124421 - Trunk M099 theme crash related to scrollbar [@ nsGfxScrollFrameInner::AddRemoveScrollbar]

Status: VERIFIED WORKSFORME

(Core :: Layout, defect, P1)

Description

[greer]

Theme switching seems to crash M098 and the Trunk with this stack. There are two 
distinct but related stack depending on whether the vertical or horizontal 
scroll bar is being removed first. 


Stack trace(Frame) 

         nsGfxScrollFrameInner::AddRemoveScrollbar
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp  line 
1027] 
         nsGfxScrollFrameInner::RemoveVerticalScrollbar
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp  line 
991] 
         nsGfxScrollFrameInner::Layout
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp  line 
1244] 
         nsGfxScrollFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp  line 
1080] 
         nsBox::Layout  
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp  line 
1052] 
         nsBoxFrame::Reflow     
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp
line 991] 
         nsGfxScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp  line 
789] 
         nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp  line 
771] 
         ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp  line 574] 
         PresShell::ResizeReflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 2811] 
         PresShell::ResizeReflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp  line 6064] 
         nsViewManager::SetWindowDimensions
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp  line 585] 
         nsViewManager::DispatchEvent   
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp
line 1816] 
         HandleEvent    [d:\builds\seamonkey\mozilla\view\src\nsView.cpp  line 
83] 
         nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 854] 
         nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 871] 
         nsWindow::OnResize     
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  
line
4386] 
         nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  line 3654] 
         nsWindow::WindowProc   
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp  
line
1116] 
         KERNEL32.DLL + 0x3613 (0xbff63613)  
         KERNEL32.DLL + 0x248f7 (0xbff848f7)

Comment 1

[greer]

Attachment: Alternate stack

Attaching the alternate stack (caused by the removal of the horizontal scroll
bar), followed by M098 and Trunk user comments.

Comment 2

[Kevin McCluskey (gone)]

Marking nsbeta1+

Comment 3

[greer]

Just repro'ed this one 3 times on Win2000, Trunk build 2002020610 
(ID 2681715, 2681599)
I started with these characteristics:
A. Classic theme 
B. www.google.com
C: Screen sized short and wide so that the vert. scroll bar appears on the right

1. Switch to Early Blue theme.
2. Resize the browser window so that the scroll bar disappears.
3. Crash

Alternately, the scroll bar may not appear after the theme switch (separate 
bug?), in which case resizing can still produce the crash.

Marc or Chris can you guys reproduce this one also?

Comment 4

[Marc Attinasi]

I crash, but with a different stack.

I do get an assertion though, that points to a problem with scrollbars during
the reframe after the frame switch.

void
nsOutlinerBodyFrame::UpdateScrollbar()
{
  // Update the scrollbar.
  nsCOMPtr<nsIContent> scrollbarContent;
  NS_ASSERTION(mScrollbar, "no scroll bar"); ***** THIS IS THE ASSERT I GET
  if (!mScrollbar)
    return;
  mScrollbar->GetContent(getter_AddRefs(scrollbarContent));
  float t2p;
  mPresContext->GetTwipsToPixels(&t2p);
  nscoord rowHeightAsPixels = NSToCoordRound((float)mRowHeight*t2p);

  nsAutoString curPos;
  curPos.AppendInt(mTopRowIndex*rowHeightAsPixels);
  scrollbarContent->SetAttr(kNameSpaceID_None, nsXULAtoms::curpos, curPos, PR_TRUE);
}

I bet that is a big clue to the problems we are having here.

Comment 5

[Kevin McCluskey (gone)]

downgrading bug to nsbeta1-, since we will be removing the dynamic theme
switching for Moz1.0.

http://bugzilla.mozilla.org/show_bug.cgi?id=127784

Comment 6

[Jay Patel [:jay]]

Making topcrash+.  Even if this doesn't get fixed directly, we need to make sure
to verify this is gone after dynamic theme switching is disabled.

Comment 7

[Jay Patel [:jay]]

Updating summary with M099 since this is a topcrasher for Mozilla 0.9.9.  

Comment 8

[Jay Patel [:jay]]

Adding dependency for bug 127784.

Comment 9

[Jan Carpenter]

I can still crash switching themes, but not to this stack signature.  I don't
see this stack at all on the trunk topcrash, and while it is on the M099
topcrash list,  the Build ID range is: 2002031008 to 2002031312.

I'm removing "topcrash+" but leaving "topcrash" for tracking purposes.

Comment 10

[Jay Patel [:jay]]

Marking this worksforme.  There have not been any crashes with recent
MozillaTrunk builds...the last one was with build 2002032211 and checkin to
disable dynamic theme switching went in on 3/24.  We should not see this crash
anymore (at least not until, and if we ever, reenable dynamic theme switching).

Comment 11

[Jay Patel [:jay]]

verified.