136513 - Crash changing font size preference while nsEngineer panel showing

Status: VERIFIED FIXED

(Core :: XUL, defect, P1)

Description

[Suresh Duddi (gone)]

Talkback incident id: 5005292

http://climate.netscape.com/reports/SingleIncidentInfo.cfm?dynamicBBID=5005292
(Netscape internal)

operator []()
nsCOMPtr_base::assign_from_helper()
nsCSSFrameConstructor::ConstructXULFrame()
nsCSSFrameConstructor::ConstructFrameInternal()
nsCSSFrameConstructor::ConstructFrame()
nsCSSFrameConstructor::CreateAnonymousFrames()
nsCSSFrameConstructor::CreateAnonymousFrames()
nsCSSFrameConstructor::ConstructDocElementFrame()
nsCSSFrameConstructor::ReconstructDocElementHierarchy()
StyleSetImpl::ReconstructDocElementHierarchy()
PresShell::ReconstructFrames()
PresShell::SetPreferenceStyleRules()
nsPresContext::PreferenceChanged()
nsPresContext::PrefChangedCallback()
pref_DoCallback()
pref_HashPref()
PREF_SetIntPref()
nsPrefBranch::SetIntPref()
nsPrefService::SetIntPref()
nsPref::SetIntPref()
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod()
XPC_WN_CallMethod()
js_Invoke()
js_Interpret()
js_Invoke()
js_InternalInvoke()
JS_CallFunctionValue()
nsJSContext::CallEventHandler()
GlobalWindowImpl::RunTimeout()
GlobalWindowImpl::TimerCallback()
nsTimerImpl::Process()
handleMyEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0xff9e (0x40392f9e)
libglib-1.2.so.0 + 0x11773 (0x40394773)
libglib-1.2.so.0 + 0x11d39 (0x40394d39)
libglib-1.2.so.0 + 0x11eec (0x40394eec)
libgtk-1.2.so.0 + 0x94333 (0x402b0333)
nsAppShell::Run()
nsAppShellService::Run()
netscape-bin + 0x8c79 (0x08050c79)
netscape-bin + 0x9457 (0x08051457)
libc.so.6 + 0x1c507 (0x404db507)

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Steps to reproduce?

Comment 2

[Suresh Duddi (gone)]

Edit->Preferences

Changed Font from San-Serif : 12 -> 13
My San-Serif font was adobe-helvetica

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

What windows did you have open?

Comment 4

[Suresh Duddi (gone)]

mmh! I played with this more. I get the core dump only if I have the sidebar
open with nsEngineer tab showing:

http://scottcollins.net/panels/ns-engineer-home.shtml

I tried without the sidebar and with different pages open in browser and mail
and those didn't seem to cause the crash. Let me know if you want me to narrow
this down further.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The problem is that, in ConstructXULFrame, GetPopupSetFrame:

5712
          rootBox->GetPopupSetFrame(&popupSetFrame);
5713
          NS_ASSERTION(popupSetFrame, "unexpected null pointer");
5714
          if (popupSetFrame) {

is returning a pointer to a deleted frame.  (I confirmed that it is actually
deleted using my 0xdd marking code in bug 114219 and bug 114221.)

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Do either of you guys (hewitt, ben) know about popupsets?

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Giving this to XUL owner.

Comment 8

[Samir Gehani]

Nav triage team: nsbeta1-

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This is fixed by the patch in attachment 90862 [details] [diff] [review] on bug 156719.

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to trunk, 2002-07-11 18:46 PDT.  See bug 156719.

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Patch was backed out because it was *suspected* of causing a regression.

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 156949 has been marked as a duplicate of this bug. ***

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in, 2002-08-19 11:29 PDT.

Comment 14

[shrirang khanzode]

.