Closed Bug 237787 Opened 20 years ago Closed 15 years ago

Using toolbar + arrowscrollbox + menulist crashes mozilla [@ nsViewManager::UpdateView] (nsViewManager]

Categories

(Core :: XUL, defect)

x86
All
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: numessiah, Assigned: hyatt)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

218 bytes, application/vnd.mozilla.xul+xml
Details
User-Agent:       Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.5) Gecko/20031007
Build Identifier: 
Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.7b) Gecko/20040315

Just load the following file to crash mozilla:

/// xulcrash.xul ///
<?xml version="1.0"?>
<window	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
	<toolbar>
		<arrowscrollbox>
			<menulist editable="true">
			</menulist>
		</arrowscrollbox>
	</toolbar>
</window>
/// END///

I have reproduced this bug an all releases down to (and including) 1.5 (1.5,
1.6, 1.7a) and on latest nigthly build (20040315) on Windows NT 4.0 (SP6) and
Linux (Sue Linux Professional 9.0).

Release 1.4.1 seems to work prefectly with this file. So I suppose this is some
kind of regressin bug.

bb4now,
PMC


Reproducible: Always
Steps to Reproduce:
1. Load the attached file

Actual Results:  
Mozilla crashes.

Expected Results:  
Empty window.

This is actualy the reducad test case from bug #235673.
Attached file XUL crashing file
Confirming with Mozilla 1.7a under WinXP.

It crashes right here:

NS_IMETHODIMP nsViewManager::UpdateView(nsIView *aView, const nsRect &aRect,
PRUint32 aUpdateFlags)
{
  NS_PRECONDITION(nsnull != aView, "null view");

  nsView* view = NS_STATIC_CAST(nsView*, aView);

  // Only Update the rectangle region of the rect that intersects the view's non
clipped rectangle
  nsRect clippedRect;
  PRBool isClipped;
  PRBool isEmpty;
  view->GetClippedRect(clippedRect, isClipped, isEmpty);  <---- view == null
  if (isEmpty) {
    return NS_OK;
  }
  view->ConvertFromParentCoords(&clippedRect.x, &clippedRect.y);


Before it crashes I get the following assertions:

###!!! ASSERTION: This hack should not be needed now!!! See bug 126263.:
'Error', file
e:/mozilla/debug/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 430
###!!! ASSERTION: Don't try to move the root widget to something non-zero:
'GetParent() || (aX == 0 && aY == 0)', file
e:/mozilla/debug/mozilla/view/src/nsView.cpp, line 293
###!!! ASSERTION: null view: 'nsnull != aView', file
e:/mozilla/debug/mozilla/view/src/nsViewManager.cpp, line 1710

Stacktrace:

