9735]
nsCSSFrameConstructor::ProcessRestyledFrames
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 9871]
nsCSSFrameConstructor::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp,
line 10245]
StyleSetImpl::AttributeChanged
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1230]
PresShell::AttributeChanged
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4958]
nsXULDocument::AttributeChanged
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 1742]
nsXULElement::UnsetAttr
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3349]
nsXULElement::RemoveAttribute
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 1458]
XPTC_InvokeByIndex
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 139]
XPCWrappedNative::CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1954]
XPC_WN_CallMethod
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 1263]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2720]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 900]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3362]
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 956]
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140]
nsXBLPrototypeHandler::ExecuteHandler
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp, line 433]
DoMouse
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseMotionHandler.cpp, line 87]
nsXBLMouseHandler::MouseClick
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseHandler.cpp, line 118]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1296]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3711]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5660]
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5630]
nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2466]
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1552]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5681]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5585]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 377]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2058]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 732]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 749]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4264]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4514]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3251]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 997]
USER32.DLL + 0x2e98 (0x77e12e98)
USER32.DLL + 0x30e0 (0x77e130e0)
USER32.DLL + 0x5824 (0x77e15824)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 453]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1276]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1593]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1611]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08) 


I know this was just given a -, but if we do know what is causing this crash, it
would be nice to get the fix into the next release.  If all the crashes reported
across different stack signatures were put together, this would be in the top 3
of M094 topcrashers.
Summary: Preference dialog crashes when changing category twisties - Trunk [@ nsCSSFrameConstructor::StyleChangeReflow] → Preference dialog crashes when changing category twisties - Trunk & M094 [@ 0xffc10000 86e4b15e, 0x00000000, 0x00000005, 0x000000017, 0x0000000a - nsCSSFrameConstructor::ProcessRestyledFrames, nsCSSFrameConstructor::StyleChangeReflow]
Clean up the crap.
Summary: Preference dialog crashes when changing category twisties - Trunk & M094 [@ 0xffc10000 86e4b15e, 0x00000000, 0x00000005, 0x000000017, 0x0000000a - nsCSSFrameConstructor::ProcessRestyledFrames, nsCSSFrameConstructor::StyleChangeReflow] → Preference dialog crashes when changing category twisties - Trunk & M094
Simon: All that might look like crap to you, but the Talkback team would like to
have it there for tracking purposes...so I'm putting the "crap" back.  Sorry if
it's messy, but it just makes keeping track of topcrashers easier for us.  Thanks.
Summary: Preference dialog crashes when changing category twisties - Trunk & M094 → Preference dialog crashes when changing category twisties - Trunk & M094 [@ 0xffc10000, 0x00000000, 0x00000005, 0x000000017, 0x0000000a - nsCSSFrameConstructor::ProcessRestyledFrames, nsCSSFrameConstructor::StyleChangeReflow]
*** Bug 98548 has been marked as a duplicate of this bug. ***
*** Bug 97323 has been marked as a duplicate of this bug. ***
*** Bug 101278 has been marked as a duplicate of this bug. ***
*** Bug 101705 has been marked as a duplicate of this bug. ***
Sorry, making some changes to the summary again...adding 0x00000009, since this
crash is showing up in Talkback under that stack signature also.  

Collectively, this is probably one of the top 3 crashers for Mozilla
0.9.4...since it's being reported under so many different stack signatures.

Is it too late to reconsider this one the nsbranch?  The following comment was
made before we realized how wide spread this problem was.

------- Additional Comments From Peter Trudelle 2001-09-16 23:19 -------

Hyatt says it is a tree widget bug, should be nsbranch-

Summary: Preference dialog crashes when changing category twisties - Trunk & M094 [@ 0xffc10000, 0x00000000, 0x00000005, 0x000000017, 0x0000000a - nsCSSFrameConstructor::ProcessRestyledFrames, nsCSSFrameConstructor::StyleChangeReflow] → Preference dialog crashes when changing category twisties - Trunk & M094 [@ 0xffc10000 | 0x00000000 | 0x00000005 | 0x00000009 | 0x000000017 | 0x0000000a - nsCSSFrameConstructor::ProcessRestyledFrames | nsCSSFrameConstructor::StyleChangeReflow]
Blocks: 104166
*** Bug 104428 has been marked as a duplicate of this bug. ***
Blocks: 107067
Keywords: nsbranch-
->098
Target Milestone: mozilla1.0 → mozilla0.9.8
I needed to fix this one in our version of 0.9.3 so here is what I did, let me
know if it seems OK.

