281331 - Keeping Backspace pushed down when the history contains more than 2 entries occasionally causes a crash [@ nsView::SetVisibility]

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[Ryuichi KUBUKI]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050206 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050206 Firefox/1.0+

Pushing Backspace while loading a page occasionally causes a crash.

Incident ID: 3538552

Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 467
Stack Trace 	
nsView::SetVisibility 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 467]
nsIFrame::AreAncestorViewsVisible 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 2444]
nsIFrame::GetScreenRect 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 2322]
nsFrame::CheckInvalidateSizeChange 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 2590]
SortByZOrder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1182]
nsViewManager::UpdateWidgetArea 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1774]
nsView::ResetWidgetBounds 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 398]
nsWindow::CaptureRollupEvents 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1182]
nsWindow::OnKeyDown 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3106]
nsWindow::ConstrainZLevel 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3288]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3827]
nsWindow::StandardWindowCreate 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1500]
USER32.dll + 0x8709 (0x77cf8709)
USER32.dll + 0x87eb (0x77cf87eb)
USER32.dll + 0x89a5 (0x77cf89a5)
USER32.dll + 0x89e8 (0x77cf89e8)
CallOpenSaveFileNameA 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsToolkit.cpp,
line 312]
nsAutoCompleteController::QueryInterface
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x16d4f (0x7c816d4f)

Reproducible: Always

Steps to Reproduce:

Comment 1

[OstGote!]

see bug 281330 too

Comment 2

[Ryuichi KUBUKI]

Bug 281614 occurs at nsView::SetOpacity

Comment 3

[Ryuichi KUBUKI]

Editing the summary. The reproduciblity of this bug seems higher when the
history contains more than 2 entries and you are rapidly going back.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Reassigning for real.

It looks like all the crashes involved have to do with deleted objects being
accessed for some reason....

Comment 5

[Boris Zbarsky [:bzbarsky]]

Could be fixed by the patch in bug 281424.  Please retest in tomorrow's build?