135764 - mozilla crashes in DOM Inspector - Trunk M1RC1 [@ nsTreeBodyFrame::SetBounds]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Wolfgang Fiedler]

startup mozilla. open the DOM Inspector. (Menu Tools -> Web Development -> DOM
Inpector).  Inside the DOMInspector do:
Menu File -> Inspect a Window ->  (choose any window).
On the right half of the window (the Object half) choose from the upper left icon
(near "Object - DOM Node") the entry "XBL Bindings".  This crashes my 
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9+) Gecko/20020404.

Comment 1

[Wolfgang Fiedler]

I changed the OS to All because the bug is also in the windows version!
(checked with build ID: 2002040411)

Comment 2

[Olivier Cahagne]

Reporter, can you post Talkback ID when crashing ?

Comment 3

[Nicholas Allen]

Crashes for me 2002040503 Win2k

TB4874599W

GKLAYOUT! 60440caf()
GKLAYOUT! 60434255()
GKLAYOUT! 60413f72()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 60413f72()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 60413f72()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 60413f72()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 60413f72()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 60413f72()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 60413f72()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 60418aad()
GKLAYOUT! 603c90f1()
GKLAYOUT! 604633c8()
GKLAYOUT! 603c1d57()
GKLAYOUT! 603c6272()
GKVIEW! 60526f92()
GKVIEW! 60521b45()
GKWIDGET! 605344d2()
GKWIDGET! 60537706()
GKWIDGET! 60536512()
GKWIDGET! 605349f0()
USER32! 77e11b60()
USER32! 77e12f29()
USER32! 77e14a44()
NTDLL! 77fa032f()
GKCONTENT! 6022496d()
GKLAYOUT! 603e5c26()
GKLAYOUT! 603c90f1()
GKLAYOUT! 603e4224()
GKLAYOUT! 60437e22()
GKLAYOUT! 60437b69()
GKLAYOUT! 60432a00()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 604341dd()
GKLAYOUT! 60420923()
GKLAYOUT! 60418aad()
GKLAYOUT! 603c90f1()
GKLAYOUT! 604633c8()
GKLAYOUT! 603ccf5a()
GKLAYOUT! 603c645c()
GKLAYOUT! 603c6532()
GKLAYOUT! 603c6334()
XPCOM! 61103712()
778b0c24()

Comment 4

[Wolfgang Fiedler]

A talkback ID for Linux is TB4864501M

Comment 5

[Wolfgang Fiedler]

This is the output from my mozilla binary during the crash. This is from
the CVS source as of 2002-04-06 15:35 CEST  and compiled by me in just under 3 hrs:


XXX Damage rectangle (38,2071,2775,20) does not intersect the widget's view
(0,0,2774,2052)!
GetPrimaryFrameFor() called while FrameManager is being destroyed!
GetPrimaryFrameFor() called while FrameManager is being destroyed!
GetPrimaryFrameFor() called while FrameManager is being destroyed!
XXX Damage rectangle (0,1140,10242,837) does not intersect the widget's view
(0,0,10241,845)!
XXX Damage rectangle (0,2641,10242,837) does not intersect the widget's view
(0,0,10241,845)!
XXX Damage rectangle (0,4712,10242,837) does not intersect the widget's view
(0,0,10241,845)!
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().:
'mRawPtr != 0', file ../../../../dist/include/xpcom/nsCOMPtr.h, line 650
###!!! Break: at file ../../../../dist/include/xpcom/nsCOMPtr.h, line 650



and also the head of the backtrace from gdb 5.1.1


#0  0x41bc7f70 in nsTreeBodyFrame::SetBounds(nsBoxLayoutState&, nsRect const&)
(this=0x852f7ec, 
    aBoxLayoutState=@0xbfffe6d0, aRect=@0xbfffd640) at nsTreeBodyFrame.cpp:594
#1  0x41b3fb6a in nsContainerBox::LayoutChildAt(nsBoxLayoutState&, nsIBox*,
nsRect const&) (
    aState=@0xbfffe6d0, aBox=0x852f818, aRect=@0xbfffd640) at nsContainerBox.cpp:634
#2  0x41b41439 in nsSprocketLayout::Layout(nsIBox*, nsBoxLayoutState&)
(this=0x8272708, 
    aBox=0x852f790, aState=@0xbfffe6d0) at nsSprocketLayout.cpp:205
#3  0x41b3fa54 in nsContainerBox::DoLayout(nsBoxLayoutState&) (this=0x852f790,
aState=@0xbfffe6d0)
    at nsContainerBox.cpp:606

Comment 6

[timeless]

mView is null, i looked through that file, in a lot of cases it's protected 
before use, in later cases it isn't. I can certainly provide a patch for the 
specific crash, but i'd like to know whether we should protect all cases...

Comment 7

[Jay Patel [:jay]]

Adding topcrash+, testcase keywords and nominating for nsbeta1.  This has become
a topcrasher with recent MozillaTrunk builds.  Here is one of the incidents
reported recently running the DOM inspector:

