14812 - [DOGFOOD][CRASH][PP]Resizing Bookmarks window crashes appruner on Mac

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P1)

Description

[Claudius Gayle]

*Summary
	Resizing and playing with the Manage Bookmarks window on MacOS results in a crash
for me every time.

*To Repro
	Launch apprunner. Select Bookmarks|Manage Bookmarks. Click+Hold size widget
(bottom right corner). Shrink the window such that some of the content is now hidden and
a scrollbar appears. Let go. Size the window again such that it is longer than it needs to be
to display all the content. Let go.

*Actual Results
	After performing the above actions my machine hung for a few seconds (clock froze) and then
crashed (dropped into MacsBug).

*Expected Results
	I should of course be able to resize willy-nilly to my heart's content.

*Build info
	This error is reliably reproduced on my G3 233 running MacOS 8.5 with the 1999092308 build.
I was not able to reproduce this error with Linux or Win32 builds from the same day.

*Additonal Info
	I was using a 'clean' build with the default profile and bookmarks. I had none of the folders
expanded in the tree view. This crash was only triggered when resizing enough to hide content and
then resizing enough to leave 'extra' space. I chose event handling only b/c I saw it kinda high up on
the stack. The entire MacsBug stdlog is included as an attachment to this bug.

Comment 1

[Claudius Gayle]

Attachment: MacsBug log(stack trace)

Comment 2

[joki (gone)]

From the stack trace I'm going to drop this off to style.  The last couple of
calls

CSSStyleSheetImpl::HasStateDependentStyle
nsCSSFrameConstructor::FindPrimaryFrameFor

Seem like they could be suspicious.

Comment 3

[Peter Trudelle]

*** Bug 14556 has been marked as a duplicate of this bug. ***

Comment 4

[Pierre Saslawsky]

Attachment: A better log of the same crash

Comment 5

[Pierre Saslawsky]

The problem still happens after updating my tree. Reassigning to waterson.

As you can see in the second stack trace, it crashes in
nsGenericElement::GetParent() because the mParent was deleted (ie. the zone is
overwritten with $EFEFEFEF) but the mParent pointer wasn't cleared. It's exactly
the problem that you fixed in nsGenericContainerElement last week (see #15511).

Comment 6

[leger]

Putting on [PDT+] radar.

Comment 7

[Pierre Saslawsky]

*** Bug 16747 has been marked as a duplicate of this bug. ***

Comment 8

[Pierre Saslawsky]

The bug #16747 which has been marked as duplicate of this bug can easily be
reproduced on WinNT and it is blocking the mailnews team.
Marking this bug as blocker.

Comment 9

[Pierre Saslawsky]

I can reproduce it anymore. It was certainly fixed as part of #12645 two days
ago. Marking fixed.

Comment 10

[ppandit]

Using a debug build from 10/21, I am not seeing this problem on Windows NT

Par

Comment 11

[ppandit]

I spoke too soon. Just tried again and got the error
"Unhandled exception in mozilla.exe (rdf.dll) 0xc0000005"

Here is the trace:
XULDocumentImpl::AttributeChanged(XULDocumentImpl * const 0x05a6abb0, nsIContent
* 0x05af1940, int 0, nsIAtom * 0x01117800, int -1) line 1760 + 25 bytes
nsXULElement::SetAttribute(nsXULElement * const 0x05af1940, int 0, nsIAtom *
0x01117800, const nsString & {...}, int 1) line 2292
nsSliderFrame::SetCurrentPosition(nsIContent * 0x05af1940, nsIFrame *
0x05afe120, int 0) line 676 + 36 bytes
nsSliderFrame::HandleEvent(nsSliderFrame * const 0x05af7e40, nsIPresContext &
{...}, nsGUIEvent * 0x0012fbcc, nsEventStatus & nsEventStatus_eIgnore) line 531
PresShell::HandleEvent(PresShell * const 0x05a6ddc4, nsIView * 0x05af7db0,
nsGUIEvent * 0x0012fbcc, nsEventStatus & nsEventStatus_eIgnore) line 2209 + 38
bytes
nsView::HandleEvent(nsView * const 0x05af7db0, nsGUIEvent * 0x0012fbcc, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834
nsViewManager::DispatchEvent(nsViewManager * const 0x05a6c780, nsGUIEvent *
0x0012fbcc, nsEventStatus & nsEventStatus_eIgnore) line 1739
HandleEvent(nsGUIEvent * 0x0012fbcc) line 63
nsWindow::DispatchEvent(nsWindow * const 0x05a6c514, nsGUIEvent * 0x0012fbcc,
nsEventStatus & nsEventStatus_eIgnore) line 401 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbcc) line 422
nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 3394 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line
3612
nsWindow::ProcessMessage(unsigned int 512, unsigned int 1, long 20382238, long *
0x0012fdf4) line 2615 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x001b0a6a, unsigned int 512, unsigned int 1, long
20382238) line 579 + 27 bytes
USER32! DispatchMessageWorker@8 + 135 bytes
USER32! DispatchMessageA@4 + 11 bytes
nsAppShell::Run(nsAppShell * const 0x00cc4290) line 74
nsAppShellService::Run(nsAppShellService * const 0x00c70200) line 485
main1(int 1, char * * 0x00c049c0) line 604 + 12 bytes
main(int 1, char * * 0x00c049c0) line 694 + 13 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! BaseProcessStart@4 + 64 bytes

Comment 12

[Claudius Gayle]

VERIFIED fixed with the 1999110508 builds (macand WinNT)