Closed
Bug 237787
Opened 20 years ago
Closed 15 years ago
Using toolbar + arrowscrollbox + menulist crashes mozilla [@ nsViewManager::UpdateView] (nsViewManager]
Categories
(Core :: XUL, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: numessiah, Assigned: hyatt)
References
Details
(Keywords: crash)
Crash Data
Attachments
(1 file)
218 bytes,
application/vnd.mozilla.xul+xml
|
Details |
User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.5) Gecko/20031007 Build Identifier: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.7b) Gecko/20040315 Just load the following file to crash mozilla: /// xulcrash.xul /// <?xml version="1.0"?> <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> <toolbar> <arrowscrollbox> <menulist editable="true"> </menulist> </arrowscrollbox> </toolbar> </window> /// END/// I have reproduced this bug an all releases down to (and including) 1.5 (1.5, 1.6, 1.7a) and on latest nigthly build (20040315) on Windows NT 4.0 (SP6) and Linux (Sue Linux Professional 9.0). Release 1.4.1 seems to work prefectly with this file. So I suppose this is some kind of regressin bug. bb4now, PMC Reproducible: Always Steps to Reproduce: 1. Load the attached file Actual Results: Mozilla crashes. Expected Results: Empty window. This is actualy the reducad test case from bug #235673.
Reporter | ||
Comment 1•20 years ago
|
||
Comment 2•20 years ago
|
||
Confirming with Mozilla 1.7a under WinXP. It crashes right here: NS_IMETHODIMP nsViewManager::UpdateView(nsIView *aView, const nsRect &aRect, PRUint32 aUpdateFlags) { NS_PRECONDITION(nsnull != aView, "null view"); nsView* view = NS_STATIC_CAST(nsView*, aView); // Only Update the rectangle region of the rect that intersects the view's non clipped rectangle nsRect clippedRect; PRBool isClipped; PRBool isEmpty; view->GetClippedRect(clippedRect, isClipped, isEmpty); <---- view == null if (isEmpty) { return NS_OK; } view->ConvertFromParentCoords(&clippedRect.x, &clippedRect.y); Before it crashes I get the following assertions: ###!!! ASSERTION: This hack should not be needed now!!! See bug 126263.: 'Error', file e:/mozilla/debug/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 430 ###!!! ASSERTION: Don't try to move the root widget to something non-zero: 'GetParent() || (aX == 0 && aY == 0)', file e:/mozilla/debug/mozilla/view/src/nsView.cpp, line 293 ###!!! ASSERTION: null view: 'nsnull != aView', file e:/mozilla/debug/mozilla/view/src/nsViewManager.cpp, line 1710 Stacktrace: nsViewManager::UpdateView(nsViewManager * const 0x030e05c8, nsIView * 0x00000000, const nsRect & {...}, unsigned int 4) line 1718 + 15 bytes nsViewManager::MoveViewTo(nsViewManager * const 0x030e05c8, nsIView * 0x03147068, int 225, int 45) line 2556 nsContainerFrame::PositionFrameView(nsIPresContext * 0x030d4b78, nsIFrame * 0x031ab3f0) line 483 nsContainerFrame::PositionChildViews(nsIPresContext * 0x030d4b78, nsIFrame * 0x031ab350) line 987 + 13 bytes nsContainerFrame::PositionChildViews(nsIPresContext * 0x030d4b78, nsIFrame * 0x031ab088) line 989 + 13 bytes nsContainerFrame::PositionChildViews(nsIPresContext * 0x030d4b78, nsIFrame * 0x031aae58) line 989 + 13 bytes nsContainerFrame::PositionChildViews(nsIPresContext * 0x030d4b78, nsIFrame * 0x031aac7c) line 989 + 13 bytes nsBox::SetBounds(nsBox * const 0x031aacb4, nsBoxLayoutState & {...}, const nsRect & {...}) line 585 + 13 bytes nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox * 0x03184008, nsBoxLayoutState & {...}) line 484 nsContainerBox::DoLayout(nsContainerBox * const 0x03184008, nsBoxLayoutState & {...}) line 610 + 34 bytes nsBoxFrame::DoLayout(nsBoxFrame * const 0x03184008, nsBoxLayoutState & {...}) line 1053 nsBox::Layout(nsBox * const 0x03184008, nsBoxLayoutState & {...}) line 994 nsScrollBoxFrame::DoLayout(nsScrollBoxFrame * const 0x03183e7c, nsBoxLayoutState & {...}) line 337 nsBox::Layout(nsBox * const 0x03183e7c, nsBoxLayoutState & {...}) line 994 nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox * 0x031839d4, nsBoxLayoutState & {...}) line 519 nsContainerBox::DoLayout(nsContainerBox * const 0x031839d4, nsBoxLayoutState & {...}) line 610 + 34 bytes nsBoxFrame::DoLayout(nsBoxFrame * const 0x031839d4, nsBoxLayoutState & {...}) line 1053 nsBox::Layout(nsBox * const 0x031839d4, nsBoxLayoutState & {...}) line 994 nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox * 0x03183880, nsBoxLayoutState & {...}) line 519 nsContainerBox::DoLayout(nsContainerBox * const 0x03183880, nsBoxLayoutState & {...}) line 610 + 34 bytes nsBoxFrame::DoLayout(nsBoxFrame * const 0x03183880, nsBoxLayoutState & {...}) line 1053 nsBox::Layout(nsBox * const 0x03183880, nsBoxLayoutState & {...}) line 994 nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox * 0x0318227c, nsBoxLayoutState & {...}) line 519 nsContainerBox::DoLayout(nsContainerBox * const 0x0318227c, nsBoxLayoutState & {...