nsViewManager::UpdateView(nsViewManager * const 0x030e05c8, nsIView *
0x00000000, const nsRect & {...}, unsigned int 4) line 1718 + 15 bytes
nsViewManager::MoveViewTo(nsViewManager * const 0x030e05c8, nsIView *
0x03147068, int 225, int 45) line 2556
nsContainerFrame::PositionFrameView(nsIPresContext * 0x030d4b78, nsIFrame *
0x031ab3f0) line 483
nsContainerFrame::PositionChildViews(nsIPresContext * 0x030d4b78, nsIFrame *
0x031ab350) line 987 + 13 bytes
nsContainerFrame::PositionChildViews(nsIPresContext * 0x030d4b78, nsIFrame *
0x031ab088) line 989 + 13 bytes
nsContainerFrame::PositionChildViews(nsIPresContext * 0x030d4b78, nsIFrame *
0x031aae58) line 989 + 13 bytes
nsContainerFrame::PositionChildViews(nsIPresContext * 0x030d4b78, nsIFrame *
0x031aac7c) line 989 + 13 bytes
nsBox::SetBounds(nsBox * const 0x031aacb4, nsBoxLayoutState & {...}, const
nsRect & {...}) line 585 + 13 bytes
nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox *
0x03184008, nsBoxLayoutState & {...}) line 484
nsContainerBox::DoLayout(nsContainerBox * const 0x03184008, nsBoxLayoutState &
{...}) line 610 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x03184008, nsBoxLayoutState & {...})
line 1053
nsBox::Layout(nsBox * const 0x03184008, nsBoxLayoutState & {...}) line 994
nsScrollBoxFrame::DoLayout(nsScrollBoxFrame * const 0x03183e7c, nsBoxLayoutState
& {...}) line 337
nsBox::Layout(nsBox * const 0x03183e7c, nsBoxLayoutState & {...}) line 994
nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox *
0x031839d4, nsBoxLayoutState & {...}) line 519
nsContainerBox::DoLayout(nsContainerBox * const 0x031839d4, nsBoxLayoutState &
{...}) line 610 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x031839d4, nsBoxLayoutState & {...})
line 1053
nsBox::Layout(nsBox * const 0x031839d4, nsBoxLayoutState & {...}) line 994
nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox *
0x03183880, nsBoxLayoutState & {...}) line 519
nsContainerBox::DoLayout(nsContainerBox * const 0x03183880, nsBoxLayoutState &
{...}) line 610 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x03183880, nsBoxLayoutState & {...})
line 1053
nsBox::Layout(nsBox * const 0x03183880, nsBoxLayoutState & {...}) line 994
nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox *
0x0318227c, nsBoxLayoutState & {...}) line 519
nsContainerBox::DoLayout(nsContainerBox * const 0x0318227c, nsBoxLayoutState &
{...}) line 610 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x0318227c, nsBoxLayoutState & {...})
line 1053
nsBox::Layout(nsBox * const 0x0318227c, nsBoxLayoutState & {...}) line 994
nsSprocketLayout::Layout(nsSprocketLayout * const 0x020ef928, nsIBox *
0x03181a98, nsBoxLayoutState & {...}) line 519
nsContainerBox::DoLayout(nsContainerBox * const 0x03181a98, nsBoxLayoutState &
{...}) line 610 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x03181a98, nsBoxLayoutState & {...})
line 1053
nsBox::Layout(nsBox * const 0x03181a98, nsBoxLayoutState & {...}) line 994
nsStackLayout::Layout(nsStackLayout * const 0x02b5faf8, nsIBox * 0x03181880,
nsBoxLayoutState & {...}) line 322
nsContainerBox::DoLayout(nsContainerBox * const 0x03181880, nsBoxLayoutState &
{...}) line 610 + 34 bytes
nsBoxFrame::DoLayout(nsBoxFrame * const 0x03181880, nsBoxLayoutState & {...})
line 1053
nsBox::Layout(nsBox * const 0x03181880, nsBoxLayoutState & {...}) line 994
nsBoxFrame::Reflow(nsBoxFrame * const 0x03181848, nsIPresContext * 0x030d4b78,
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 868
nsRootBoxFrame::Reflow(nsRootBoxFrame * const 0x03181848, nsIPresContext *
0x030d4b78, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 240
nsContainerFrame::ReflowChild(nsIFrame * 0x03181848, nsIPresContext *
0x030d4b78, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0,
int 0, unsigned int 0, unsigned int & 0) line 935 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0318174c, nsIPresContext *
0x030d4b78, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 248 + 43 bytes
PresShell::InitialReflow(PresShell * const 0x0315ccd8, int 11820, int 7635) line
2824
nsXULDocument::StartLayout() line 2175
nsXULDocument::ResumeWalk() line 3029
nsXULDocument::EndLoad() line 723
XULContentSinkImpl::DidBuildModel(XULContentSinkImpl * const 0x03056a20) line 460
nsExpatDriver::DidBuildModel(nsExpatDriver * const 0x03182e48, unsigned int 0,
int 1, nsIParser * 0x03056bf8, nsIContentSink * 0x03056a20) line 1058 + 12 bytes
nsParser::DidBuildModel(unsigned int 0) line 1245 + 46 bytes
nsParser::ResumeParse(int 1, int 1, int 1) line 1820
nsParser::OnStopRequest(nsParser * const 0x03056bfc, nsIRequest * 0x03109ef8,
nsISupports * 0x00000000, unsigned int 0) line 2472 + 21 bytes
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x03109fa0,
nsIRequest * 0x03109ef8, nsISupports * 0x00000000, unsigned int 0) line 353
nsFileChannel::OnStopRequest(nsFileChannel * const 0x03109f00, nsIRequest *
0x0310a768, nsISupports * 0x00000000, unsigned int 0) line 578
nsInputStreamPump::OnStateStop() line 499
nsInputStreamPump::OnInputStreamReady(nsInputStreamPump * const 0x0310a76c,
nsIAsyncInputStream * 0x0310a2c4) line 339 + 11 bytes
nsInputStreamReadyEvent::EventHandler(PLEvent * 0x0310a7e4) line 119
PL_HandleEvent(PLEvent * 0x0310a7e4) line 671 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00a06ed0) line 606 + 9 bytes
nsEventQueueImpl::ProcessPendingEvents(nsEventQueueImpl * const 0x009d2f68) line
391 + 12 bytes
nsWindow::DispatchPendingEvents() line 3640
nsWindow::ProcessMessage(unsigned int 257, unsigned int 13, long -1071906815,
long * 0x0012fbe8) line 3881
nsWindow::WindowProc(HWND__ * 0x000901c4, unsigned int 257, unsigned int 13,
long -1071906815) line 1346 + 27 bytes
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d43d79()
USER32! 77d43ddf()
nsAppShellService::Run(nsAppShellService * const 0x00a4b3b8) line 484
main1(int 1, char * * 0x002e2638, nsISupports * 0x009aef30) line 1291 + 32 bytes
main(int 1, char * * 0x002e2638) line 1678 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e814c7()
Severity: normal → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: Using toolbar + arrowscrollbox + menulist crashes mozilla → Using toolbar + arrowscrollbox + menulist crashes mozilla [nsViewManager::UpdateView(nsViewManager]
Blocks: 151826
No longer blocks: 151826
Depends on: 151826
Keywords: crash
Also found similar bug 165469.  All of them look like dups of bug 107518.  
Summary: Using toolbar + arrowscrollbox + menulist crashes mozilla [nsViewManager::UpdateView(nsViewManager] → Using toolbar + arrowscrollbox + menulist crashes mozilla [@ nsViewManager::UpdateView] (nsViewManager]
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: shrir → xptoolkit.widgets
Attachment #144133 - Attachment mime type: text/plain → application/vnd.mozilla.xul+xml
No crash for me on Mac using mozilla-central.  I'll add this testcase as a crashtest.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
Crashtest checked in: http://hg.mozilla.org/mozilla-central/rev/45fd81ea3f4b
Flags: in-testsuite+
Crash Signature: [@ nsViewManager::UpdateView] (nsViewManager]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: