10911 - Showing Channels or sidebar causes nsCellMap precondition

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect, P3)

Description

[[e-mail]]

Overview Description:

Clicking on the MyChannel button or opening and closing the sidebar (by clicking
the grippy) causes nsCellMap::GetCellAt() to throw a precondition.

Steps to Reproduce:

1) Start Mozilla
2) Click on Channels button.
or
2) Click on Sidebar grippy.

Actual Results:

Precondition for Channels

0[9e2bf0]: PreCondition: "GetCellAt: bad row index" ((0 <= aRowIndex) &&
(aRowIndex < mRowCount)) at file
c:\home\mozilla\layout\html\table\src\nsCellMap.h, line 165
0[9e2bf0]: Break: at file c:\home\mozilla\layout\html\table\src\nsCellMap.h,
line 165

Precondition for sidebar:

0[9e2bf0]: PreCondition: "GetCellAt: bad row index" ((0 <= aRowIndex) &&
(aRowIndex < mRowCount)) at file
c:\home\mozilla\layout\html\table\src\nsCellMap.h, line 165
0[9e2bf0]: Break: at file c:\home\mozilla\layout\html\table\src\nsCellMap.h,
line 165

Stack trace for opening channels follows:

KERNEL32! bff768a4()
nsDebug::PreCondition(const char * 0x015c42bc
??_C@_0BJ@KDKB@GetCellAt?3?5bad?5row?5index?$AA@, const char * 0x015c42d8
??_C@_0CM@HBNB@?$CI0?5?$DM?$DN?5aRowIndex?$CJ?5?$CG?$CG?5?$CIaRowIndex?5?$DM@,
const char * 0x015c4304 ??_C@_0DC@KOKC@c?3?2home?2mozilla?2layout?2html?2tabl@,
int 165) line 152 + 13 bytes
nsCellMap::GetCellAt(int 0, int 0) line 165 + 43 bytes
nsTableFrame::GetCellFrameAt(int 0, int 0) line 493 + 16 bytes
FixedTableLayoutStrategy::AssignPreliminaryColumnWidths(int 3000) line 119 + 17
bytes
BasicTableLayoutStrategy::Initialize(nsSize * 0x00000000, int 1, int 3000) line
81
nsTableFrame::BalanceColumnWidths(nsIPresContext & {...}, const
nsHTMLReflowState & {...}, const nsSize & {...}, nsSize * 0x00000000) line 3767
nsTableFrame::Reflow(nsTableFrame * const 0x0a47bc34, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 2243
nsTreeFrame::Reflow(nsTreeFrame * const 0x0a47bc34, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 294
nsContainerFrame::ReflowChild(nsIFrame * 0x0a47bc30, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x0a47a094, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 1006 + 37 bytes
nsBoxFrame::FlowChildAt(nsIFrame * 0x0a47a090, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0,
nsCalculatedBoxInfo & {...}, int & 97460488, nsString & {"To get pref size"})
line 856
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0a47a090, nsCalculatedBoxInfo & {...}) line 226
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x00914a68, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::Reflow(nsBoxFrame * const 0x00914a2c, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 322
nsContainerFrame::ReflowChild(nsIFrame * 0x00914a28, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
RootFrame::Reflow(RootFrame * const 0x0a475494, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 327
