Closed
Bug 402034
Opened 17 years ago
Closed 16 years ago
Crash [@ nsPropertyTable::PropertyList::Equals][@ HandleEvent] with focusing setting iframe to dislay: none
Categories
(Core :: Layout, defect, P2)
Tracking
()
RESOLVED
FIXED
People
(Reporter: martijn.martijn, Assigned: roc)
References
Details
(Keywords: crash, regression, testcase, Whiteboard: [depends on 395609])
Crash Data
Attachments
(2 files)
See testcase, which usually crashes for me after a few reloads. I get a regression range of between 2007-09-20 and 2007-09-22 (but not sure if that says anything): http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-09-20+04&maxdate=2007-09-22+09&cvsroot=%2Fcvsroot http://crash-stats.mozilla.com/report/index/a0ff5823-8872-11dc-ba5e-001a4bd43e5c 0 nsPropertyTable::PropertyList::Equals(unsigned short, nsIAtom*) mozilla/content/base/src/nsPropertyTable.cpp:85 1 nsPropertyTable::GetPropertyListFor(unsigned short, nsIAtom*) mozilla/content/base/src/nsPropertyTable.cpp:295 2 nsPropertyTable::GetPropertyInternal(nsPropertyOwner, unsigned short, nsIAtom*, int, unsigned int*) mozilla/content/base/src/nsPropertyTable.cpp:190 3 nsPropertyTable::GetProperty(nsPropertyOwner, nsIAtom*, unsigned int*) mozilla/content/base/src/nsPropertyTable.h:113 4 nsIFrame::GetProperty(nsIAtom*, unsigned int*) mozilla/layout/generic/nsFrame.cpp:5601 5 nsIFrame::GetView() mozilla/layout/generic/nsFrame.cpp:3310 6 nsFrame::Destroy() mozilla/layout/generic/nsFrame.cpp:480 7 nsSubDocumentFrame::Destroy() mozilla/layout/generic/nsFrameFrame.cpp:624 8 nsFrameList::DestroyFrames() mozilla/layout/generic/nsFrameList.cpp:67 9 nsContainerFrame::Destroy() mozilla/layout/generic/nsContainerFrame.cpp:259 10 nsFrameList::DestroyFrames() mozilla/layout/generic/nsFrameList.cpp:67 etc... The xul code in the window is: <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> <wizard> <browser/> </wizard> </window>
Flags: blocking1.9?
Reporter | ||
Comment 1•17 years ago
|
||
This crashes too (and uses enhanced privileges). Unzip it and then open 'parentframe2.htm' to see the crash. This has a different stacktrace, so that's why I'm attaching this on too. http://crash-stats.mozilla.com/report/index/2c3e39e1-8865-11dc-b188-001a4bd43ed6 0 @0x0 1 HandleEvent mozilla/view/src/nsView.cpp:168 2 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&) mozilla/widget/src/windows/nsWindow.cpp:1075 3 nsWindow::DispatchWindowEvent(nsGUIEvent*, nsEventStatus&) mozilla/widget/src/windows/nsWindow.cpp:1100 4 nsWindow::OnPaint(HDC__*) mozilla/widget/src/windows/nsWindow.cpp:5678 5 nsWindow::ProcessMessage(unsigned int, unsigned int, long, long*) mozilla/widget/src/windows/nsWindow.cpp:4159 6 nsWindow::WindowProc(HWND__*, unsigned int, unsigned int, long) mozilla/widget/src/windows/nsWindow.cpp:1288 7 InternalCallWinProc 8 UserCallWinProcCheckWow 9 DispatchClientMessage 10 __fnDWORD
Reporter | ||
Updated•17 years ago
|
Blocks: 397114
Summary: Crash [@ nsPropertyTable::PropertyList::Equals] with focusing setting iframe to dislay: none → Crash [@ nsPropertyTable::PropertyList::Equals][@ HandleEvent] with focusing setting iframe to dislay: none
Updated•17 years ago
|
OS: Windows XP → All
Comment 2•17 years ago
|
||
I see ###!!! ASSERTION: reflowing in the middle of frame construction: 'mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0', file /home/smaug/mozilla/mozilla_cvs/mozilla/layout/base/nsPresContext.h, line 924 before the crash, when testing the first testcase.
Re-entering reflow sounds like a layout bug. Smaug, what's the stack when you get that assertion?
Component: Event Handling → Layout
QA Contact: events → layout
Comment 4•17 years ago
|
||
I don't get the assert, but I do get the crash, under reflow event processing. The key is: #3 0xb4c80a64 in PresShell::HandlePostedReflowCallbacks (this=0x9269478) at ../../../mozilla/layout/base/nsPresShell.cpp:4375 4375 if (callback->ReflowFinished()) { (gdb) p mIsDestroying $3 = 1 '\001' So either the ReflowFinished() call or something before it killed this presshell.