}) line 610 + 34 bytes nsBoxFrame::DoLayout(nsBoxFrame * const 0x0318227c, nsBoxLayoutState & {...}) line 1053 nsBox::Layout(nsBox * const 0x0318227c, nsBoxLayoutState & {...}) line 994 nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox * 0x03181a98, nsBoxLayoutState & {...}) line 519 nsContainerBox::DoLayout(nsContainerBox * const 0x03181a98, nsBoxLayoutState & {...}) line 610 + 34 bytes nsBoxFrame::DoLayout(nsBoxFrame * const 0x03181a98, nsBoxLayoutState & {...}) line 1053 nsBox::Layout(nsBox * const 0x03181a98, nsBoxLayoutState & {...}) line 994 nsStackLayout::Layout(nsStackLayout * const 0x02b5faf8, nsIBox * 0x03181880, nsBoxLayoutState & {...}) line 322 nsContainerBox::DoLayout(nsContainerBox * const 0x03181880, nsBoxLayoutState & {...}) line 610 + 34 bytes nsBoxFrame::DoLayout(nsBoxFrame * const 0x03181880, nsBoxLayoutState & {...}) line 1053 nsBox::Layout(nsBox * const 0x03181880, nsBoxLayoutState & {...}) line 994 nsBoxFrame::Reflow(nsBoxFrame * const 0x03181848, nsIPresContext * 0x030d4b78, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 868 nsRootBoxFrame::Reflow(nsRootBoxFrame * const 0x03181848, nsIPresContext * 0x030d4b78, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 240 nsContainerFrame::ReflowChild(nsIFrame * 0x03181848, nsIPresContext * 0x030d4b78, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 935 + 31 bytes ViewportFrame::Reflow(ViewportFrame * const 0x0318174c, nsIPresContext * 0x030d4b78, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 248 + 43 bytes PresShell::InitialReflow(PresShell * const 0x0315ccd8, int 11820, int 7635) line 2824 nsXULDocument::StartLayout() line 2175 nsXULDocument::ResumeWalk() line 3029 nsXULDocument::EndLoad() line 723 XULContentSinkImpl::DidBuildModel(XULContentSinkImpl * const 0x03056a20) line 460 nsExpatDriver::DidBuildModel(nsExpatDriver * const 0x03182e48, unsigned int 0, int 1, nsIParser * 0x03056bf8, nsIContentSink * 0x03056a20) line 1058 + 12 bytes nsParser::DidBuildModel(unsigned int 0) line 1245 + 46 bytes nsParser::ResumeParse(int 1, int 1, int 1) line 1820 nsParser::OnStopRequest(nsParser * const 0x03056bfc, nsIRequest * 0x03109ef8, nsISupports * 0x00000000, unsigned int 0) line 2472 + 21 bytes nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x03109fa0, nsIRequest * 0x03109ef8, nsISupports * 0x00000000, unsigned int 0) line 353 nsFileChannel::OnStopRequest(nsFileChannel * const 0x03109f00, nsIRequest * 0x0310a768, nsISupports * 0x00000000, unsigned int 0) line 578 nsInputStreamPump::OnStateStop() line 499 nsInputStreamPump::OnInputStreamReady(nsInputStreamPump * const 0x0310a76c, nsIAsyncInputStream * 0x0310a2c4) line 339 + 11 bytes nsInputStreamReadyEvent::EventHandler(PLEvent * 0x0310a7e4) line 119 PL_HandleEvent(PLEvent * 0x0310a7e4) line 671 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00a06ed0) line 606 + 9 bytes nsEventQueueImpl::ProcessPendingEvents(nsEventQueueImpl * const 0x009d2f68) line 391 + 12 bytes nsWindow::DispatchPendingEvents() line 3640 nsWindow::ProcessMessage(unsigned int 257, unsigned int 13, long -1071906815, long * 0x0012fbe8) line 3881 nsWindow::WindowProc(HWND__ * 0x000901c4, unsigned int 257, unsigned int 13, long -1071906815) line 1346 + 27 bytes USER32! 77d43a50() USER32! 77d43b1f() USER32! 77d43d79() USER32! 77d43ddf() nsAppShellService::Run(nsAppShellService * const 0x00a4b3b8) line 484 main1(int 1, char * * 0x002e2638, nsISupports * 0x009aef30) line 1291 + 32 bytes main(int 1, char * * 0x002e2638) line 1678 + 37 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! 77e814c7()
Severity: normal → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: Using toolbar + arrowscrollbox + menulist crashes mozilla → Using toolbar + arrowscrollbox + menulist crashes mozilla [nsViewManager::UpdateView(nsViewManager]
Comment 4•20 years ago
|
||
Also found similar bug 165469. All of them look like dups of bug 107518.
Summary: Using toolbar + arrowscrollbox + menulist crashes mozilla [nsViewManager::UpdateView(nsViewManager] → Using toolbar + arrowscrollbox + menulist crashes mozilla [@ nsViewManager::UpdateView] (nsViewManager]
Blocks: 107518
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: shrir → xptoolkit.widgets
Updated•15 years ago
|
Attachment #144133 -
Attachment mime type: text/plain → application/vnd.mozilla.xul+xml
Comment 5•15 years ago
|
||
No crash for me on Mac using mozilla-central. I'll add this testcase as a crashtest.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
Comment 6•15 years ago
|
||
Crashtest checked in: http://hg.mozilla.org/mozilla-central/rev/45fd81ea3f4b
Flags: in-testsuite+
Updated•13 years ago
|
Crash Signature: [@ nsViewManager::UpdateView] (nsViewManager]
You need to log in
before you can comment on or make changes to this bug.
Description
•