nsContainerFrame::ReflowChild(nsIFrame * 0x0a475490, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0a475884, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 513
PresShell::InitialReflow(PresShell * const 0x0a475ee0, int 3000, int 3000) line
979
XULDocumentImpl::StartLayout() line 4079
XULDocumentImpl::LayoutPopupDocument(XULDocumentImpl * const 0x0a472540) line
3145
nsWebShellWindow::CreatePopup(nsWebShellWindow * const 0x00a8d764, nsIDOMElement
* 0x09b60130, nsIDOMElement * 0x09ad13c0, int 608, int 106, const nsString &
{"popup"}, const nsString & {"none"}, const nsString & {"topleft"}, nsIDOMWindow
* 0x098ec2e8, nsIDOMWindow * * 0x09b62de8) line 1369
nsWebShell::CreatePopup(nsWebShell * const 0x00aa8e44, nsIDOMElement *
0x09b60130, nsIDOMElement * 0x09ad13c0, int 608, int 106, const nsString &
{"popup"}, const nsString & {"none"}, const nsString & {"topleft"}, nsIDOMWindow
* 0x098ec2e8, nsIDOMWindow * * 0x09b62de8) line 2415 + 54 bytes
GlobalWindowImpl::CreatePopup(GlobalWindowImpl * const 0x098ec2e8, nsIDOMElement
* 0x09b60130, nsIDOMElement * 0x09ad13c0, int 608, int 106, const nsString &
{"popup"}, const nsString & {"none"}, const nsString & {"topleft"}, nsIDOMWindow
* * 0x09b62de8) line 2354
XULPopupListenerImpl::LaunchPopup(nsIDOMElement * 0x09b60130, int 608, int 106,
int 602, int 62) line 468
XULPopupListenerImpl::LaunchPopup(nsIDOMEvent * 0x0a443290) line 370 + 34 bytes
XULPopupListenerImpl::MouseDown(nsIDOMEvent * 0x0a443290) line 199
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x006af904, nsIDOMEvent * * 0x006af748, unsigned int 3, nsEventStatus &
nsEventStatus_eIgnore) line 524 + 17 bytes
RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x09b60140, nsIPresContext
& {...}, nsEvent * 0x006af904, nsIDOMEvent * * 0x006af748, unsigned int 1,
nsEventStatus & nsEventStatus_eIgnore) line 2361
PresShell::HandleEvent(PresShell * const 0x099140b4, nsIView * 0x099144b0,
nsGUIEvent * 0x006af904, nsEventStatus & nsEventStatus_eIgnore) line 2248 + 39
bytes
nsView::HandleEvent(nsView * const 0x099144b0, nsGUIEvent * 0x006af904, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834
nsViewManager::DispatchEvent(nsViewManager * const 0x099146d0, nsGUIEvent *
0x006af904, nsEventStatus & nsEventStatus_eIgnore) line 1736
HandleEvent(nsGUIEvent * 0x006af904) line 67
nsWindow::DispatchEvent(nsWindow * const 0x09914374, nsGUIEvent * 0x006af904,
nsEventStatus & nsEventStatus_eIgnore) line 490 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x006af904) line 515
nsWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 3257 +
15 bytes
ChildWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line
3430
nsWindow::ProcessMessage(unsigned int 513, unsigned int 1, long 4063834, long *
0x006afb38) line 2520 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00000ad8, unsigned int 513, unsigned int 1, long
4063834) line 563 + 27 bytes
KERNEL32! bff7363b()
KERNEL32! bff942e7()
006a8bba()