In nsCSSFrameConstructor::ProcessRestyledFrames I see two problems

1. ChangeAt() expects 0-base indexes so the while statement should be
     while( 0 <= --count )

2. The call to RecreateFramesForContent() should be followed by something that
will break out of the loop, like:
     count = 0;  // force exit from loop
otherwise the frames in the rest of the list will be invalid.

Updating the summary. Still seeing this one on Mac in M095 and N620.
Summary: Preference dialog crashes when changing category twisties - Trunk & M094 [@ 0xffc10000 | 0x00000000 | 0x00000005 | 0x00000009 | 0x000000017 | 0x0000000a - nsCSSFrameConstructor::ProcessRestyledFrames | nsCSSFrameConstructor::StyleChangeReflow] → Preference dialog crashes when changing category twisties - Trunk M095 N620 [@ 0xffc10000 | 0x00000000 | 0x00000005 | 0x00000009 | 0x000000017 | 0x0000000a - 0x003b008c - nsCSSFrameConstructor::ProcessRestyledFrames | nsCSSFrameConstructor::StyleChangeRef…
*** Bug 109689 has been marked as a duplicate of this bug. ***
From attachment 55787 [details] [diff] [review] (Comment #50):  
-  while (0 < count--) {
+  while (0 <= --count) {

These are completely the same, unless I'm going senile.
(I strongly prefer (count-- > 0) but that's beside the point).

So they are, oops. The important part of the patch is exiting the loop early
after calling RecreateFramesForContent(). 

 
*** Bug 111306 has been marked as a duplicate of this bug. ***
*** Bug 111460 has been marked as a duplicate of this bug. ***
*** Bug 113695 has been marked as a duplicate of this bug. ***
*** Bug 114144 has been marked as a duplicate of this bug. ***
*** Bug 114264 has been marked as a duplicate of this bug. ***
hyatt et al., how does this patch look? or, has it bit-rotted? and/or would
conversion to outliner take care of this?
Keywords: patch, review
You shouldn't break out of the change list when recreating frames.  What is
presumably happening is that some frame later in the list is trashed and that
may even be because of a recreate earlier in the list, but the better question
is "How did a descendant frame get into the list of frames to process?"
Keywords: patch, review
stealing
Assignee: hyatt → varga
Status: ASSIGNED → NEW
fixed
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
Ummm... ususally it is good practice to write in the bug how it was
fixed/resolved. There was no patch checked in as far as I know, and none
approved and mentioned in the bug. This bug is then not actually "fixed" without
a patch to repair the error. If the problem is no longer seen, the bug then
becomes "worksforme"
bug 99715 - convert category tree to use outliner  r=hixie sr=blake
checked in by varga at ~3pm PST today.
oh sorry, I thought that it had been already mentionted that conversion to
outliner will fix this problem.
yay! vrfy fixed, using comm bits [2002.01.07.0x] on linux rh7.2, winnt and mac
10.1.2.
Status: RESOLVED → VERIFIED
*** Bug 123125 has been marked as a duplicate of this bug. ***
shortening summary per justdave's orders, summaries will have a shorter limit in
future
Summary: Preference dialog crashes when changing category twisties - Trunk M095 N620 [@ 0xffc10000 | 0x00000000 | 0x00000005 | 0x00000009 | 0x000000017 | 0x0000000a - 0x003b008c - nsCSSFrameConstructor::ProcessRestyledFrames | nsCSSFrameConstructor::StyleChangeRef… → preference dialog crashes
Whiteboard: [@ 0xffc10000 | 0x00000000 | 0x00000005 | 0x00000009 | 0x000000017 | 0x0000000a - 0x003b008c - nsCSSFrameConstructor::ProcessRestyledFrames | nsCSSFrameConstructor::StyleChangeReflow]
Depends on: 99715
Product: Browser → Seamonkey
You need to log in before you can comment on or make changes to this bug.