Closed Bug 14253 Opened 26 years ago Closed 26 years ago

Freeing damaged memory in nsCellMap's destructor

Categories

(Core Graveyard :: RDF, defect, P3)

Product:
Core Graveyard
Component:
RDF
Platform:
x86
Windows NT
Type:
defect

Tracking

(Not tracked)

Status:
VERIFIED DUPLICATE of bug 14386

People

(Reporter: bratell, Assigned: alecf)

Details

Overview Description: When I tried the new DOM-viewer I crashed when studying http://www.lysator.liu.se/~bratell/maindata.html Steps to Reproduce: 1) run apprunner 2) close sidebar 3) start DOM-viewer 4) Enter the url http://www.lysator.liu.se/~bratell/maindata.html 5) Click Load in DOM-viewer 6) Click Refresh in DOM-viewer 7) Open HTML 8) Open BODY 9) Close BODY Result: Crash in the row below in nsCellMap.cpp if (nsnull != mIsCollapsedRows) { --->delete [] mIsCollapsedRows; mIsCollapsedRows = nsnull; mNumCollapsedRows = 0; } The full stack trace was: _free_dbg_lk(void * 0x036e80c0, int 1) line 1066 + 60 bytes _free_dbg(void * 0x036e80c0, int 1) line 1001 + 13 bytes operator delete(void * 0x036e80c0) line 49 + 16 bytes nsCellMap::~nsCellMap() line 77 + 18 bytes nsCellMap::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsTableFrame::Reflow(nsTableFrame * const 0x033c2f04, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 2209 + 46 bytes nsTreeFrame::Reflow(nsTreeFrame * const 0x033c2f04, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 325 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x033c2f00, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 439 + 28 bytes nsTableOuterFrame::IR_InnerTableReflow(nsTableOuterFrame * const 0x033c1140, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState & {...}, unsigned int & 0) line 573 + 34 bytes nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsTableOuterFrame * const 0x033c1140, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState & {...}, unsigned int & 0) line 368 + 31 bytes nsTableOuterFrame::IR_TargetIsChild(nsTableOuterFrame * const 0x033c1140, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState & {...}, unsigned int & 0, nsIFrame * 0x033c2f00) line 341 + 31 bytes nsTableOuterFrame::IncrementalReflow(nsTableOuterFrame * const 0x033c1140, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState & {...}, unsigned int & 0) line 324 + 35 bytes nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x033c1144, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 857 + 35 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x033c1140, const nsRect & {...}, int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 229 + 42 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x033c7820, int * 0x0012db8c) line 2958 + 59 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x033c7820, int * 0x0012db8c, int 1) line 2380 + 20 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2178 + 24 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x033c1664, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1417 + 18 bytes nsBoxFrame::FlowChildAt(nsIFrame * 0x033c1660, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsCalculatedBoxInfo & {...}, int & 0, nsString & {...}) line 1051 nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState & {...}, nsIFrame * 0x033c1660, nsCalculatedBoxInfo & {...}) line 365 nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x02f8b190, nsIPresContext & {...}, const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1475 + 44 bytes nsBoxFrame::Reflow(nsBoxFrame * const 0x02f8b154, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 482 nsContainerFrame::ReflowChild(nsIFrame * 0x02f8b150, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 439 + 28 bytes RootFrame::Reflow(RootFrame * const 0x033b5034, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 330 nsContainerFrame::ReflowChild(nsIFrame * 0x033b5030, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 439 + 28 bytes ViewportFrame::Reflow(ViewportFrame * const 0x033b89f4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 516 nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x03775be0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 141 PresShell::ProcessReflowCommands(PresShell * const 0x02f17f10) line 1261 PresShell::ExitReflowLock(PresShell * const 0x02f17f10) line 600 PresShell::ContentRemoved(PresShell * const 0x02f17f18, nsIDocument * 0x02ee8e30, nsIContent * 0x035da1d0, nsIContent * 0x036ebb80, int 30) line 1730 XULDocumentImpl::ContentRemoved(XULDocumentImpl * const 0x02ee8e30, nsIContent * 0x035da1d0, nsIContent * 0x036ebb80, int 30) line 2296 RDFElementImpl::RemoveChildAt(RDFElementImpl * const 0x035da1d0, int 30, int 1) line 2113 RDFGenericBuilderImpl::RemoveGeneratedContent(nsIContent * 0x035da1d0) line 2719 + 18 bytes RDFGenericBuilderImpl::CloseContainer(RDFGenericBuilderImpl * const 0x033b8520, nsIContent * 0x03632ea0) line 815 + 17 bytes XULDocumentImpl::CloseWidgetItem(nsIContent * 0x03632ea0) line 4697 + 22 bytes XULDocumentImpl::AttributeChanged(XULDocumentImpl * const 0x02ee8e30, nsIContent * 0x03632ea0, nsIAtom * 0x00b2d4c0, int -1) line 2170 RDFElementImpl::UnsetAttribute(RDFElementImpl * const 0x03632ea0, int 0, nsIAtom * 0x00b2d4c0, int 1) line 2664 RDFElementImpl::RemoveAttribute(RDFElementImpl * const 0x03632e90, const nsString & {...}) line 1231 + 31 bytes nsTreeTwistyListener::MouseDown(nsIDOMEvent * 0x036edfc0) line 130 + 61 bytes nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 548 + 17 bytes RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x033b4620, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2872 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x035ac790, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2866 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x035b3c80, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2866 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x035c1e30, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2866 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x03632ea0, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2866 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x03632350, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2866 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x03633f90, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2866 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x03633090, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 4, nsEventStatus & nsEventStatus_eIgnore) line 2866 RDFElementImpl::HandleDOMEvent(RDFElementImpl * const 0x03634ca0, nsIPresContext & {...}, nsEvent * 0x0012fbe8, nsIDOMEvent * * 0x0012f99c, unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 2866 PresShell::HandleEvent(PresShell * const 0x02f17f14, nsIView * 0x02f16380, nsGUIEvent * 0x0012fbe8, nsEventStatus & nsEventStatus_eIgnore) line 2025 + 39 bytes nsView::HandleEvent(nsView * const 0x02f16380, nsGUIEvent * 0x0012fbe8, unsigned int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 828 nsViewManager::DispatchEvent(nsViewManager * const 0x02f16880, nsGUIEvent * 0x0012fbe8, nsEventStatus & nsEventStatus_eIgnore) line 1644 HandleEvent(nsGUIEvent * 0x0012fbe8) line 63 nsWindow::DispatchEvent(nsWindow * const 0x02f16244, nsGUIEvent * 0x0012fbe8, nsEventStatus & nsEventStatus_eIgnore) line 332 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbe8) line 353 nsWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 3160 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 3378 nsWindow::ProcessMessage(unsigned int 513, unsigned int 1, long 3735595, long * 0x0012fe08) line 2389 + 24 bytes nsWindow::WindowProc(HWND__ * 0x00010dee, unsigned int 513, unsigned int 1, long 3735595) line 401 + 27 bytes USER32! 77e71820() Build Date & Platform Bug Found: Built from CVS 1999-09-18 ~10:00 AM PST Windows NT SP5, Visual C++ 6 SP3
Status: NEW → ASSIGNED
Target Milestone: M14
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → DUPLICATE
*** This bug has been marked as a duplicate of 14386 ***
Status: RESOLVED → VERIFIED
Verified fixed (if it's a dup I can't verify)
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.