254415 - An <iframe> tag inside a <arrowscrollbox> crashes the browser [@ nsView::GetDimensions ]

Status: RESOLVED DUPLICATE of bug 38589

(Core :: XUL, defect)

Description

[Ilya Bely]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2

An <iframe> tag inside a <arrowscrollbox> crashes the browser.

It crashes when a XUL is loaded from chrome, local file, or a web server.

Reproducible: Always
Steps to Reproduce:
The following XUL crashes the browser

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://softomate_toolbar/content/style.css"
type="text/css"?>

<window
    id="toolbar-window"
    title="Toolbar"
    orient="horizontal"
    xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
    align="center">

<arrowscrollbox orient="horizontal" flex="1">
        <iframe width="80" src="http://www.mozilla.org/"/>
</arrowscrollbox>

</window>


Actual Results:  
browser crashes

Expected Results:  
display the page

Comment 1

[Adam Hauner]

Ilya: Could you provide TalkBack incident ID of your crash?

Comment 2

[Ilya Bely]

Attachment: talkback dump

I do not know how to get the icident ID send by talkback, I only can say that I
had included id of the bug (254415) into the description.

I'm including the talkback dump into the attachment.

Comment 3

[OstGote!]

(In reply to comment #2)
> I do not know how to get the icident ID send by talkback, I only can say that I
> had included id of the bug (254415) into the description.
Open/run Talkback.exe to see the incident ID. From the start menue group of
Firefox or from [FF_Program_Path]\firefox\components\talkback.exe.

With that ID you can view the whole stack at
http://talkback-public.mozilla.org/talkback/fastfind.jsp
Or you can search for specific comments.

Comment 4

[Adam Hauner]

To get the Talkback ID's go to your Firefox directory and go to components/,
there start talkback.exe, it'll give you a list with the IDs. Thank's a lot.

Comment 5

[Ilya Bely]

the icident id is
nsView::GetDimensions 1e2f735b

Comment 6

[Adam Hauner]

TB488313:
nsView::GetDimensions 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/view/src/nsView.h,
line 248]
nsView::GetClippedRect 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 841]
nsViewManager::UpdateView 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1738]
nsViewManager::MoveViewTo 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2567]
nsContainerFrame::PositionFrameView 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 510]
nsBox::SetBounds 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 584]
nsSprocketLayout::Layout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 484]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBox.cpp,
line 994]
nsRootBoxFrame::Reflow 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp,
line 240]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 249]
PresShell::InitialReflow 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 2827]
nsXULDocument::StartLayout 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 2197]
nsXULDocument::ResumeWalk 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3050]
nsXULDocument::EndLoad 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 746]
XULContentSinkImpl::DidBuildModel 
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULContentSink.cpp,
line 460]

Looks like dupe of bug 38589.

*** This bug has been marked as a duplicate of 38589 ***

Comment 7

[Adam Hauner]

Bug 35299 should be also related (same signature/stack, more similar description).