Comment 5•17 years ago
|
||
Oh, the callback is nsSubDocumentFrame.
Comment 6•17 years ago
|
||
So that crash is due to a local patch that hasn't landed yet... So it's not the issue this bug is about.
Assignee | ||
Updated•17 years ago
|
Flags: blocking1.9? → blocking1.9+
Priority: -- → P4
Assignee | ||
Updated•17 years ago
|
Assignee: nobody → roc
Assignee | ||
Comment 7•17 years ago
|
||
The is the stack for the "reflowing in the middle of frame construction" assertion: #0 NS_DebugBreak_P (aSeverity=1, aStr=0x1852cad8 "reflowing in the middle of frame construction", aExpr=0x1852ca30 "mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0", aFile=0x1852c938 "../../dist/include/layout/nsPresContext.h", aLine=926) at /Users/roc/mozilla-trunk/xpcom/base/nsDebugImpl.cpp:263 #1 0x1859e5eb in nsAutoLayoutPhase::Enter (this=0xbfffc3c8) at ../../dist/include/layout/nsPresContext.h:925 #2 0x1859e714 in nsAutoLayoutPhase::nsAutoLayoutPhase (this=0xbfffc3c8, aPresContext=0x402e0db0, aPhase=eLayoutPhase_Reflow) at ../../dist/include/layout/nsPresContext.h:900 #3 0x17edde8e in PresShell::ProcessReflowCommands (this=0x237f400, aInterruptible=0) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:6267 #4 0x17ede1d0 in PresShell::DoFlushPendingNotifications (this=0x237f400, aType=Flush_Layout, aInterruptibleReflow=0) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:4505 #5 0x17ede3b8 in PresShell::FlushPendingNotifications (this=0x237f400, aType=Flush_Layout) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:4445 #6 0x17eb06be in DocumentViewerImpl::LoadComplete (this=0x40216b60, aStatus=0) at /Users/roc/mozilla-trunk/layout/base/nsDocumentViewer.cpp:946 #7 0x3076859d in nsDocShell::EndPageLoad (this=0x40402490, aProgress=0x404024a4, aChannel=0x4025f8a0, aStatus=0) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.cpp:5019 #8 0x3077228a in nsWebShell::EndPageLoad (this=0x40402490, aProgress=0x404024a4, channel=0x4025f8a0, aStatus=0) at /Users/roc/mozilla-trunk/docshell/base/nsWebShell.cpp:1013 #9 0x30759763 in nsDocShell::OnStateChange (this=0x40402490, aProgress=0x404024a4, aRequest=0x4025f8a0, aStateFlags=131088, aStatus=0) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.cpp:4919 #10 0x30781bcb in nsDocLoader::FireOnStateChange (this=0x40402490, aProgress=0x404024a4, aRequest=0x4025f8a0, aStateFlags=131088, aStatus=0) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:1235 #11 0x30781f22 in nsDocLoader::doStopDocumentLoad (this=0x40402490, request=0x4025f8a0, aStatus=0) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:858 #12 0x30782117 in nsDocLoader::DocLoaderIsEmpty (this=0x40402490) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:763 #13 0x307ce36c in nsDocLoader::ChildDoneWithOnload (this=0x40402490, aChild=0x402de820) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.h:205 #14 0x30782145 in nsDocLoader::DocLoaderIsEmpty (this=0x402de820) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:766 #15 0x30782c26 in nsDocLoader::OnStopRequest (this=0x402de820, aRequest=0x3fcdf470, aCtxt=0x0, aStatus=2152398850) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:679 #16 0x13a4f92f in nsLoadGroup::RemoveRequest (this=0x402dea30, request=0x3fcdf470, ctxt=0x0, aStatus=2152398850) at /Users/roc/mozilla-trunk/netwerk/base/src/nsLoadGroup.cpp:688 #17 0x13a4e782 in nsLoadGroup::Cancel (this=0x402dea30, status=2152398850) at /Users/roc/mozilla-trunk/netwerk/base/src/nsLoadGroup.cpp:341 #18 0x30782263 in nsDocLoader::Stop (this=0x402de820) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:311 #19 0x307b28f9 in nsDocShell::Stop (this=0x402de820) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.h:218 #20 0x3076449c in nsDocShell::Stop (this=0x402de820, aStopFlags=3) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.cpp:3349 #21 0x3076735e in nsDocShell::Destroy (this=0x402de820) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.cpp:3622 #22 0x180f7c99 in nsFrameLoader::Destroy (this=0x3fccad30) at /Users/roc/mozilla-trunk/content/base/src/nsFrameLoader.cpp:265 #23 0x17f1fbac in nsSubDocumentFrame::Destroy (this=0x24daef0) at /Users/roc/mozilla-trunk/layout/generic/nsFrameFrame.cpp:745 #24 0x17f20fd4 in nsFrameList::DestroyFrames (this=0x40800e6c) at /Users/roc/mozilla-trunk/layout/generic/nsFrameList.cpp:67 #25 0x17f08b5f in nsContainerFrame::Destroy (this=0x40800e38) at /Users/roc/mozilla-trunk/layout/generic/nsContainerFrame.cpp:257 #26 0x18069fe0 in nsBoxFrame::Destroy (this=0x40800e38) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsBoxFrame.cpp:961 #27 0x17f20fd4 in nsFrameList::DestroyFrames (this=0x408008b0) at /Users/roc/mozilla-trunk/layout/generic/nsFrameList.cpp:67 #28 0x17f08b5f in nsContainerFrame::Destroy (this=0x4080087c) at /Users/roc/mozilla-trunk/layout/generic/nsContainerFrame.cpp:257 #29 0x18069fe0 in nsBoxFrame::Destroy (this=0x4080087c) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsBoxFrame.cpp:961 #30 0x1807e229 in nsDocElementBoxFrame::Destroy (this=0x4080087c) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsDocElementBoxFrame.cpp:109 #31 0x1806ac04 in nsBoxFrame::RemoveFrame (this=0x40800540, aListName=0x0, aOldFrame=0x4080087c) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsBoxFrame.cpp:1024 #32 0x180655b4 in nsRootBoxFrame::RemoveFrame (this=0x40800540, aListName=0x0, aOldFrame=0x4080087c) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsRootBoxFrame.cpp:212 #33 0x17eb8608 in nsFrameManager::RemoveFrame (this=0x237f41c, aParentFrame=0x40800540, aListName=0x0, aOldFrame=0x4080087c) at /Users/roc/mozilla-trunk/layout/base/nsFrameManager.cpp:694 #34 0x17e8fe6f in nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal (this=0x3fcc2900) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:7821 #35 0x17e8ff91 in nsCSSFrameConstructor::ReconstructDocElementHierarchy (this=0x3fcc2900) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:7764 #36 0x17e90230 in nsCSSFrameConstructor::RecreateFramesForContent (this=0x3fcc2900, aContent=0x237a228) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:11252 #37 0x17e90898 in nsCSSFrameConstructor::RestyleElement (this=0x3fcc2900, aContent=0x237a228, aPrimaryFrame=0x4080087c, aMinHint=0) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:10060 #38 0x17e90aa7 in nsCSSFrameConstructor::ProcessOneRestyle (this=0x3fcc2900, aContent=0x237a228, aRestyleHint=eReStyle_Self, aChangeHint=0) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:13166 #39 0x17e937ac in nsCSSFrameConstructor::ProcessPendingRestyles (this=0x3fcc2900) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:13254 #40 0x17ede15b in PresShell::DoFlushPendingNotifications (this=0x237f400, aType=Flush_Layout, aInterruptibleReflow=1) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:4479 #41 0x17ede302 in PresShell::ReflowEvent::Run (this=0x3fcc1860) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:6045 #42 0x01376cb7 in nsThread::ProcessNextEvent (this=0x29132e0, mayWait=0, result=0xbfffdbf4) at /Users/roc/mozilla-trunk/xpcom/threads/nsThread.cpp:510
Comment 8•17 years ago
|
||
This is possibly a dup of Bug 395609. That one makes the evil part of nsFrameLoader::Destroy asynchronous or executed at a "safe time" - at least tries to.
Assignee | ||
Comment 9•17 years ago
|
||
Yes, I think you're right.
Depends on: 395609
Whiteboard: [depends on 395609]
Priority: P4 → P2
Assignee | ||
Comment 10•16 years ago
|
||
We wouldn't block just for this, although I think we should get the underlying bug fixed for 1.9.
Flags: wanted-next+
Flags: blocking1.9-
Updated•16 years ago
|
Flags: tracking1.9+
Reporter | ||
Comment 11•16 years ago
|
||
This is worksforme, now, using: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008032204 Minefield/3.0b5pre So I guess fixed by bug 395609.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Updated•13 years ago
|
Crash Signature: [@ nsPropertyTable::PropertyList::Equals]
[@ HandleEvent]
You need to log in
before you can comment on or make changes to this bug.
Description
•