This is the stack trace for opening the sidebar:

KERNEL32! bff768a4()
nsDebug::PreCondition(const char * 0x014e42bc
??_C@_0BJ@KDKB@GetCellAt?3?5bad?5row?5index?$AA@, const char * 0x014e42d8
??_C@_0CM@HBNB@?$CI0?5?$DM?$DN?5aRowIndex?$CJ?5?$CG?$CG?5?$CIaRowIndex?5?$DM@,
const char * 0x014e4304 ??_C@_0DC@KOKC@c?3?2home?2mozilla?2layout?2html?2tabl@,
int 165) line 152 + 13 bytes
nsCellMap::GetCellAt(int 0, int 0) line 165 + 43 bytes
nsTableFrame::GetCellFrameAt(int 0, int 0) line 493 + 16 bytes
FixedTableLayoutStrategy::AssignPreliminaryColumnWidths(int 2550) line 119 + 17
bytes
BasicTableLayoutStrategy::Initialize(nsSize * 0x00000000, int 1, int 2550) line
81
nsTableFrame::BalanceColumnWidths(nsIPresContext & {...}, const
nsHTMLReflowState & {...}, const nsSize & {...}, nsSize * 0x00000000) line 3767
nsTableFrame::Reflow(nsTableFrame * const 0x0aadf0c4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 2243
nsTreeFrame::Reflow(nsTreeFrame * const 0x0aadf0c4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 294
nsContainerFrame::ReflowChild(nsIFrame * 0x0aadf0c0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x0aadde04, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 1006 + 37 bytes
nsBoxFrame::FlowChildAt(nsIFrame * 0x0aadde00, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0,
nsCalculatedBoxInfo & {...}, int & 97460488, nsString & {"To get pref size"})
line 856
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0aadde00, nsCalculatedBoxInfo & {...}) line 226
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a01e510, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::Reflow(nsBoxFrame * const 0x0a01e4d4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 322
nsContainerFrame::ReflowChild(nsIFrame * 0x0a01e4d0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
RootFrame::Reflow(RootFrame * const 0x0aadccd4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 327
nsContainerFrame::ReflowChild(nsIFrame * 0x0aadccd0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0aad67f4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 513
PresShell::InitialReflow(PresShell * const 0x0a953e90, int 2550, int 1875) line
979
XULDocumentImpl::StartLayout() line 4079
XULDocumentImpl::EndLoad(XULDocumentImpl * const 0x0a4e91c0) line 1899
XULContentSinkImpl::DidBuildModel(XULContentSinkImpl * const 0x0a4ea430, int 1)
line 546
CWellFormedDTD::DidBuildModel(CWellFormedDTD * const 0x0a953960, unsigned int 0,
int 1, nsIParser * 0x0a4ebd50, nsIContentSink * 0x0a4ea430) line 286 + 20 bytes
nsParser::DidBuildModel(unsigned int 0) line 525 + 55 bytes
nsParser::ResumeParse(nsIDTD * 0x00000000, int 0) line 893
nsParser::EnableParser(int 1) line 619 + 15 bytes
XULContentSinkImpl::DoneLoadingScript(nsIUnicharStreamLoader * 0x0aac2300,
nsString & {"/* -*- Mode: Java; tab-width: 4; indent-tabs-mode: nil;
c-basic-offset: 4 -*-
 *
 * The contents of this file are subject to"}, void * 0x0a4ea430, unsigned int
0) line 1661
nsUnicharStreamLoader::OnStopRequest(nsUnicharStreamLoader * const 0x0aac2304,
nsIChannel * 0x0aac2210, nsISupports * 0x00000000, unsigned int 0, const
unsigned short * 0x00000000) line 161 + 31 bytes
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x0aac5380) line
274
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x0aac5384) line 149 + 12 bytes
PL_HandleEvent(PLEvent * 0x0aac5384) line 509 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00a954b0) line 470 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00000820, unsigned int 53395, unsigned int 0,
long 11097264) line 932 + 9 bytes
KERNEL32! bff7363b()
KERNEL32! bff942e7()
006a8bba()

Comment 1

[joki (gone)]

This would seem to be a table bug, not an event bug.

Comment 2

[karnaze (gone)]

David, this assertion happens with trees. I've changed my local copy of
nsCellMap:GetCellAt to return nsnull in this case (the col index is 0 and
there are no cells in the cellmap) and plan to check it in. Can you tell me if
an assertion is valid here or not. If this condition is ok for trees, then I
won't include an assertion.

Comment 3

[David Hyatt]

Fixed. I wasn't invalidating the column cache when I dynamically created content
(which caused the columns to increase from 0 to the appropriate #).

Comment 4

[Jan Carpenter]

wsargent,
your report doesn't mention which build you saw this problem on so I tried to
recreate it on builds from around that time.  I couldn't get it to crash.  In
light of that, in case I'm not following the steps correctly, could you tell me
if you still see this crash in the current build?

Comment 5

[Jan Carpenter]

From email:
The bug no longer exists in the current build.  Congratulations, you fixed it.
Will.

Marking verified.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1ae1c3f1bb77
[fenix] For https://github.com/mozilla-mobile/fenix/issues/10911: disables flaky createBookmarkFolderTest
https://hg.mozilla.org/integration/autoland/rev/0748ced65482
[fenix] Closes https://github.com/mozilla-mobile/fenix/issues/10911: idling resource registration timing issues (https://github.com/mozilla-mobile/fenix/pull/14231)