 Incident ID 4928095   
Stack Signature  nsTreeBodyFrame::SetBounds 06b60232
Trigger Time 2002-04-07 13:34:55
Email Address
URL visited http://www.mozilla.org/start/
Build ID 2002040611
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
User Comments Run Dom Inspector. Select page Getting involved with mozilla
Change to XBL binding view with window node selected. crash
Stack Trace
nsTreeBodyFrame::SetBounds
[d:\builds\seamonkey\mozilla\layout\xul\base\src\tree\src\nsTreeBodyFrame.cpp,
line 595]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 638]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 206]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 650]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 206]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 650]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 206]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 650]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 206]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 650]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 206]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 650]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 206]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsContainerBox::LayoutChildAt
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 650]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 206]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsSprocketLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsSprocketLayout.cpp, line 529]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsStackLayout::Layout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsStackLayout.cpp, line 331]
nsContainerBox::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsContainerBox.cpp, line 608]
nsBoxFrame::DoLayout
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1208]
nsBox::Layout [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBox.cpp, line 1052]
nsBoxFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1001]
nsRootBoxFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsRootBoxFrame.cpp, line 243]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 807]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 588]
nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line 217]
PresShell::ProcessReflowCommand
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6280]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6335]
ReflowEvent::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6191]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 597]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 530]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1078]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 309]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1431]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1766]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1784]
WinMainCRTStartup()
KERNEL32.DLL + 0xd326 (0x77e8d326) 

Here is the section of code that's suspect:
593                        PRInt32 rowCount;
594                        mView->GetRowCount(&rowCount);

595 varga        1.106     PRInt32 lastPageTopRow = PR_MAX(0, rowCount -
mPageCount);

The crash is actually at line 594 (although Talkback reports it at 595)...so I'm
guessing a null check for mView just before that wouldn't hurt.

Comment 8

[Peter Trudelle]

Nav triage team needs info: DOM Inspector doesn't appear to be in the NS build,
so is this going to be a MachV issue?

Comment 9

[timeless]

trudelle: this is a bug in trees (formerly outliner), inspector just happens to 
be the easiest way to reproduce this. my guess is that this also happens 
elsewhere, jpatel: do talkback stacks indicate people using anything other than 
inspector?

Comment 10

[Jay Patel [:jay]]

Almost all the comments mention DOM Inspector, but there are a couple of URLs
(which I think the users might have used with the DOM Inspector)...but I'm not
sure.  In either case, we should find out what in the tool is causing this
crash...as it is quite possible that the same problem could exist elsewhere on
the web.

(4993321)
Comments: using DOM Inspector (chose 'XBL Bindings')
     (4991440)	Comments: Trying to fiddle around with DOM Explorer and the java console was
also running
     (4928311)	URL: http://www.mozilla.org/start/
     (4928098)	URL: http://www.mozilla.org/start/
     (4928095)	URL: http://www.mozilla.org/start/
     (4928095)	Comments: Run Dom Inspector.Select page Getting involved with mozillaChange
to XBL binding view with window node selected.crash
     (4927588)	Comments: Using DOM inspector.  Changed to view XBL and crash..
     (4905128)	URL: http://slashdot.org/
     (4905128)	Comments: Using the DOM inspector (in a separate window)  viewing the first
script element.  Had just switched views to "Object Box"  then it crashed when I
tried switching view to "XBL bindings".-Robert
     (4874599)	URL: chrome://navigator/content/navigator.xul
     (4874599)	Comments: Using DOM inspector
     (4866936)	URL: www.mediom.com/~rener/messageriefetes
     (4866710)	URL: www.mediom.com/~rener/messageriefetes
     (4866710)	Comments: Crash using DOM Inspector
     (4864501)	Comments: open the DOM Inspector:  inside DOMInsp:  Menu File ->Ispect a
window ->  choose any window.The on the right half (the Object half) from the
upper left icon near "Object - DON Node"  choose "XBL Bindings"  ...  crash!
     (4829722)	Comments: Crashed in the DOM-viewer
     (4767272)	URL: http://java.sun.com/j2ee/download.html#tutorial

Comment 11

[Håkan Waara]

A crash *always* happens when you try to inspect the XBL bindings of a webpage.
This is a known (crasher) bug, that has received very little attention.

Comment 12

[Jay Patel [:jay]]

hwaara:  which bug are you refering too?  it would be nice to know if that is a
topcrasher in some way also.

Comment 13

[Peter Trudelle]

nsbeta1- per Nav triage team

Comment 14

[Wolfgang Fiedler]

I just downloaded RC1 and this bug is still here!!!  Isnt it about time
to fix this beast?  I mean it is easy to reproduce, we know what happens,
we know why it happens, why is there no fix available?  I really dont want to
see this bug in 1.0 final!   If I could be of any help in fixing this bug, let
me know and I will try my best.

Comment 15

[John Morrison]

timeless: got spackle?

;-)

Comment 16

[Jan Varga [:janv]]

Attachment: proposed fix

Comment 17

[Brian Ryner (not reading)]

Comment on attachment 80008 [details] [diff] [review]
proposed fix

r=bryner

Comment 18

[Jan Varga [:janv]]

-> me

Comment 19

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 80008 [details] [diff] [review]
proposed fix

sr=[e-mail]

Comment 20

[Scott Collins]

Comment on attachment 80008 [details] [diff] [review]
proposed fix

a=scc for checkin to the mozilla 1.0 branch

Comment 21

[Jan Varga [:janv]]

landed on 1.0 branch too
marking fixed

Comment 22

[Asa Dotzler [:asa]]

adding fixed1.0.0 keyword (branch resolution). This bug has comments saying it
was fixed on the 1.0 branch and a bonsai checkin comment that agrees. To verify
the bug has been fixed on the 1.0 branch please replace the fixed1.0.0 keyword
with verified1.0.0.

Comment 23

[Jay Patel [:jay]]

Adding M1RC1 to summary for future reference...this was a topcrasher for Mozilla
1.0 RC1.

Looking at the latest Talkback data, this last crashed:
Mozilla1.0 Branch - build 2002041808
MozillaTrunk - build 2002042212 

Base on that info, this bug can be verified...leaving it up to the QA owner to
do that.